Cutting through with KSIB
A curated series of topical issues, connecting you to diverse perspectives, going straight to the core of what matters and helping you cut through complexity in
Data, tech and AI, Sustainability, Brand strategy, People, Transformation and
Finance Function advisory.
Cutting through with KSIB
Episode 2 FY27 - Kristin, Steve and Sharon on what matters now in cyber security and sustainability reporting
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
This episode covers two key topics:
1. Steve Brown discusses the AI political narrative versus the practical one. We want to have a conversation around cutting through the noise and focus on successfully and safely implementing AI at scale.
2. Sharon Broekhuizen looks toward year two of sustainability reporting. What have we learned as a market? And what are the 'watch outs' for boards and executives?
Welcome to the second episode of Cutting Through with KSIB for the financial year ended 30 June 2027. I'm Kristin Stubbins, CEO and founder of KSIB, and the found and the owner of this regular podcast where we try to share our reflections on key strategic issues impacting Australian businesses. The two key topics we're going to cover today are firstly, of course, the AI political narrative versus the practical one. We want to have a conversation around cutting through the noise and focusing on successfully and safely implementing AI at scale. The second topic we're going to focus on today is around year two of sustainability reporting. What have we learned as a market? And what are the watch outs for boards and executives? So let me start with the interesting topic number one: the political narrative versus the practical narrative around AI. I personally think there's a real danger here that the AI narrative in Australia becomes very binary and only deals with the extremes. Unfortunately, a little bit around how we went with energy transition. There's sort of a really important reality for the Australian economy that needs to be considered, which is that other economies are advancing with this technology at pace. So there is a window for us to adopt AI at scale and to safely do that. And I think if we don't embrace that opportunity as a market, then we do run the risk of becoming uncompetitive. Not necessarily because AI takes human jobs, but because business models and customer focus is changing globally. So it would be a shame if the narrative does go the same way as the energy transition, where the extreme views get all the media attention. But I would really like to encourage business executives to focus on the practical implications of this AI revolution for their business. As I said before, it is a revolution and it provides an opportunity to reassess strategy and business models. I want to confirm that we have seen some very successful outcomes with positive ROIs where clients have focused on the bigger picture opportunities. And that generally means focusing on customer offerings and service. So putting customer first, and how does AI effectively augment your business strategy, your customer strategy, versus just be a cost-out exercise? And we've seen some successes across many industries, across financial services, but also engineering and manufacturing companies. So what we're seeing in practice is that many of the opportunities to drive business transformation really require careful planning, and they're often through building software using AI rather than whole-scale implementation of probabilistic agentic models. So you can obviously use agents very successfully, and all of this needs to fit together in a system. It just needs to be really carefully planned and managed. So we've started to use a practical framework to help clients with this decision making. And it goes something like this. So first of all, and I talk about this a lot, you know, start with the business opportunity or problem. And that needs to be a clean sheet of paper sort of approach. So what's the opportunity that you're aiming for? What's the outcome that you're aiming for? That's the first question. Because actually, you might be able to redesign a product or redesign a service completely because, you know, legacy things might have come into a process, you might have had technology constraints in history. And maybe the outcome could be achieved by just redesigning the whole thing really simply. And you may not even need any technology. So, first question is answer that question. What's the outcome that you are seeking? Then, assuming that you do need to re-engineer the current process somewhat, you can do that a lot quicker now because AI tooling can support the understanding and documentation of the current process. So you can use AI as a tool to help you understand the process. Human beings respond much better to critiquing something, a piece of uh you know documentation, than creating something from scratch, which can be quite difficult. Once you've understood the process properly, eliminate any unnecessary elements. From an ROI perspective, you really do not want to be just layering AI over a clunky process. And then when you get to that point, you can plan to simplify using the right technology choices. And that may mean actually standing up a deterministic solution, using AI to help with the coding, carefully architected, of course, and Steve will talk more about that. Or it may mean that you do want to create, you know, a family of agents or a group of agents doing different tasks. But all of that needs to be really carefully planned and monitored. So that's sort of what we're thinking and what we're experiencing at a high level.
