Cloud programs that survive
the risk committee
Financial services work carries a second audience. Whatever you build has to satisfy the engineers who run it and the regulator who reviews it — and retrofitting the second audience is where most programs lose a quarter.
The three conversations we have most often in financial services
Core systems that cannot move, and cannot stay
A mainframe or vendor platform nobody will re-write, surrounded by integrations that have to keep working while everything around them changes. The answer is rarely a big-bang migration.
Evidence assembled by hand every quarter
Controls exist — in a spreadsheet, a Confluence page and someone's memory. Producing evidence for an APRA review consumes weeks of senior engineering time that should be spent building.
An AI mandate with no safe data access
The board wants an AI story. The data sits in systems that cannot be reached without a privacy review, so every initiative stalls at proof of concept.
What we do for financial services clients
Four workstreams that show up in nearly every engagement in this sector, usually in this order.
Regulated landing zones
Multi-account foundations where the CPS 234 control set is expressed as Terraform modules and Service Control Policies, so the control and its evidence are the same artefact.
- Control-to-code mapping with traceability
- Preventative guardrails, not detective-only
- Evidence packs generated on demand
Operational resilience under CPS 230
Critical operation mapping, tolerance levels, tested failover and documented severe-but-plausible scenarios — the parts of CPS 230 that are engineering work rather than policy work.
- Critical operations and dependency mapping
- Tested RTO/RPO with evidence
- Third-party and cloud concentration analysis
Data platforms for risk and finance
A governed lakehouse that serves regulatory reporting, risk modelling and member or customer analytics from one lineage-tracked source rather than four reconciled extracts.
- Lineage and data contracts
- Regulatory reporting pipelines
- Consent-aware access controls
AI with an audit trail
Fraud and anomaly detection, adviser and member assistants, and document automation — designed so every output can be traced to its source and every decision has a named human owner.
- Grounded retrieval with citation enforcement
- Model cards and decision logs
- Human-in-the-loop for consequential decisions
The obligations we design against
We are consultants, not your legal advisers. But these frameworks sit on the desk throughout the design phase, and we produce the artefacts your risk function will be asked for.
APRA CPS 234
Information security capability, control testing and incident notification, mapped to deployable AWS controls with generated evidence.
APRA CPS 230
Operational risk management: critical operations, tolerance levels, scenario testing and service provider management.
ISO 27001 / SOC 2
Continuous control evidence for certification and for the due-diligence questionnaires your enterprise clients send.
Shrinking the part of the estate that has to be audited
PCI DSS scope reduction and real-time transaction monitoring on a growing payments platform.
When your page speed belongs to somebody else
Quote aggregation across insurer APIs, rebuilt so one slow partner stops holding up the page.
What financial services clients ask first
Yes, and we prefer to. Where a pattern has already been through your risk process, we extend it rather than propose a replacement that would restart the approval clock.
You do. Evidence generation runs from your pipelines, in your accounts, using your tooling. If we disappeared tomorrow the next quarter's pack would still generate.
We have migrated and integrated around them — including Oracle and SQL Server estates, mainframe adjacency patterns and vendor platforms with restrictive support terms. We are honest about where a vendor constraint makes an option unavailable.
Workloads run in ap-southeast-2 (Sydney) by default, with ap-southeast-4 (Melbourne) as a secondary region where resilience requirements call for it. Any exception is raised explicitly and requires written approval.
Bring us the constraint, not just the goal
The regulator, the vendor contract, the immovable audit date. The earlier those enter the design conversation, the cheaper they are to satisfy.