Annual General Meetings are built on trust.

Members trust that their votes will be counted correctly. Directors trust the integrity of the results. Company secretaries and governance professionals trust that the meeting complies with legal and organisational requirements.

Increasingly, that trust also depends on technology.

As more Australian organisations conduct hybrid and virtual AGMs, the voting platform becomes part of the governance process. It’s no longer enough for software to be easy to use—it also needs to demonstrate that member information, voting data and election processes are properly protected.

That’s where recognised security certifications become important.

Rather than relying on marketing claims about being “secure”, organisations can look for independently assessed security standards that provide evidence of mature information security practices.

Why security matters in AGM voting

An AGM voting platform processes information that organisations cannot afford to compromise.

Depending on the meeting, this may include:

If these systems are poorly secured, organisations face risks such as:

Even if none of these events occur, uncertainty around security can reduce confidence in the outcome.

Governance isn’t only about getting the right result. It’s also about demonstrating that the result can be trusted.

Security certifications provide independent assurance

Any software provider can claim to take cybersecurity seriously.

Independent certification is different.

It requires external auditors to examine policies, controls, operational processes and ongoing security management against recognised standards.

This provides customers with objective evidence rather than relying solely on vendor promises.

For organisations selecting an AGM voting provider, that independent verification significantly reduces procurement risk.

Why ISO/IEC 27001 matters

ISO/IEC 27001 is the world’s leading standard for Information Security Management Systems (ISMS).

Rather than focusing on one feature or one piece of software, ISO 27001 assesses how an organisation manages information security across its entire business.

Certification covers areas including:

Importantly, certification isn’t permanent.

Organisations undergo regular surveillance audits and periodic recertification to demonstrate that security controls continue to operate effectively.

For customers, ISO 27001 shows that security is embedded into organisational governance—not added as an afterthought.

What is SOC 2 Type II?

SOC 2 Type II is often misunderstood.

Unlike ISO 27001, it isn’t a certification.

It’s an independent assurance report that evaluates whether security controls not only exist but operate effectively over an extended period.

Type II reports assess controls against the Trust Services Criteria, including:

The critical difference is that auditors examine how controls perform over time rather than assessing them at a single point.

For organisations purchasing SaaS platforms, SOC 2 Type II provides additional confidence that operational security is consistently maintained.

Why both standards matter

Many procurement teams now ask technology vendors for both ISO 27001 and SOC 2 Type II because they evaluate different aspects of security.

Together, they demonstrate both mature governance and effective day-to-day security practices.

Security is about more than encryption

Encryption is essential.

But secure AGM voting requires much more than encrypted data.

A trustworthy voting platform should also include:

Strong authentication
Only eligible members should be able to access their ballot. Authentication methods may include shareholder reference numbers (SRNs), holder identification numbers (HINs), member IDs or unique secure credentials appropriate to the organisation.

Role-based access
Administrative access should be tightly controlled and limited only to authorised personnel.

Audit trails
Every significant action should be recorded with tamper-evident logs, providing transparency if questions arise after the meeting.

Business continuity
If unexpected technical issues occur, the provider should have documented recovery procedures to minimise disruption.

Ongoing monitoring
Security isn’t something performed once a year. Effective providers continually monitor systems, manage vulnerabilities and review risks as part of normal operations.

Security supports good governance

Australian regulators increasingly recognise that technology plays an important role in member participation.

ASIC expects companies using virtual meeting technology to provide members with a reasonable opportunity to participate, including voting and asking questions. Guidance also emphasises planning for technology risks and ensuring voting processes remain accessible and reliable.

Similarly, the Governance Institute of Australia and other governance bodies recommend considering cybersecurity and resilience when planning hybrid and virtual AGMs.

Security therefore supports governance outcomes—not just IT objectives.

Common misconceptions

“We’re only a small organisation.”
Cybercriminals don’t only target large listed companies. Associations, unions, strata bodies and not-for-profits all hold valuable personal information and financial records. Security standards benefit organisations of every size.

“Password protection is enough.”
Passwords are only one layer of defence. Modern security relies on multiple controls working together, including monitoring, access management, incident response and secure operational processes.

“If we’ve never had a breach, we’re secure.”
Past performance doesn’t guarantee future resilience. Independent certification demonstrates that security is actively managed rather than assumed.

Questions to ask your AGM voting provider

Before selecting an online voting platform, ask:

These questions often reveal far more than product feature lists.

How Vero Voting helps

Security forms part of every trustworthy election.

Vero Voting operates with an Information Security Management System certified to ISO/IEC 27001:2022 and has also successfully completed a SOC 2 Type II independent audit.

Combined with Australian data hosting, encrypted communications, comprehensive audit trails and robust voter authentication, these independently assessed controls help organisations conduct AGMs, elections and ballots with greater confidence.

Rather than relying on marketing claims, customers can assess independently verified evidence that security practices are embedded into the organisation’s operations.

Key takeaways

Security certifications are no longer a “nice to have” when selecting an AGM voting platform.

They provide independent assurance that a provider has invested in structured security governance, operational controls and continual improvement.

For boards, company secretaries and governance professionals, that means greater confidence that voting processes, member information and election outcomes are protected.

When trust is the foundation of an AGM, independently verified security helps protect that trust.

If your organisation is reviewing its AGM voting platform, contact Vero Voting for a demonstration or speak with our team about how our certified security framework supports secure, transparent and compliant elections.

Sources

Australian Securities & Investments Commission (ASIC) – Virtual meetings FAQs

ASIC – Guidelines for investor meetings using virtual technology

Governance Institute of Australia – AGMs using technology

Australian Taxation Office – Operational Framework security standards (ISO 27001 and SOC 2)