In today's environment of heightened scrutiny, regulatory complexity and rapid technological change, organisations face risks at every turn.
Combined, Assurance & Risk is a powerful force which safeguards integrity, protects people and resources, builds trust, and creates the foundation for sustainable performance.
Clarity in complexity
We help you understand the risks, obligations and governance challenges that matter most, bringing clarity to complex environments so you can focus your attention where it will have the greatest impact.
Building resilience
We help strengthen governance, controls and risk practices, identifying vulnerabilities and preparing your organisation to respond to emerging risks and changing expectations.
Confidence to act
We provide independent insight and practical advice give you the confidence to make informed decisions, navigate uncertainty and move forward knowing your risks are understood and managed.
Protecting what matters
We help protect your people, performance, reputation and resources through assurance and risk solutions that strengthen organisational resilience and support lasting value.
Capabilities
Assurance gives you the clarity and evidence to act decisively, knowing your risks are understood and your controls are working. Our proactive risk insights help you anticipate and respond to challenges; protecting performance and reputation.
Together, we deliver progress that matters on...
Internal and performance audit
OCM conducts independent and risk-based reviews of controls, efficiency, and compliance that drive stronger governance and continuous improvement. Our audits focus on operational, strategic, and financial risks, bringing together generalist and specialist auditors to deliver outstanding results on:
- Operational effectiveness audits
- Financial and compliance audits
- Performance and efficiency reviews
- Process mapping and control evaluation
- Quality assurance reviews
Risk and governance frameworks
We ensure the establishment and enhancement of risk frameworks that are built around ISO 31000 and aligned with other regulatory standards. We help organisations develop fit-for-purpose risk and governance frameworks that provide clarity and confidence in managing uncertainty, including:
- Enterprise risk management framework design
- Risk appetite, tolerance setting, and reporting
- Framework maturity assessments
- Board and committee governance structures
- Policy and procedure development
- Governance health checks and effectiveness reviews
Compliance and regulatory assurance
We lead reviews that are focused on adherence to regulatory guidelines, industry standards, and policy requirements. We provide subject matter experts to monitor compliance to provide the confidence you are meeting:
- Legislative and regulatory obligations, industry standards, and frameworks
- Internal policy adherence
- Contractual compliance
- Grant funding conditions
- Environmental and safety regulations
Digital assurance and cyber
Technology brings risk through digital infrastructure, systems, and data reliance. Our integrated digital assurance approach builds digital trust, empowering organisations to leverage the potential of data and elevate their digital landscape:
- Cyber security: Safeguarding information regardless of how it’s handled, processed, transported or stored
- Threat and incident management: Enhancing threat and vulnerability management maturity in business applications, systems, and networks through assessments, patching, monitoring, and threat intelligence
- Data governance: Establishing frameworks that enable better coordinated management of data availability, usability, integrity and security
- IT general controls: Assurance across the digital ecosystem including data accessibility, response to disruption, digital resilience, change management, cloud services and security controls
Program and project assurance
We offer independent program and project assurance aligned with leading frameworks including Gateway Review methodology. We validate scope, assess risk, and conduct reviews at critical milestones to ensure delivery remains on track, benefits are realised, and governance standards are upheld. Our approach includes:
- Gateway reviews at key decision points
- Project health checks and readiness assessments
- ECI and competitive alliance reviews
- Financial audit of construction progress claims
- Financial viability of contractors prior to contract award
- Benefits realisation validation
- Transparent reporting to give stakeholders confidence in complex delivery environments
Process mapping & control evaluation
Unlock better performance and decision making by visualising workflows and assessing controls to discover inefficiencies, gaps, and risks; informing reform, automation and smarter systems and ways of working. We support organisations with:
- End-to-end process mapping
- Control identification and evaluation
- Process gap and inefficiency analysis
- Risk and control mapping
- Process improvement opportunities
- Automation and systems opportunities
- Future-state process design
Sustainability & ESG
Environmental, Social, and Governance (ESG) factors are now central to organisational resilience, reputation, and long-term value creation. We help clients embed sustainability into operations through reviews aligned with ISO 20400 (Sustainable Procurement) and global best practices. We assess:
- Compliance with modern slavery legislation
- Ethical sourcing and supply chain transparency
- Sustainability framework implementation
- Climate-related financial disclosures
- Social procurement commitments
- Environmental management systems
- Stakeholder engagement and reporting
Business resilience
We work with organisations to build and maintain resilience, promote reliability, and be ready to respond. By working together, we identify vulnerabilities, workshop solutions and implement recommendations through:
- Disaster & Emergency Preparedness: Integration of disaster management planning, emergency procedures, and hazard/risk identification (e.g. bushfire protocols)
- Incident Response & Recovery Capability: Defined incident response procedures, post-incident reviews, and tracking of lessons learned
- Backup & Restore Readiness (RPO/RTO): Regular testing of backups, clearly defined Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs), and alignment with business expectaions
- Risk Identification, Assessment & Treatment: Identifying risks, linking them to enterprise risk registers, and maintaining treatment plans monitored through governance bodies
- Staff Training, Awareness & Capability: Regular, scenario-based exercises, training on continuity/incident plans, and building staff understanding of roles during disruptions
- Testing, Review & Continuous Improvement: Desktop exercises, scenario tests, audits, and refinement of plans based on outcomes and emerging risks. Protocols for internal and external communication during disruptions, ensuring clarity and continuity
Local government service reviews
We help councils evaluate and improve services so they continue to meet community needs, strategic priorities and regulatory requirements. Our structured and evidence-based approach provides a clear understanding of service performance, value and future direction, with reviews focused on:
- Service objectives, performance, costs, demand and utilisation
- Service efficiency, effectiveness and value for money
- Alignment with community needs and strategic priorities
- Community and stakeholder engagement
- Benchmarking against comparable councils and better practice
- Governance and performance measurement improvements
- Practical and actionable recommendations
- Compliance with Integrated Planning and Reporting requirements
Independent external quality assessments
Confirming internal audit effectiveness and conformance with IIA standards as required at least once every five years. Our assessments identify strengths, gaps and practical opportunities for improvement, supporting continuous improvement and confidence among key stakeholders.
Assurance that delivers confidence
Discover how we help organisations strengthen governance, manage risk and ensure controls and investments deliver as intended.
Our people
Cathy Blunt
Daniel Newby
Judy Malpas
Mayus Nath
Susanne Kennedy
Yas Wickramasekera
We help protect today and safeguard tomorrow. You shape the future.
Progress needs a partner. We're ready.