Business and risk advisory services, where finance meets risk.

Business and risk advisory services are project engagements that sit outside the monthly compliance cycle: building a risk register and control framework, modelling scenarios, planning business continuity, valuing shares for a transaction or a tax event, and redesigning how the finance function itself works.

Most accounting firms stop at compliance. Books closed, tax filed, statutory accounts lodged: see you next year. For SMEs facing scale, regulation, capital raises or transactions, that's not enough. The work that determines whether a business survives a bad quarter, defends a valuation, or passes regulator scrutiny is strategic and risk-oriented, and it's the work we live for.

Our business and risk advisory scope covers strategic financial advisory (forecasting, scenario modelling, capital allocation), enterprise risk management (risk register, control framework, business continuity), valuation (for fundraising, M&A or internal share schemes), and operational consultancy (process re-engineering, finance-function design, system selection).

Engagement is typically project-based: a six-week sprint to build a risk register, a three-month engagement to design controls, a one-off valuation for a tax event. Some clients retain us on an ongoing advisory cadence; others use us for specific decisions and return when the next big question lands.

Where our advisory work touches on regulated activities (investment advice, audit) we coordinate with appropriately-licensed partners, but the substantive analysis, modelling and recommendations are ours.

A risk register is only useful when it is specific enough to argue with. Each entry names the risk, scores likelihood and impact on a fixed scale, names one accountable owner (a person, not a department), states the control already in place, then scores the residual risk after that control. The register is reviewed quarterly and anything scored high with no dated mitigation goes to the board as an exception. Registers that list "cyber attack" and "key person risk" with no owner and no score are decoration.

The internal controls that matter most in a business under 100 people are unglamorous and cheap:

• Dual authorisation on payments above a stated threshold, with the threshold written down.
• Bank payee changes verified by a call to a number you already held, not one on the email.
• Supplier onboarding separated from payment approval, so one person cannot create and pay a vendor.
• Monthly reconciliation reviewed by someone other than the preparer.
• Access rights removed on the leaver checklist, on the leaving date.
• A payroll change log reviewed against the pay run before it is approved.

Business continuity planning turns on two numbers per critical process: how long you can be down (recovery time) and how much data you can afford to lose (recovery point). Once those are agreed, most of the plan writes itself, because the numbers decide whether a nightly backup is adequate or whether you need a warm standby. The test is not the document. It is whether someone who is not the finance director can run the payroll in the week the finance director is unreachable.

Valuation work is usually driven by an event with a deadline. A share valuation agreed with HMRC for an EMI option grant holds for a limited window, so the grants have to be made inside it or the exercise starts again. A transaction valuation needs a defensible method (earnings multiple, discounted cash flow, or net asset, and usually more than one as a cross-check) with the assumptions stated so a buyer can test them rather than dismiss them.

A worked example of scenario modelling. A business with £4.2m of revenue and a 21 percent net margin models three cases: base, a 15 percent revenue fall, and the loss of its largest customer at 18 percent of revenue. The third case turns net margin negative in month two, not month five, because two thirds of the cost base is fixed inside a quarter. That single finding changes the contract renewal strategy and the notice periods on two supplier agreements. The model is worth more than the forecast.

This work assumes reliable numbers underneath it, which is why it pairs with monthly management accounts and, where the engagement is continuous rather than project-based, with fractional CFO services. Control frameworks built here feed directly into audit and SOC readiness work, and governance documentation into company secretarial support. Most of our valuation and option-scheme work comes from VC-backed startups. Retainer and project fee bands are on the fixed-fee pricing page. Advisory projects are quoted separately from the retained work in our accounting and tax services directory.