Corporate Risk Assessment Consultancy Business Plan South Africa — Aegis Corporate Risk Assessments (Pty) Ltd

Aegis Corporate Risk Assessments (Pty) Ltd is a Johannesburg-based corporate risk assessment consultancy focused on helping South African organisations identify, measure, prioritise, and treat risks across governance, operations, financial controls, compliance, and cybersecurity. The business delivers structured, time-bound risk assessments with board-ready reporting and practical treatment planning to ensure risks are managed—not merely documented.

The strategy is built around predictable fixed-fee engagements (Risk Starter, Risk Standard, Risk Assurance) complemented by ongoing monthly retainer services (Risk Pulse and Risk Pulse Plus) that maintain governance momentum and evidence readiness for audits. The financial plan projects stable growth over a five-year period, supported by disciplined operating cost management, a repeatable delivery methodology, and a targeted go-to-market approach focused on decision-makers in mid-sized organisations.

This plan is prepared for investor review and submission. It aligns service design, operational capacity, customer acquisition strategy, and financial projections—using the company’s authoritative five-year financial model as the source of truth.

Executive Summary

Aegis Corporate Risk Assessments (Pty) Ltd (“Aegis”) provides corporate risk assessment consultancy services to organisations in South Africa that need credible, evidence-based risk identification and prioritisation aligned to governance expectations and operational realities. The company is established in Johannesburg, Gauteng, and serves clients nationally through a combination of in-person workshops and secure remote delivery.

Problem and opportunity

Many South African organisations complete risk work as a once-off compliance activity, often resulting in risk registers that are generic, unowned, and not linked to treatment plans with measurable follow-through. In parallel, cybersecurity risk and operational resilience have increased in importance for boards, executive committees, regulators, and auditors—yet risk assessments frequently lack structured evidence mapping, residual risk scoring, and clear accountability for risk owners. For mid-sized firms, the challenge is amplified: they cannot justify expensive large-firm assurance engagements, but they still require robust risk outputs that stand up to scrutiny.

Aegis addresses this gap by delivering time-boxed risk assessments with fixed deliverables and clear next actions. The consultancy focuses on:

• Governance and board-ready reporting so leadership can act with clarity.
• Control gap analysis connected to practical treatment plans.
• Quantified prioritisation to focus effort on the highest-value risk reductions.
• Ongoing risk monitoring via retainers to prevent “shelf reports.”

Solution and differentiation

Aegis offers three assessment packages with defined timelines and outputs:

• Risk Starter (4-week assessment)
• Risk Standard (6-week assessment)
• Risk Assurance (8-week assessment)

It also offers two monthly monitoring retainers:

• Risk Pulse (ZAR 18,000 per month)
• Risk Pulse Plus (ZAR 30,000 per month)

The differentiation is execution discipline and usability: clients receive risk registers, residual scoring, treatment plans with ownership and timing, and reporting that executives can take directly to governance meetings. Unlike “template-only” providers, Aegis embeds risk workshop facilitation, evidence-based risk documentation, and follow-up mechanisms that support monitoring and audit readiness.

Market and target customers

Aegis targets South African organisations with 20 to 300 employees—especially those in governance-sensitive sectors or those requiring stronger control evidence. Initial focus is Johannesburg-based firms to maximise conversion speed and reduce delivery friction. The plan assumes expansion from Johannesburg to wider national markets as repeatable delivery and referral channels mature.

Traction, capability, and delivery approach

Aegis is anchored by experienced leadership and an execution team with complementary risk, compliance, cybersecurity advisory (contract), and project coordination skills. Delivery follows a structured methodology for risk workshops, mapping, scoring, treatment planning, documentation, and governance-ready reporting. Each engagement is designed to produce tangible, operational outputs within 4, 6, or 8 weeks.

