Governance · Risk · Assurance
Governance, risk and assurance that works in practice.
We review what is actually working, design what should be, and build the risk, compliance and internal audit functions that make it real. Senior practitioners for boards, audit and risk committees, executive teams and the organisations they lead.
Evidence, not opinion.
What we do
Three questions we help answer
Most organisations come to us with one of three questions. Each engagement starts from that question, has a clear scope and an agreed fee, and ends when the answer is in your hands, not in a report on a shelf.
01 · Assess
Board and regulatory evidence review
“We believe we are compliant and well governed. What evidence would we produce if someone asked us to prove it?”
We test what is actually held rather than what is asserted: papers, decisions, controls and the assurance behind them. We map it against what you are accountable for, and show what is there, what is claimed but unsupported, and what is missing. You get findings written for directors, not specialists, and a practical 90-day plan.
What changes. Evidence you can put in front of a regulator, owner, funder or minister, and a clear view of where assurance is duplicated and where it is thin.
Who it's for. Boards and audit and risk committees, new chairs and chief executives asking what they have inherited, and organisations facing regulatory scrutiny or an adverse finding.
02 · Design
Transition, governance and risk roadmap
“We are becoming a different organisation. What has to be in place, who decides what, and in what order?”
For organisations being created, separated, merged or rebuilt. We design decision rights, committee structures, the risk framework and appetite, and an assurance model sized to what you can afford, then sequence it into a 6 to 12 month roadmap tested against the capacity you actually have.
What changes. Nothing falls between the old organisation and the new one. We know where obligations go missing in a transition, because we have found them afterwards.
Who it's for. Tertiary providers in transition, councils, council organisations and new water services entities, and Crown entities and newly established bodies.
03 · Implement
Implementation and assurance support
“We know what needs to change. We don't have the capacity or the independence to do it ourselves.”
We build risk, compliance and internal audit functions: policy, registers, risk appetite, charter, methodology, a risk-based plan and reporting the board can use. We run board and committee induction and workshops, design and test controls, and check that recommendations were actually closed. We also deliver individual internal audit reviews from your audit plan or ad-hoc, outsourced or co-sourced, including technology and programme assurance.
What changes. Recommendations become changes, not another report. When we build a function, we work alongside your people, hand it over, and plan our exit from the start.
Who it's for. New or restructured organisations standing up a function for the first time, and organisations with accepted recommendations and no one to deliver them.
Not sure which applies? Most conversations start with what is prompting the question. If a short, bounded review is the right answer we will say so; if it is not, we will tell you that too.
Changes we're helping with now
Where we're seeing demand now
Each of these changes raises one of the three questions above. Each item shows which offering it falls under.
FEATUREDPart of 03 Implement: board and committee development
Audit and risk committees in local government
From mid-March 2027, non-elected committee members will neither vote nor count towards a quorum, except where they are appointed under other legislation, such as a Treaty settlement. They can still contribute their expertise. In 2020, more than half of councils (54%) had an independent chair on their audit and risk committee. This is a timely opportunity to strengthen elected members' audit and risk capability, whoever chairs the committee.
Practical support to build confidence and capability for audit and risk committees and their members, using their council's own public papers, alongside LGNZ's training and the council's governance team. It is support for the committee, not an assessment of anyone on it.
Committee workshop
2 to 3 hours for elected and independent members and governance staff, on the committee's own recent public papers. The usual place to start; it ends with questions members may want to raise later.
Foundations
One-to-one sessions on risk, assurance and governance, each using your council's recent public papers as the worked example.
Meeting-ready
Before: we read the published agenda and send three to five questions tied to page numbers, then talk them through. After: we review later public papers for reported progress and identify further questions (where possible).
Chair-ready
For whoever chairs, and the elected members who carry the votes: terms of reference, quorum, the work programme, running the meeting, and preparing questions for time with the auditors.
What's different: built for councils · governance, risk and assurance together · every meeting, not just training · independent of the room: an external perspective without sitting on the committee, with conflicts assessed before and throughout each engagement.
Download the one-page overview (PDF)02 Design · 03 Implement
Water services reform
Councils are setting up new water services organisations. We help design their governance, decision rights, risk framework and assurance model, and set up risk and internal audit so they work from day one.
01 Assess · 02 Design
Tertiary and vocational change
Polytechnics are becoming standalone again and providers face new quality assurance expectations. We help map obligations through the separation, and give governing councils evidence that quality and risk systems are working.
About us
Three senior practitioners
Between us: board governance, regulated financial services and insurance, legal and regulatory review, internal audit and its quality assurance, and technology assurance. The people you meet do the work.
John Stewart
Internal audit, risk, compliance and governance
30+ years across regulated financial services, corporate and public-sector organisations. John delivers internal audit and assurance reviews, assesses governance and control frameworks, and reports to boards and senior leaders.
Approved external QA examiner · IIA facilitator
Rachel Nottingham
Governance, regulatory review and privacy
A former commercial lawyer specialising in regulatory reviews, gap analyses and effectiveness evaluations. Rachel led internal audit at a large tertiary institution, working closely with risk to provide an integrated service.
Chartered Director (IoD) · former commercial lawyer (UK qualified)
Lucas Moreno
Internal audit, technology and risk assurance
20+ years across Big Four consulting, banking and a large retail cooperative. Lucas has built internal audit, risk and compliance functions, led a national technology audit programme and delivered more than 100 audits and quality reviews.
CIA · CISA · former Associate Director, Deloitte
How we work
Senior, bounded, independent
- Senior people throughout. The people who scope the work deliver it.
- Bounded first engagements. A clear question, scope and fee, not an open-ended retainer.
- Evidence, not opinion. We tell you what we found, including when it is unwelcome.
- Independence protected. We do not sit on the committee. We disclose relevant past or current work for the organisation, assess conflicts before and throughout each engagement, and decline work where independence can't be maintained. Any management-side work for the same organisation needs a fresh conflict assessment and the client's agreement before we accept it. We don't assure our own work, including any function or controls we designed or built for the same client.
- Clear boundaries. Formal legal opinions, statutory audit, certification and other specialist work are referred to the right people.
- Written by people. Our reports and conclusions are our own; we use AI only to support analysis.
We work with tertiary and vocational education, financial services and insurance, Crown entities and not-for-profits, and local government and council organisations.
Get in touch
Most engagements start with a short conversation.
We meet in person or by video anywhere in Aotearoa New Zealand.
- John Stewart John@co-axiom.co.nz
- Rachel Nottingham rachel.nottingham@weaver.page
- Lucas Moreno lucaspablo.moreno@gmail.com
Privacy statement
We collect personal information from you, including your name and contact details, when you email us. We collect it so that we can get in touch and explore working together, and we don't share it with anyone else. You have the right to ask for a copy of any personal information we hold about you, and to ask for it to be corrected if you think it is wrong. To do either, contact Rachel Nottingham at rachel.nottingham@weaver.page.