Risk Management & Governance

What could take this business down — and how much of that are you willing to carry?

Most business owners can answer that question in general terms and not in specific ones. One customer is a large share of revenue and nobody's worked out what happens if they leave.

There's a personal guarantee signed years ago, secured against the house, that hasn't been read since. One machine, one supplier, one person who knows how something works. Insurance bought once and never reviewed against what the business has become.

None of this feels urgent until it is. And by then the cost of not having thought about it is the whole problem.

This isn't about worry. It's about knowing your exposures in numbers, deciding which ones you're prepared to carry, and dealing with the ones you're not.

It tells you which exposures to spend money fixing and which to consciously accept. Without it, you're either over-insuring things that don't matter or carrying things you'd never have agreed to if anyone had asked you directly.

Who this is for

Owners whose personal financial position is tied up in a business they've never formally stress-tested. Particularly those with physical operations, concentrated customers or suppliers, export exposure, or a board or shareholder group asking questions the business can't currently answer.

You're likely a good fit if:

  • One customer or supplier represents a worrying share of your business

  • You've signed personal guarantees and haven't quantified the exposure

  • There's no plan if you're out of the business for three months

  • You have shareholders or a board wanting risk reporting you don't produce

  • You're preparing for a sale, a funding round, or bringing in a partner

  • You suspect you have compliance obligations you haven't fully mapped

What actually happens

Weeks 1–2 — Identify

Workshops with you and your key people. Structured analysis of the business — operational, financial, commercial, people, compliance and strategic exposures. Review of contracts, insurance, guarantees, facility agreements and shareholder documents. Site visit. The output is a long, unfiltered list of everything that could go wrong, which is deliberately more than we'll act on.

Weeks 3–4 — Quantify and set your appetite

Each significant exposure gets a dollar figure — likelihood and financial impact, in numbers. This is the step most risk work skips, and it's what tells you which three things matter and which twelve don't.

Then the harder question: how much of each kind of risk are you actually willing to carry?

We work through this by type: financial, operational, people, customer and supplier, compliance, reputational, because your tolerance genuinely isn't the same across all of them. Most owners will accept significant operational risk in a process they've run for fifteen years and understand deeply, and almost none are relaxed about anything touching the family home. That's not inconsistency, it's judgement, and it deserves to be made explicit rather than left implied.

Weeks 5–6 — Treat

Now the decisions get easier, because the question is no longer “is this risky?" but “is this inside what we agreed?" For the exposures sitting outside your appetite: what to do, what it costs, who owns it, by when. Some are insurance decisions. Some are contract renegotiations. Some are operational changes. And some you'll consciously decide to accept — a legitimate answer once you've decided it deliberately rather than by default.

Weeks 7–8 — Build the discipline

A short written appetite statement being a few lines per risk type, in your own words —so the thinking survives the engagement. A risk register you'll actually maintain, and Key Risk Indicators built into your existing monthly reporting with thresholds that trigger a conversation when something drifts outside the line you set. Policies where they're genuinely needed and not where they aren't. If you have a board or shareholders, a reporting format that works for them.

What you get

  • A written risk appetite statement — where your line sits, by type of risk, in your own words

  • Thresholds that trigger a conversation, so you know when something's moved outside what you signed up for

  • A risk register, ranked by quantified financial impact

  • A written risk management plan aligned to your strategy

  • Key Risk Indicators integrated into your monthly reporting

  • A review of internal controls over your significant risks

  • Business continuity basics — what happens if you, or a key person, or a key asset, is unavailable

  • Policies drafted where required (treasury, delegated authority, credit, health and safety interfaces)

  • A quantified summary of your personal guarantee and shareholder exposures

  • Board reporting format, if applicable

How it's priced

A full risk and governance engagement is a fixed-fee project, usually six to eight weeks depending on the number of sites and entities.

If you'd rather start smaller, a Risk Health Check covers the identification, appetite and quantification stages without the full treatment plan — a shorter, fixed-fee piece of work over two to three weeks.

Ongoing governance support for example, quarterly risk reporting, board or advisory board attendance is a monthly retainer.

Fees are agreed before we start. You'll have a number early in the conversation.

Why me

I'm Rachel Southee, a chartered accountant and a process engineer. It's not a common pairing, and it's the reason I do this work.

This is where my background is most directly relevant.

At Oji Fibre Solutions, $1.47b in revenue and $1.65b in assets across New Zealand and Australia, I wrote the Enterprise Risk Management Policy and the Treasury Management Policy, both approved by the Board. I established the Treasury Management Committee and the Finance Governance Committee. I presented a paper to the New Zealand Board on emerging sustainability reporting requirements under IFRS S1 and S2 and their impact on the Group.

I also provided the technical advice on hedge accounting and derivatives — which is financial risk management in its most practical form: working out what exposure the business is actually carrying on currency and commodity movements, and what it costs to manage it.

I've sat on the other side of the table as well. I've held governance roles since 2016, including as a director and chair of the Audit & Risk Committee of Auckland Basketball Services Limited and as treasurer and co-chair of the YWCA. I know what a board needs to see, and how rarely they get it.

What that adds up to: I can build you the same structure a large corporate uses, at a size and cost that makes sense for your business — and I'll translate every bit of it out of the jargon it usually comes wrapped in.

Let’s Talk

Twenty minutes, no pitch, just a chat. Tell me what's bothering you and I'll tell you honestly whether I can help.