Career

Andy Davies is a senior risk, compliance and assurance executive with more than 20 years’ experience across banking, financial services, technology and complex transformation environments. He has held senior leadership roles across ING Australia, Commonwealth Bank of Australia, Macquarie Group and Westpac, developing deep expertise across technology risk, operational risk, regulatory compliance, controls, resilience and governance. He combines a strong technical foundation in Computer Science with extensive executive experience, giving him a practical understanding of how risk frameworks need to operate within complex technology and business environments.

Andy has recently moved into the role of General Manager, Risk & Assurance at Greenstone Financial Services, following senior leadership roles at ING Australia and CBA. At ING, he led Technology Risk and Control as a direct report to the Chief Information Officer, supporting a major transformation of the bank’s core banking, online banking and back-office systems. He led significant regulatory engagement with APRA, including a major IT and Cyber Prudential Review, while overseeing technology risk advisory, controls assurance, regulatory compliance, incident response, governance and risk in change.

Prior to ING, Andy spent almost eight years at Commonwealth Bank, where he held senior leadership roles across Technology Risk, Compliance, Cyber Security, Resilience, Outsourcing and Payments. He was also a member of CBA’s Group Crisis Management Team, supporting the organisation’s response to serious disruptive events including cyber attacks, system outages and natural disasters. Earlier in his career, he held an international Division Director and Global Business Leader role at Macquarie Group and led the transformation and subsequent operation of the risk and compliance function across Technology and Operations at Westpac.

Role at Factor

As a Factor Expert Advisor, Andy brings a pragmatic and commercially minded perspective to the relationship between risk, technology, regulation and business performance. His experience spans both Line 1 and Line 2 environments, giving him a strong understanding of how risk functions can move beyond oversight to become embedded in everyday decision-making and transformation.

Andy can provide insight into how organisations can build risk and assurance models that support innovation while maintaining appropriate controls, accountability and regulatory confidence. His experience across major banking transformations, cloud, cyber security, data, privacy, outsourcing, operational resilience and emerging technology provides a practical perspective on managing risk as technology environments become increasingly complex.

Andy is particularly well placed to advise senior technology, risk and business leaders navigating regulatory change, technology transformation and operational resilience. His experience leading regulatory examinations and Prudential Reviews, responding to major incidents and establishing executive and Board-level governance enables him to bring a grounded perspective to conversations around risk appetite, controls, resilience and the role of risk in strategic decision-making.

Key roles Andy works with include: Chief Risk Officers, Chief Information Officers, Chief Technology Officers, Chief Information Security Officers, Chief Compliance Officers, Chief Operating Officers, Chief Transformation Officers, CEOs & Executive Leaders, and Boards & Risk Committees.

Previous Roles

Prior to joining Greenstone Financial Services, Andy was Head of Technology Risk and Control at ING Bank Australia, reporting directly to the Chief Information Officer. He led a team of Line 1 Risk and Compliance professionals across Australia, India and the Philippines, with responsibility spanning risk advisory, risk assessment, controls assurance, SOX, regulatory compliance, incident response, governance and risk in change. He also chaired the Technology division’s Risk and Governance Forum and Cloud Risk Committee and regularly engaged with Executive and Board-level risk and technology governance forums.

At Commonwealth Bank of Australia, Andy held senior roles across Technology Risk and Compliance and Technology, Cyber Security, Resilience, Outsourcing and Payments. He provided independent Line 2 advice and assurance across cloud, software development, cyber security, data, privacy, operational resilience, outsourcing, offshoring and conduct. As a member of the Group Crisis Management Team, he played a role in the bank’s response to significant disruptive events and led regulatory and government engagement for the Technology division.

At Macquarie Group, Andy was Division Director and Global Business Leader for Technology Risk and Compliance, leading the risk and compliance function for Corporate Operations, including Technology, Cyber Security, Cloud, Business Services and Market Operations. His international team operated across Sydney, Manila, New York and London, with his responsibilities including risk assessments, technology due diligence, new technology approvals and governance of new business and product initiatives.

Andy began his senior risk career at Westpac, where he transformed and subsequently led risk and compliance for Group Services, covering Technology and Operations. Earlier roles at Westpac included Program Director for Bank of Melbourne and Project Director within Group Operations, where he worked across major transformation programs including the integration strategy for the acquisition of St George Bank. He also co-founded a software consulting business and began his career working on technology and banking transformation projects for global institutions including Deutsche Bank, ABN AMRO and HSBC.

Media Presence and Industry Contributions

Andy brings a perspective shaped by working at the intersection of technology, regulation and business transformation. His experience demonstrates how effective risk management can support better customer outcomes, stronger decision-making and greater organisational resilience, rather than operating solely as a control or compliance function.

He has extensive experience helping organisations respond to regulatory expectations and embed regulatory requirements into practical operating environments. This includes leading engagements with APRA, Prudential Reviews, regulatory change programs and implementation of APRA standards including CPS231, CPS232, CPS234 and CPS230, as well as supporting responses to significant industry events such as the Optus data breach.

Andy has also contributed to the development of stronger technology and operational resilience practices across major financial institutions. His experience spans cyber security, cloud, data protection, controls assurance, outsourcing, crisis management and risk automation, providing an informed perspective on how organisations can balance innovation and transformation with appropriate governance, accountability and resilience.

Leadership Philosophy

Andy believes risk and compliance should be commercially minded, pragmatic and embedded into the way organisations make decisions. Rather than treating risk as a barrier to transformation, he advocates for strong risk capabilities that enable organisations to understand uncertainty, make informed choices and pursue opportunities with appropriate confidence.

His leadership approach combines strong technical understanding with practical execution and constructive stakeholder engagement. He has operated across both Line 1 and Line 2 environments and understands the importance of building trusted relationships between risk functions, technology teams, business leaders, executives, Boards and regulators.

Andy is also passionate about developing people and building sustainable risk capabilities. He places a strong emphasis on coaching, mentoring and creating opportunities for teams to grow, while ensuring that risk and compliance functions remain closely connected to the strategic priorities and day-to-day realities of the organisations they support.