Enterprise Software Development in Sydney, Australia

Financial Services / Superannuation

A Sydney-based industry superannuation fund (A$45B FUM, 850,000 members, APRA-regulated) managed regulatory compliance through a combination of spreadsheets, email workflows, and manual processes across a 35-person compliance team. The problems: (1) APRA reporting: 47 different regulatory returns to APRA annually — each requiring data from multiple source systems (member administration, investment platform, insurance provider, custodian), manual reconciliation, and multi-level approval. Average preparation time per return: 12 business days. Three returns in the previous year had required resubmission due to errors caught post-lodgement. (2) Member complaints: the fund received 2,400+ member complaints annually. ASIC RG 271 required complaints to be acknowledged within 1 business day and resolved within 45 days (or 90 days for superannuation death benefit complaints). The complaint tracking spreadsheet had no automated escalation — 14% of complaints breached the 45-day deadline in the previous year, each breach requiring a separate report to ASIC. (3) Risk management: APRA CPS 220 required a documented risk management framework with regular risk assessments, incident tracking, and board reporting. The fund's risk register lived in a SharePoint spreadsheet with no automated controls, no integration with incident data, and no systematic review scheduling. Risk committee reporting required 5 days of manual compilation per quarter. (4) Breach reporting: the fund had to report significant breaches to APRA within 10 business days. Identifying what constituted a "significant breach" required manual assessment against ASIC's RG 78 guidance — a process that was inconsistent across the compliance team.

We built a unified compliance platform over 16 weeks: (1) APRA reporting module: automated data extraction from the fund's 6 source systems (member administration — Grow Super, investment platform — Temenos/Multifonds, insurance — TAL, custodian — BNP Paribas, payroll — ADP, banking — CBA). Data reconciliation: automated checks comparing data across sources — flagging discrepancies for human review rather than requiring manual cross-checking of every data point. Report generation: automated population of APRA return templates with reconciled data — the compliance analyst reviewing a pre-populated return rather than building it from scratch. Approval workflow: multi-level sign-off (analyst → senior analyst → compliance manager → CFO) with electronic signatures and audit trail. (2) Complaints management: digital workflow replacing the spreadsheet — member complaints captured through the fund's call centre, website, email, and written correspondence (scanned and OCR-processed). Automated: complaint classification (using keyword analysis and ML classification trained on 3 years of complaint history), acknowledgement letter generation (personalised response sent within 4 hours of receipt), deadline tracking with automated escalation (7-day, 14-day, 30-day, and 40-day escalation alerts to progressively senior staff), and ASIC IDR reporting (Internal Dispute Resolution data compiled automatically for the semi-annual ASIC report). (3) Risk management: digital risk register replacing the SharePoint spreadsheet. Each risk: scored on likelihood and impact, assigned an owner, linked to controls, and scheduled for periodic review. Incident management: staff reporting incidents through the platform — each incident automatically assessed for risk register impact and potential breach implications. Board reporting: automated quarterly risk report generation — pulling risk register status, incident summaries, KRIs (Key Risk Indicators), and trend analysis. (4) Breach assessment: guided breach assessment workflow implementing ASIC RG 78 criteria — when an incident is reported, the platform walks the compliance officer through the significance assessment (impact on members, number affected, systemic vs. isolated, financial impact) and recommends a significance classification. Significant breaches: automatically generating the APRA notification timeline and tracking remediation actions.

APRA reporting: average preparation time from 12 business days to 4 business days per return (67% reduction). Resubmissions: zero in the 12 months following deployment (vs. 3 in the previous year). Automated reconciliation: catching 340+ data discrepancies in the first year that would have previously required post-submission correction — each discrepancy resolved before lodgement. Complaints: acknowledgement time from "variable" (some same-day, some 3+ days) to 100% within 4 hours. 45-day deadline breaches: from 14% to 1.8% (the remaining breaches all complex death benefit complaints correctly extended to 90 days). ASIC IDR reporting: from 3 days of manual compilation to automated generation in 15 minutes. Member satisfaction with complaint handling: improved from 3.1/5 to 4.2/5 (measured by post-resolution survey). Risk management: quarterly board risk report from 5 days of manual compilation to 2 hours of review and refinement. Risk register: 100% of risks reviewed on schedule (vs. 65% in the SharePoint era — many risks had gone years without review). Incident reporting: staff reporting 4x more incidents than previously (300+ annually vs. 75) — not because more incidents were occurring, but because the digital reporting was frictionless compared to the previous email-based process. The compliance manager: calling this "the most valuable outcome — we now see what's actually happening rather than what people remember to report." Breach assessment: consistent classification across the compliance team — eliminating the previous inconsistency where different analysts reached different significance conclusions for similar incidents. Development cost: A$420,000 (16 weeks). Annual value: compliance team efficiency (A$280,000 — 2 FTE equivalent redirected from data compilation to actual compliance oversight), breach prevention (unquantifiable but existentially important — a single significant compliance failure could trigger APRA enforcement action), and board confidence (the board receiving reliable, timely compliance data for the first time). The fund's CEO to the board: "For the first time, I can tell you with confidence what our compliance posture actually is."