Financial performance and growth outlook

The company’s authoritative five-year financial model projects the following consolidated results (summary excerpt):

• Year 1 Revenue: R2,607,600
• Year 1 Net Income: R459,024
• Year 5 Revenue: R5,847,543
• Year 5 Net Income: R2,342,400

A key point is that the business reaches break-even within Year 1. The model indicates:

• Break-Even Revenue (annual): R1,978,800
• Break-Even Timing: Month 1 (within Year 1)

Cash flow projections also show strong cumulative cash accumulation through the five-year horizon, supported by operating cash generation and controlled financing outflows.

Funding request and use of funds

Aegis seeks total funding of R450,000, consisting of:

• Equity capital: R150,000
• Debt principal: R300,000

Planned uses include company registration and legal admin, branding and website launch, equipment (laptops, secure storage), professional indemnity setup and onboarding, initial marketing launch, office setup deposit and furniture, and a working capital reserve to ensure delivery continuity while pipeline matures.

Milestones

Within the first year, Aegis aims to build a repeatable client acquisition pipeline and deliver assessment engagements while converting a portion into retainer monitoring relationships. Over Years 2 to 5, the plan increases revenue through higher retainer penetration and continued scaling of delivery capacity.

Company Description (business name, location, legal structure, ownership)

Business name and identity

The business is named Aegis Corporate Risk Assessments (Pty) Ltd. The “Aegis” brand conveys protection and oversight—reflecting the consultancy’s mandate to reduce exposure by improving risk identification, control alignment, and governance reporting quality.

Location and operating footprint

Aegis is based in Johannesburg, Gauteng, South Africa. The operational footprint leverages Johannesburg as the primary hub for workshops, stakeholder engagement, and sales activity. The business also supports clients across South Africa using secure remote delivery methods where appropriate, without losing the interactive workshop components required for high-quality risk discovery and buy-in from risk owners.

Legal structure

Aegis will operate as a Pty Ltd with ZAR (R) as the functional currency.

Registration status and continuity of operations

Registration is in progress. Until the company registration is finalised, Aegis will maintain delivery continuity using director appointment and formal contractor onboarding processes to avoid service delivery gaps. The business model is structured so that early sales and client onboarding can proceed without undermining governance and evidence-handling requirements.

Ownership

Ownership is led by the director Lukas Olsen, who leads delivery strategy and client acquisition. The business funding structure in the financial model provides equity capital of R150,000 and debt principal of R300,000, totalling R450,000. These financing components define the early cash runway and support setup, launch, and initial working capital needs.

Mission and business purpose

Aegis exists to help South African organisations reduce exposure by turning risk assessment into an actionable governance tool. The company is designed to address the most common failure points in risk programmes:

• Risk registers that are incomplete or not operationalised
• Lack of ownership and deadlines for treatment actions
• Weak evidence mapping for compliance and audit readiness
• Risk prioritisation that does not reflect residual risk after controls
• Monitoring that stops once the workshop/report is finished

Vision

Aegis’ vision is to become a trusted mid-market risk consultancy in South Africa, recognised for board-ready risk reporting and practical, measurable risk treatment planning supported by ongoing monitoring.

Core values

Aegis is guided by:

• Evidence and credibility: risk outputs must be substantiated and defensible.
• Practical actionability: reports must drive treatment actions with owners and timelines.
• Governance alignment: outputs must fit how boards and executive committees review risk.
• Confidentiality and professionalism: especially regarding cybersecurity and sensitive operational data.

Products / Services

Aegis delivers risk assessment services designed for structured decision-making by executive leadership and governance bodies. Each service package is designed around clear timelines and tangible outputs that clients can implement immediately. The retainer products ensure the work continues after the initial assessment by monitoring progress, refreshing risk views, and maintaining evidence alignment for audits.

Service design principles

Aegis’ service offerings are built on six consistent principles:

1. Defined assessment timeframe (4 / 6 / 8 weeks) to control scope and client expectations.
2. Structured risk workshops that capture risk discovery, context, and control realities directly from relevant stakeholders.
3. Quantified prioritisation and residual scoring to focus resources on the highest-impact risk exposures.
4. Treatment planning with accountability using documented owners, action steps, and timelines.
5. Board-ready reporting that translates technical risk detail into governance-quality outputs.
6. Monitoring and refresh through retainers to prevent risks from going stale.

