AUDIT & RISK EVOLUTION
– Interview with the ARC Chair
Since joining the Board in 2019, Keiran Horne has helped oversee a significant evolution in how Quayside manages its reporting and risk. From strengthening governance and assurance frameworks to embedding climate-related financial risk into decision-making, the organisation has developed a more mature approach to protecting and growing regional wealth.
A broader view of risk and value
As Chair of the Audit and Risk Committee (ARC), Keiran shares that the role has expanded well beyond traditional audit oversight and preparation of financial statements. “It has evolved into a commercial value-add part of the governance ecosystem,” she says. “Today, the committee’s terms of reference have widened to include a focus on cybersecurity, climate-related disclosures and assurance, over how effectively the organisation’s controls are working in practice. It’s no longer just a protective committee; it’s a value-add committee.”
That framing reflects where audit and risk governance is heading more broadly. Many boards still start by staffing the committee with accountants, and financial literacy remains essential. But an audit and risk committee is really a risk and assurance committee. Its core job is giving the Board confidence that the organisation’s most significant risks are identified, understood and managed in a way that supports strategy and long-term performance. Financial reporting sits at the centre of that, but it’s only one part of it.
Risk, in this sense, is anything that could get in the way of Quayside delivering on its strategy and sustaining enterprise value. Keiran is clear that good risk oversight isn’t just about spotting downside. Done well, it points to opportunity as well and whether that’s where to lean into the portfolio or where the returns aren’t worth the exposure.
As the Audit and Risk Committee has an increasing portfolio across the likes of cybersecurity, data governance, climate reporting, regulatory change, insurance and fraud risk. It all now sits inside the committee’s remit alongside financial statements and controls testing, not as occasional add-ons. Enterprise risk management runs through the committee’s oversight as a matter of course, and Keiran expects the ARC to understand how each of these risks may eventually show up within the organisation, not just how they look on a risk register. That breadth is what turns oversight into genuine assurance rather than a compliance checkbox.
Assurance over comfort
The same logic explains why external reviews and independent testing of controls matter so much to Keiran. It’s not enough for management to say controls are in place. Effective oversight means someone at the table who understands the difference between a control that exists on paper and one that actually holds under pressure, whether that’s a cyber incident, a climate-driven asset shock, or a breakdown in financial reporting discipline.
Keiran comments, “Risk and assurance go hand in hand. External advisor John Creagh helped us build the foundations of how we manage risk here, and assurance is the natural next step. You identify a risk, put controls in place, and then you have to ask: how effective are those controls, really?
That’s what assurance is for. It’s evolving here as our risk maturity evolves, and I think a mature approach to assurance is one of the best tools an organisation has for continuous improvement. Bringing in a fresh, external eye gives governors confidence the systems are working, and it often points to a better way of doing things.”
The committee itself has to work the same way. It’s a safe forum for genuine challenge between management and directors, not a rubber stamp. That’s harder to build than it sounds. It requires independence, a willingness to ask uncomfortable questions, and enough trust in the room that management brings problems forward early rather than managing them quietly. That’s the culture Keiran has built as ARC Chair.
A constrained portfolio
As a regional investment fund, Quayside operates with a significantly concentrated asset base. “Quayside’s biggest risk in the portfolio is concentration risk,” says Keiran. “This is why the Council’s decision in 2024 to enable a partial sell-down of Quayside’s Port of Tauranga shareholding is so important. A transaction of this scale, that is reinvested, will reduce the concentration risk and has the potential to provide greater returns, which benefits our shareholder and the community.”
Over time, Quayside has sought to diversify its holdings, broaden its exposure, and build a more balanced portfolio. “You can put your money in the bank, and it will be really safe, but you won’t earn much,” she says. “Or you can invest for higher returns, but you need to understand the risks and whether you’re being rewarded for them.”
“The Board defines clear risk appetites across different areas of the business. Some risks are tightly controlled. Others are taken deliberately and managed to support returns.”
That discipline is central to the ARC’s contribution. The committee helps ensure risk is not considered separately from performance, but as part of how Quayside makes investment decisions, protects the balance sheet and maintains sustainable distributions to Bay of Plenty Regional Council.
Risk management maturation
One of the most visible shifts at Quayside has been the maturation of its internal capability. When Keiran first joined the Board, the organisation was growing quickly but systems and processes were still catching up. She describes it as “a bit like a lanky teenager that had grown pretty quickly.” Since then, that gap has closed. Risk management frameworks are now embedded across the business, with staff at all levels actively considering risk in their decision-making. Explaining the practicalities of the framework, Keiran provides an example “We have a low risk tolerance for health and safety, but in contrast for some aspects of the investment portfolio we’re more prepared to take on a little more risk to earn a higher return.”
ARC’s governance has helped drive better visibility of material risks, clearer ownership of controls, and a stronger link between risk appetite and assurance.
Climate risk beyond disclosure
When the mandatory climate-reporting threshold for listed issuers rose to $1 billion last year, Quayside was no longer required to prepare a mandatory climate statement for the year ended 30 June 2026. From here, the focus shifted to targeted climate risk management, with a revised Climate Transition Plan approved by the Board in March 2026. “A good strategy helps you focus on that destination in the future,” Keiran says. “But it’s also underpinned by clear values and understanding why we’re here.” The point is not that climate risk has become less important. It is that the work is now more clearly aligned with Quayside’s role as a long-term investor: protect capital, understand material exposures, and focus effort where it is most decision-useful. “We now understand the risks and opportunities,” Keiran says. “The question is what we’re going to do about them.”
People enabling performance
When asked what has stuck with her most from her time on the Board, Keiran doesn’t point to a framework or a policy. She points to people. “I’m an accountant by background, but I hadn’t had a lot to do with financial markets before this appointment. I’ve learned a huge amount from my fellow independent directors, particularly Fraser, on financial markets and on governance more broadly. And I’ve immensely enjoyed working with Lyndon, seeing him lead by truly living the organisation’s values and bringing his team along with him. If there’s one lesson that’s stuck with me from this Board, it’s that it’s difficult to achieve anything of significance if you haven’t got the right people around the table, governors and management both.”
That’s the thinking behind how Quayside’s governance actually works. “A thought partnership model is always the best,” Keiran says. Governors and management working together, with mutual respect, clear roles, and a shared focus on performance.
It also relies on a clear separation between the commercial entity and its public shareholder. “It’s our job to earn the income,” Keiran says. “And for the shareholder to decide how that is used for the community.” That model allows the organisation to operate with commercial discipline while still delivering regional outcomes. The ARC’s role is to support that discipline, testing whether risks are understood, controls are working, assurance is targeted, and decisions are made with the right information in front of the Board.