Cyber Security with Steve Brown
Kristin StubbinsI'd really like for you to now hear from Steve, who many of you know, but if you don't know Steve Brown, he's one of the most experienced and expert technologists and information security experts in the country, and we're really proud to have him working at KSIB and I'd really like to, Steve, ask you a few questions around the noise that's out there at the moment and how we practically cut through. So welcome.
Steve BrownYeah, thanks, Kristin. Good to be here.
Kristin StubbinsSo, so many alarm bells in the last month around AI. What do you think about that?
Steve BrownWell, yeah, it's very interesting. Um, I'd take the warnings seriously. Um, my guess is the recursive AI argument is um worth considering, but probably also requires hardware as well, which is naturally human-gated, I guess. Um, but probably of most benefit to us and organizations is what's the practical value of that for us today and how we can productively use AI.
Kristin StubbinsOkay, so just following on from that, what's your view then on some of the practical steps that Australian executives should be taking to implement AI and not be left behind?
Steve BrownWell, I mean, firstly, the interesting thing in the news about the hacking disclosures from the AI organizations is that um the models got in using basic techniques um such as exploiting weak passwords or unauthenticated endpoints. So the cybersecurity angle to that is very interesting. I mean, they're things that organizations should be focusing on today, regardless, anyway. They're about visibility of your estate and what security controls you have. Um and then I think um in terms of the practical steps organizations can take, most good solutions are going to combine both deterministic and probabilistic tools. So by that I mean a lot of the danger and the benefit in AI is um around what controls it has or what it's allowed to do. LLM by itself just takes text in and gives you text back out. It doesn't actually do anything. So the power and the danger is around the harnesses and controls you put around it. Um in that regard, though, I think it's extremely powerful. And as you said, there's huge potential benefit in adopting AI when it's used in the right way.
Kristin StubbinsYeah. And certainly that's, as I said before, that's what we're seeing in terms of evidence in the market as well. Um, so if you're a company, Steve, that doesn't have a really large cybersecurity team, you know, obviously this has been one of the things that's been most prevalent in the in the news in the in recent times is sort of mythos and um and then even just today, um, and we're recording this podcast, um, the Prime Minister's talked about um an open AI agent hacking um Medicare. So everyone is on edge around this. But if you're sort of, you know, let's say a company that's a decent size, but you don't have, you know, a massive cybersecurity team, what should you be thinking about? And especially if you're a board or an executive who who's not close to this world?
Steve BrownYeah, interesting. I think that the like the news is certainly valid, um, but to a large extent too, tools like Mythos and and others, um, they are a tool. So the concern really is what attackers can do with these increasingly capable tools. Um, and I guess the good news is the defenders, us the good guys, have access to that same capability or can get access to it. What's really changed is the attacker economics, I think. Um historically, organizations might have been safe because no one was out there discovering them and attacking them. Well, now it's so simple to leverage any AI to perform that attack. And patching has become the constraint for most organizations. How quickly can you can you um solve the problem? Um for companies in terms of the um adopting AI for their benefit and protecting against those sort of threats, I think it's important that they have a strong end-to-end framework that they approach all this with. Um and there's a few critical questions then that um they might ask or boards might ask related to that. So um, you know, the obvious questions are going to be what could seriously harm us? Um, how much risk are you choosing then to carry? And what are we doing about it? And how do you know it works? And that how do you know it works is really important. And you can leave rich AI through all those steps, I think.
Kristin StubbinsYeah, and so um, if you're listening to this and you're interested in learning more, um I'd encourage you to contact us, or also uh we're going to release um a more detailed newsletter on on cyber very shortly. And Steve has written an a practical guide to all of these steps that uh companies should take and how they go about implementing them. So rather
Sustainability reporting/ Sharon Broekhuizen
Kristin Stubbinsthan just sort of talking about this at a very high level, which most frameworks seem to do, we've built the guide that sort of says, well, this is what you practically have to do to respond to this challenge. So watch this space and uh, you know, if you want to talk about it further, contact either Steve or I. So thanks, Steve, for those insights. I think uh it's an interesting, challenging, and exciting time that we are living in, and I'm really grateful that I um have the ability to talk to you about these issues.
Steve BrownThanks, Kristen. Great opportunity to share my experience as well. Cheers.
