Risk, Resilience & Governance
We build the records that show what happened, who approved it and what the data said at the time, so a risk is visible before it becomes an incident.
Our perspective
Risk, resilience and governance work at THEFOCUS covers the records and controls that show what happened, who decided it and on what data: risk registers fed from system data, compliance programs, business continuity, supply integrity and traceability, data privacy controls and third-party risk. We build and maintain the evidence trail. Legal interpretation, audit opinions and certification stay with the client's advisers, auditors and accredited bodies.
A risk register usually records what people remember to report. Many of the exposures that cause real damage are already sitting in the systems: an advertising account with an unresolved security warning, a backup payment card that expired months ago, a supplier delivering without a quality record, a former contractor who still has admin access to the booking platform. They live in logs and settings that nobody reviews, so the register says one thing and the systems say another.
We build the evidence trail first. Each risk gets an owner, a source in a named system and a check that runs on a schedule. Approvals for prices, budgets, contracts and system changes are recorded inside the tools where the work happens, so the record already exists when someone asks for it and nobody has to rebuild it from message threads. Accountability then rests on data: what the figures showed when the decision was taken, and who took it.
FuelVeriq, our fuel quality and supply-integrity product, applies the same thinking to fuel supply and is at pre-launch MVP stage with pilot enquiries open. In client work we keep evidence and judgement apart. We build and maintain the records, while legal interpretation, audit opinions and certification stay with the client's lawyers, auditors and accredited bodies.
How we help clients
Enterprise Risk Management
Risk registers fed from system data, with an owner, a review date and evidence behind each rating, reported to the board in a form it can act on.
ExploreRegulatory Compliance Programs
Obligations registers, controls and evidence workflows that turn requirements set by your advisers into checks staff run inside their daily systems.
ExploreBusiness Continuity & Operational Resilience
Continuity plans tested against the systems, suppliers, payment methods and logins the business depends on, with recovery times measured in real tests.
ExploreSupply Integrity & Traceability
Structured records for quality checks, batches, incidents and investigations along a supply chain, designed to stand up to later review.
ExploreData Privacy & Protection
Consent, data-handling and access controls configured in websites, CRMs and analytics, documented for your advisers and measured for their effect on reporting.
ExploreThird-Party & Supplier Risk
Supplier, agency and vendor risk tracked from contracts, access logs and performance data, with reviews scheduled before renewals and at offboarding.
Explore
Business challenges
01
Risks that live in one person's memory
Known exposures, such as an advertising account security incident that was never fully closed, an expired backup payment card or a supplier with no quality record, are remembered by individuals and never logged with an owner.
02
Approvals with no trail
Changes to prices, budgets, contracts and live systems are agreed in messages and calls. When something goes wrong, nobody can show who approved what, or on which figures.
03
Continuity plans that have never been run
The plan describes recovery on paper, but backups have never been restored, the fallback supplier has never been called and the only admin login to a critical platform belongs to one person.
04
Supply integrity that cannot be evidenced
Fuel, material or product quality problems are investigated with ad hoc spreadsheets and phone photographs, and the resulting record cannot support a claim against a supplier or an internal accountability process.
05
Consent settings that do not match local rules
The platform's default consent settings do not cover the regime that applies in the client's market, so tracking either runs without a valid basis or is cut back without anyone knowing by how much.
06
Third parties with access nobody reviews
Agencies, freelancers, app vendors and integrators keep access to stores, advertising accounts and customer data long after their work has ended.
How we approach it
Inventory the exposures
We list the operational risks the organisation already knows about and those we find in its systems, each with an owner, a source and its current status.
Record decisions where the work happens
Approvals, changes and investigations are logged inside the systems staff use for the work itself, so the record builds up as the work is done instead of being reconstructed afterwards.
Keep evidence and judgement apart
We build and maintain the evidence. Legal interpretation, regulatory decisions and certification stay with the client's advisers, auditors and the relevant authorities.
Review on a calendar
Controls are checked on a schedule against stated baselines, and any change in exposure is reported to the named owner.
Relevant industries
- Oil, Gas & Fuel Distribution
- Commodities, Trading & Sourcing
- Construction, Building Materials & Home Improvement
- Retail & E-commerce
- Food & Beverage
- Hotels & Resorts
- Marinas & Yachting
- Transportation & Logistics
- Public Sector & Institutional Organisations
- Technology & Software
Associated solutions
- FuelVeriq Pilot stage
How outcomes are evaluated
- Share of identified risks with a named owner, a system source and current evidence
- Share of material changes carrying a recorded approval
- Time from an incident to a complete investigation record
- Share of third parties whose access was reviewed in the last cycle
- Recovery steps tested against the continuity plan, and the time each took
Scope boundaries
- We do not give legal advice. Policies, contracts and compliance documents we prepare are drafts for review by the client's qualified legal advisers.
- THEFOCUS is not a regulator and does not act for one or deal with one on a client's behalf.
- We do not issue certifications, accreditations, compliance attestations or audit opinions, and our work is neither a statutory audit nor an internal audit.
How an engagement with THEFOCUS starts
A first conversation is about your situation. If there is a fit, we propose a scoped diagnostic with a fixed deliverable before any larger commitment.
Discuss this with us01
A working conversation
Forty-five minutes with the person who would lead the work. We ask about the decision, the systems behind it and the deadline.
02
A scoped diagnostic
Read-only access, a fixed timeframe and a written finding: what the records show, what it costs and what to change first.
03
A plan you can act on
Changes, owners, measures and exclusions in writing. The same team then builds and measures, or hands over cleanly.
- One accountable team
- The people who diagnose also build the systems and measure the result.
- Partners chosen per problem
- Independent specialists join for the parts that need them, under one contract.
- Records before dashboards
- Orders, ledgers and logs are reconciled before any recommendation depends on them.
Questions executives ask
Do you provide legal or compliance sign-off?
No. We build the records, workflows and controls, and prepare drafts. Legal interpretation and sign-off stay with your qualified advisers, and certification stays with accredited bodies.
Do you carry out audits or issue certificates?
No. We do not perform statutory or internal audits, issue audit opinions or certify compliance. We prepare the records, controls and evidence that your auditors and certification bodies review.
What kind of organisations is this work for?
Businesses with supplier, quality, data or approval exposures they cannot currently evidence, and institutions moving manual processes onto digital systems. We work in fuel and commodity supply, construction, retail and e-commerce, food and grocery, hotels and marinas.
How does an engagement start?
With an inventory of known risks and recent incidents, and read access to the systems where approvals and records sit. The first output is a register showing which exposures have evidence behind them and which do not.
How do you work with our legal, audit and compliance teams?
They set the requirements and keep the judgement. We agree with them what each record must contain and in what form, then build it into the systems your staff already use.
What happens after the controls are in place?
Your team owns the registers and workflows. We can run scheduled reviews against the agreed baselines, or hand over with documentation your internal audit function can use.
Discuss this with us
A few details help us route your enquiry to the right partner. Fields marked optional can be left blank.