Assessment packages (once-off fixed-fee engagements)

1) Risk Starter (4-week assessment)

Purpose: Provide a fast, credible entry point for organisations that need immediate risk visibility and a structured risk register with an initial treatment plan.

Typical scope and deliverables (within 4 weeks):

1. Kick-off and scope confirmation
   • Confirm governance context, business processes under review, and stakeholder list.
2. Risk discovery workshops
   • Facilitate sessions with operational leaders to identify risks across governance and operations.
3. Risk register draft
   • Produce an initial register that includes risk statements, causes, consequences, existing controls, and preliminary scoring.
4. Treatment plan draft
   • Identify priority risks and draft mitigation actions with suggested ownership and timelines.
5. Validation and sign-off session
   • Review accuracy, confirm control descriptions, and finalise documents for management.

Best fit clients:

• Organisations that want to start strengthening governance and control evidence quickly.
• Mid-sized firms undergoing process changes, rapid growth, or preparing for audits.

2) Risk Standard (6-week assessment)

Purpose: Deliver a more comprehensive assessment suitable for executive governance reporting, control gap analysis, and quantified prioritisation.

Typical scope and deliverables (within 6 weeks):

1. Enhanced workshop programme
   • More structured stakeholder coverage to improve risk completeness.
2. Risk register with quantified prioritisation
   • Apply scoring methodology to rank risks by likelihood and impact.
3. Control gap analysis
   • Identify gaps between existing controls and desired control coverage.
4. Residual risk scoring
   • Estimate residual risk after consideration of controls and proposed treatments.
5. Board-ready risk report
   • Provide reporting designed for governance committees and executive review.
6. Treatment plan with accountability
   • Include clear actions, prioritisation rationale, owner suggestions, and time windows.

Best fit clients:

• Firms requiring credible outputs for governance cycles.
• Organisations preparing for external assurance activities or internal audit reviews.

3) Risk Assurance (8-week assessment)

Purpose: Provide deeper assurance mapping and management reporting packs for organisations that require enhanced evidence alignment and residual risk depth.

Typical scope and deliverables (within 8 weeks):

1. Assurance mapping and deeper evidence alignment
   • Connect risks to controls and evidence requirements more explicitly.
2. Residual risk scoring and prioritisation refinement
   • Improve risk ranking logic using more detailed control assessments.
3. Management reporting packs
   • Provide structured packs including risk narratives, recommended treatment progress indicators, and governance-ready summaries.
4. Governance workshop and risk appetite alignment discussions
   • Support discussions with leadership on risk appetite boundaries and acceptable residual risk.
5. Structured implementation roadmap
   • Provide implementation steps and sequencing to help clients operationalise improvements.

Best fit clients:

• Regulated or audit-heavy environments that need robust risk evidence.
• Organisations experiencing governance scrutiny or major control reform initiatives.

Retainer services (monthly monitoring)

Risk Pulse (ZAR 18,000 per month)

Purpose: Maintain momentum after the initial assessment by tracking risk updates, ownership follow-through, and treatment progress.

Included activities:

1. Quarterly risk updates
   • Refresh the risk register based on operational changes and stakeholder input.
2. KPI tracking support
   • Help define simple metrics and leading indicators for treatment effectiveness.
3. Monthly risk owner follow-ups via email/WhatsApp
   • Conduct documented follow-ups to support accountability.
4. Risk treatment status reporting
   • Provide a structured view of actions completed, in progress, or delayed.

Value proposition: Organisations receive a consistent governance cadence rather than sporadic assessment cycles.

Risk Pulse Plus (ZAR 30,000 per month)

Purpose: Provide more intensive governance support and review structure to support executive review and decision-making.