Kristin StubbinsSo we're going to shift gears now and talk about sustainability reporting. We're in year two of sustainability reporting for large companies. So our second topic is about what we've learned as a market and what are the 'watch outs' for boards and executives. And I am going to ask Sharon Broekhuizen, who works with us and leads our sustainability work, to share some of her reflections in this space. But before we go into that, first of all, if your organization has got through its first report, well, congratulations. Um, but unfortunately, there's still a lot more work to do, I'm sorry to say. And that's particularly because of scope three now being relevant for many, many companies. Um, so Sharon, welcome to the podcast. Thanks for having me. So uh I guess what are your key messages for boards and and executives at this point?
Sharon BroekhuizenSo, for boards and executives of Group One companies, which are our largest emitters in Australia, our biggest companies, um, I'll echo your sentiment around congratulations for getting through year one, because it was a huge effort. Um, we've seen really interesting reports come out from some of the big firms and also from the regulators identifying the parts that were done well and the parts that probably need a bit more work. But I would say on the whole, um, certainly the regulators' view is that it was a really good attempt in year one. So that's a great foundation to build on. For those group one reporters, they are now approaching a period that's going to require a significant step up in effort and complexity. So your second year of reporting as a group one reporter extends your reporting boundary beyond your emissions that you control to those that are generated across your entire value chain, which is a very broad concept. So, whereas in year one, we were focused very much on considering the data from your own electricity and fuel usage, we're now having to think about looking at the emissions being generated from your suppliers, from your inbound and outbound logistics and transport, from end-of-life of your products or even use of your products, if your products are then used in a process that further requires processing. And of course, for our financial services clients, they're grappling with financed emissions, which is an incredibly complex topic of its own. So, two main challenges. One is the data doesn't reside in your business. So you're reliant on a whole bunch of third parties to be able to try and get primary data from them. And to the extent that you're unable to get sufficient primary data, you would also be then looking at the data in your own records, such as spend data, and trying to use some sort of estimation techniques to come up with what you presume or what you estimate your emissions to be across your value chain. So a lot of judgment involved in deciding where to focus your efforts, a lot of judgment involved in creating estimates and methodologies. And then obviously, on top of that, you've still got the work involved in governance and management of your actual climate risks and opportunities. So my message would be on average, scope three consists of about 80% of an entity's total emissions. That's our best estimate. So this is going to be a huge effort compared to year one. Plus, then you've got all that complexity that I just spoke about, and you've got this big project management element in terms of how you gather that data from third parties. My advice would be you need a technology solution. I don't think it's feasible to do any of this manually or in Excel, particularly given the complexity of the emissions factors that you need to use, which come in very large complex data sets, and you really need to be a data scientist to be able to wrangle them by yourself. And that's why we partner with NetNada. Um, and you know, all of our clients really are using NetNada um or some other type of technology solution that allows them to be able to bring some rigour auditability but also streamline and efficiency into the process.
Kristin StubbinsUm that sounds like a lot. Um and uh and I know I love the way you talk about this because you're so passionate about it, but so clear at um at cutting through for clients. Um so I'm sitting here as you know an executive and I'm wondering this scope three stuff, and I've got to get all this information from you know other parties. Is it even available? Like let's assume that not everyone is reporting this data. Like, how hard is it to get this data, Sharon?
Sharon BroekhuizenSo the guidance available to reporters around the type of data that they need to collect is a pyramid. So the standard would ask you as far as possible to get primary data. But of course, we know that that's literally going to be impossible for a certain part of your supply chain and a certain part of your broader value chain. So the standard does allow for other forms of data to be used to come up with estimates. Um, that obviously it it introduces a different type of problem. So if you're using primary data, your problem is logistical, um, trying to coordinate with many suppliers all across the world and ask them for information that they many of them don't understand what you're really asking for. Um, whereas once you move through that data pyramid more towards the estimation side of things, you're introducing a lot more judgments and a lot more, you know, having to think about what's material and where to focus your efforts. So it's sort of some different problems depending what side of the data pyramid you're on. We do think that over time this is going to mature. So in the early years, it's going to be really difficult to get good data, good primary data. But as the years go on and the industry becomes more aware of and more capable of providing this information across the supply chains, um, the use of primary data is expected to increase.
