ANZ consolidates operational risk into ServiceNow

ANZ Banking Group is migrating its entire non-financial risk portfolio to ServiceNow, in a move to strengthen operational resilience across its enterprise technology stack.

Over the past two years, ANZ has transitioned from IBM’s OpenPages to ServiceNow’s integrated risk management (IRM) platform, with a focus on 16 key risk domains and 19 critical business operations.

As part of the shift, ANZ implemented ServiceNow’s common service data model (CSDM) version five to boost workflow orchestration across multiple modules, including IRM, business continuity management (BCM), third-party risk management (TPRM), and IT service management (ITSM).

The program also enabled ANZ to also map 43,000 supporting resources – which include vendors, facilities, teams and applications - as well as risks and controls against its core business processes.

ANZ also leant on Kafka and API-based connectivity to connect to key data sources.

Speaking during ServiceNow Knowledge in Las Vegas, ANZ ServiceNow architect Stephen Harland said the program was driven partly by the Australian Prudential Regulation Authority's (APRA’s) new prudential standard CPS 230, which focuses on operational risk and takes effect on July 1 2025.

“We embarked on what was probably about an 18-month journey to define all of the bank's service offerings, leaning on industry frameworks like CSDM,” he said.

“Anchored to that were a lot of the underpinning technology components and the service commitments around group technologies [and] delivery against the business-facing services.”

To support this, ANZ identified 16 non-financial risk themes across the enterprise and began migrating them into ServiceNow IRM.

In parallel, it earmarked 19 critical operations that pose risks of "intolerable levels of customer harm" or potential disruption to financial markets and plans to have these fully onboarded to ServiceNow by July 1.

However, as the program evolved, ANZ began extending its data models to include external partners and contractors in order to better “understand the chain of resilience.”

“No longer was it enough just to link up a few app services to a service offering and call it a day,” said Harland.

“We needed to understand the business components that delivered against the service, in particular that of vendors, so that we understood their contractual obligations.”

This need led to the adoption of ServiceNow’s TPRM module in March, integrated with Orbis for company reference data and SAP Ariba for contract alignment.

“TPRM [is] hugely important in terms of being able to not only identify the vendors that underpin our critical operations, but also the nature of the work and the engagements that they're undertaking so that we understand the work that they're delivering to ANZ and how it contributes and delivers to a critical operation.”

With the CPS 230 deadline approaching, ANZ is expanding its use of ServiceNow to include business continuity management (BCM) as part of its integrated risk platform.

ANZ technology area lead Shaun Burke told the audience at ServiceNow Knowledge that the vendor’s BCM was previously used primarily for technology backup and disaster recovery, while continuity planning for the broader organisation was housed in SharePoint under a “fragmented” mesh of business functions."

However, as of now, ANZ has consolidated its business continuity strategies and planning into ServiceNow.

The current phase of the project concluded with the adoption of operational dashboards to continuously monitor integrated datasets.

Looking ahead into 2026 and beyond, ANZ intends to expand its operational resilience framework to give what Burke calls a “left-to-right view of [its] value chain” and then use the framework to build and deploy “important operations and shared services”.

Having recently adopted ServiceNow’s generative AI tool Now Assist, the bank is starting to explore using automation and AI within its risk and resilience stack.

While still in its early stages of adoption, the bank has already uncovered some “powerful use cases” for using agentic AI to drive “optimisation, efficiency, consistency and predictability” in managing its operations.

“The exciting part is how we actually start getting that to make our lives simpler and getting more insights and predictability in it,” Burke added.