Questions, Answered.

In practical terms, we help your business answer four core questions: what could go wrong? What laws, standards, contracts and stakeholder requirements apply? What controls should be in place? And how can you prove those controls are working? That covers risk frameworks and registers, compliance obligations, ISO management systems, internal audits, governance structures, incident management, policies, training and certification preparation.

No — and if it does, it's been done badly. Controls should be proportionate to your risk profile. A small professional-services business should never carry the same system as a major infrastructure contractor. We design systems employees will realistically use, integrated into how you already work, focused on material risks rather than theoretical ones.

Our core standards are:

• ISO 9001 — quality management
• ISO 14001 — environmental management
• ISO 45001 — work health and safety
• ISO 27001 — information security
• ISO 42001 — artificial intelligence management

We also build integrated management systems that cover multiple standards in a single, workable framework — usually the most efficient option if you need more than one.

No — and you should be wary of anyone who says they can do both. We prepare and support your organisation: gap assessments, system development, internal audits, management reviews and staff preparation. An independent certification body then assesses whether certification requirements have been met. These functions must remain appropriately separate; that independence is what gives your certificate its value.

Because what you're buying is confidence and a defensible position. Good risk and compliance management reduces the likelihood of incidents, breaches and disputes — and when something does go wrong, it gives you evidence that your operations were properly controlled. It also improves tender and procurement eligibility, satisfies client and insurer requirements, and gives management better information to make decisions.

Depending on scope: a risk and compliance framework, strategic and operational risk registers, a compliance obligations register, an integrated management system, policies and procedures, audit programs and reports, corrective-action and incident registers, a contractor prequalification system, a legislative-change process, business continuity plans, training materials, board dashboards and a certification readiness report.

Ten domains: strategic and commercial, operational and project, work health and safety, environmental, financial and fraud, cybersecurity and information security, legal and regulatory, supply-chain and contractor, reputational, and business continuity and emergency risk.

We independently assess whether your systems and controls are properly designed, implemented consistently, effective in practice, meeting applicable requirements and producing reliable evidence. That typically involves reviewing documentation, interviewing personnel, sampling records and observing operations — then reporting findings, risks and improvement opportunities. We can also help management close out corrective actions and confirm the root cause has genuinely been addressed.

That perception is usually a symptom of a system that was built for auditors instead of employees. We translate technical requirements into practical expectations, integrate controls into normal business processes, and back it with inductions, workshops, briefings and role-specific coaching. A system people understand and use stops being box-ticking — it becomes how the business runs.

This is one of the most common ways engagements begin. We start with a rapid gap assessment against the requirements you're being measured on, prioritise the issues an auditor is most likely to raise, and work through mandatory records, corrective actions and staff preparation ahead of the date. Contact us early — lead time is your best friend.

With a conversation. We first take time to understand your business, objectives and existing arrangements — we never prescribe solutions before understanding how you actually operate. From there, most clients begin with a gap assessment or risk review that gives a clear, prioritised picture of what's needed, sized to your risk profile and budget.

We're based at 100 Beattie Street, Balmain NSW, in Sydney's inner west. We work with organisations across industries — from professional services to construction and technology — anywhere structured risk, compliance and assurance arrangements are needed. Call 0424 195 740 or email info@riskcompliance.com.au.