Kristin StubbinsAnd as I understand it, there are some uh industry data sets and other sort of group data sets that might be available. And again, you know, we access that through our partner NetNada to help our clients. So it's quite expensive to get this data, and and often it's um it's easier to get it through, you know, through um purchasing power of uh the consultants getting one set and then helping their clients with it versus an individual company going and trying to find all these data sets. Have you found that as well?
Sharon BroekhuizenYeah, that's right. 100%. Most companies who have any sort of offshore supply chain or customer base will need to be using a bunch of different data sets. And each one comes with a cost. Um, and so there's the cost element, but then there's also the effort required. So the time that your people would have to spend wrangling those data sets, they're not straightforward or or easy to use. And so certainly using a consultant or tech provider who has been doing this for a while, like NetNIDA have for a couple of years, um, and they have AI capability in their solution, it really cuts through and is able to streamline that process of difficult data matching.
Kristin StubbinsSo then we also come to uh assurance, which um by the way, we don't do here at KC, but our focus is on helping clients um get through this, you know, difficult time, cut through the complexity, but there is um you know a whole art to the assurance process as well, and we do help clients manage that process. Um, so there's more assurance coming. What does that involve, uh, Sharon?
Sharon BroekhuizenSo in year two, for our group one reporters, the assurance scope is much broader. It now covers the entire report and it covers scope three emissions. So we had a little bit of a reprieve in year one, although I have found that typically the auditors have provided comments on the entire report, even though they've only been assuring a small part of it. So that's really helped the group ones. Those of those of them who've taken those comments on board and and actually brought them, um brought them in and implemented them, they'll be in a good position for year two. Um, and the focus will really be heavily just on the scope three and the scope three assurance. Um, with that in mind, building a really good data trail from day one is super important so that you don't end up with a big challenge when it comes to audit time. And that's another reason why a tech solution really works.
Kristin StubbinsSo, okay, I think that that direction of travel is reasonably clear. Um, but if I was a director listening to this and I'm sort of worried about my you know obligations, what should they be asking management?
Sharon BroekhuizenWell, in my experience, uh often directors uh may not be aware that they have the same obligations under the Corporations Act. That they have for financial reporting, the same ones apply for sustainability reporting. And so that means management needs to be able to give the directors the same level of comfort that the disclosures in the sustainability report are accurate, but also that there is an appropriate risk management process and controls in place to manage the risks that arise as a result of the climate transition. So I think really as a director, it's about being able to understand what is happening across the company in terms of risks, opportunities, identification and management, and what systems and controls, what are those key things that you're relying on to make sure that those risks are being managed and those opportunities are being activated to the right degree? And then, really important, is there a good system that underpins the data side of the emissions disclosures? Those would be the key risk areas.
Kristin StubbinsOkay. So in a typical engagement, Sharon, how do you help clients with this complexity?
Sharon BroekhuizenWe try and do a couple of things. We really try and help management with the groundwork. So starting with a blank sheet of paper is really tough. I think you mentioned that earlier, Kristin. Humans much prefer critiquing a process than uh having to create something from scratch. And so we've been doing financial reporting for many, many years. And so, you know, the annual process of financial reporting can be very painful, as can the audit process. This is even more, you know, it's to a higher degree because you're starting with a blank sheet. So we bring a lot of experience from financial reporting and other types of external reporting. So we can just take a bit of the fear factor away from that year one. Um, and then what we also do is because we're working across a whole bunch of different clients, we can really bring insights from others, particularly for now our group twos and threes who are just starting their process for their first year of reporting for group twos. We can bring all the learnings from the year one and help them have, you know, a really streamlined and smooth process and do a really good job with their year one foundations. Um, and we also help just to prevent any last-minute panic. We help to create capacity in the clients as well, because often this gets either left to a sustainability person if there is one, or it sits with the finance team, and they're already so busy with other things, particularly during reporting season, that we really help to bring that extra capacity, capability that may not be in-house, um, and help get everyone up to speed on this new requirement.
Kristin StubbinsSo that does sound um pretty practical and timely. So thanks, Sharon, and thanks to everyone else for listening to our podcast. As always, you can email me directly at kristin@ ksib.com.au if you have any questions. Or you can check out uh our expanding thought leadership on our website, www.ksib.com.au. Thanks for listening.