Know which risks
are worth carrying.

Technology risk management identifies what could go wrong, how likely it is, what it would cost, and which risks are worth treating rather than accepting. It is for boards and executives who need to make an informed decision about what they are exposed to.

A risk assessment is a point-in-time measurement of where you stand, usually against a framework, producing a ranked list of findings. Risk management is the ongoing discipline: maintaining the register, owning each risk, reviewing it, and reporting it upward. The assessment tells you the score. Management is what stops the score drifting back down six months later.

In our experience, four recur. A cyber incident that stops trading, most often ransomware or business email compromise. Key person risk, where one individual holds knowledge or access nobody else has. Concentration risk, where a single supplier or system has no alternative. And compliance exposure, where an obligation is being carried without evidence. Everything else tends to be a variation on one of those.

Yes, and it is often the right answer. Accepting a risk knowingly, with the cost understood and a named owner, is a legitimate decision. What causes damage is accepting risk by accident, where nobody weighed it and nobody can say who decided. The register exists to move risks from the second category into the first.

Partially, and it is worth reading the policy closely rather than assuming. Cyber cover typically transfers some of the financial consequence, but it does not restore your systems, protect your reputation, or satisfy a regulator. Most policies also carry conditions such as multi-factor authentication and tested backups, and a claim can be declined where those conditions were not actually met. Insurance is one treatment option among several, not a substitute for the others.

Quarterly for the register as a whole, and immediately whenever something material changes: a new system, an acquisition, a significant supplier change, or an incident. A register reviewed once a year is a compliance artefact rather than a management tool.

We quote after scoping rather than before. Anyone pricing this work without looking at your environment is guessing, and the guess is rarely in your favour. Scoping itself is quick, and we tell you what it costs before we start it.

A first conversation takes about half an hour and costs nothing. Scoping is usually a week or two of our time depending on the size of the environment, and we agree the delivery dates with you before anything is booked in.

Yes, and it is common. We are happy to work as an extra pair of hands under your internal team, or alongside an incumbent provider on a defined piece of work. We will set out in writing where the responsibilities split, so nothing falls between us.

No. This can be delivered as a standalone piece of work for an organisation we have never worked with before, or folded into a managed agreement if you already have one with us. Plenty of clients use us for one thing and keep everything else where it is.

Our team is based in Auckland and we attend sites across the wider region. Most of this work is delivered remotely, so we support organisations throughout New Zealand, and we will say up front where being on site genuinely matters.

Named people, not a queue. You get a lead who knows your environment and stays with it, which is the difference between explaining your business once and explaining it every time you make contact.

You keep the documentation regardless, and anything registered in your name stays in your name. Whether we stay involved is your call. Some clients take it in house from there, others move it onto an ongoing agreement with us. We would rather you left cleanly than stayed because leaving was difficult.