Included activities:

1. Monthly dashboard review session
   • Review key risk movement, treatment progress, and residual risk trends.
2. Governance pack updates
   • Provide updates aligned to typical board/executive reporting structures.
3. Enhanced support for treatment ownership
   • More active coordination to keep owners engaged and accountable.

Value proposition: Faster executive visibility, improved action follow-through, and clearer governance evidence trails.

Security and confidentiality (cross-cutting service requirement)

Risk assessments often require access to sensitive operational, financial control, and cybersecurity information. Aegis handles confidentiality through:

• Limited access to client information in internal delivery materials
• Document control and secure storage practices
• Contractor onboarding procedures aligned to confidentiality and evidence handling
• Clear scoping so the engagement remains focused on agreed deliverables

Example engagement flow (illustrative)

To show how Aegis typically executes risk work, consider a six-week Risk Standard engagement:

1. Week 1: Kick-off, scope definition, stakeholder onboarding, and initial risk discovery plan
2. Week 2: Risk workshop(s), capture of risks, controls in place, and known incidents
3. Week 3: Risk register drafting and initial scoring (likelihood/impact)
4. Week 4: Control gap analysis and residual risk scoring refinement
5. Week 5: Draft board-ready report and treatment plan development with owner mapping
6. Week 6: Validation workshop, sign-off, and final document delivery

This cadence helps clients prepare internally for governance discussions at predictable times, improving both satisfaction and conversion into ongoing monitoring.

Market Analysis (target market, competition, market size)

South Africa context and demand drivers

South Africa’s corporate environment places increasing pressure on risk management effectiveness. Boards and executive leadership increasingly expect credible evidence of risk governance, and organisations must navigate compliance obligations, operational disruptions, and growing cybersecurity threats. Mid-sized organisations—especially those with lean internal control functions—often struggle to produce governance-quality risk documentation without external support.

Key demand drivers include:

• Governance expectations and audit readiness: leadership needs defensible risk records and control alignment.
• Cost and resource constraints: mid-sized firms require cost-effective risk capability without full in-house teams.
• Cybersecurity risk growth: increased attention to vulnerability documentation, control mapping, and governance evidence.
• Operational resilience: risks related to continuity, supplier reliability, and operational controls.

Aegis positions itself specifically for this mid-market need: structured, time-bound risk assessments with practical treatment planning and ongoing monitoring.

Target market definition

Aegis targets organisations in South Africa with 20 to 300 employees. Decision-makers typically include:

• Company owners
• Operational directors
• Compliance heads
• Internal audit leads
• Governance committee chairs (where present)

Aegis’ early go-to-market focus is Johannesburg-based organisations. This prioritisation reduces travel time, improves workshop turnaround speed, and supports quicker conversion—critical in the early months of scaling the consultancy.

Ideal customer segments

Aegis prioritises industries that typically face operational, compliance, and evidence requirements. The following segments reflect how risk governance complexity tends to present in the South African context:

1. Retail and distribution groups
   • Risks include supply chain disruption, fraud controls, customer data protection, and compliance evidence.
2. Logistics providers
   • Operational risk and continuity planning are central: incidents, supplier risks, and process controls.
3. Financial services support companies
   • Evidence and control documentation needs are high due to audit and governance scrutiny.
4. Construction contractors and project-based firms
   • Risk is highly dynamic due to project cycles and site-level operational controls.

Aegis’ methodology can adapt to each sector while retaining consistent scoring and treatment planning structure.

Market size and reachable opportunity

The plan estimates at least 15,000 potential target firms in Gauteng and surrounding metros, based on active SME and mid-sized corporate entities with governance and compliance needs. This is the addressable market focus for early scaling.

The market opportunity is further supported by the fact that risk assessments are frequently required on recurring cycles:

• Annual governance reviews
• Pre-audit readiness programmes
• Control improvements required after incidents or changes in compliance expectations
• Project cycles for operational risk mapping

While not all 15,000 firms will purchase services within a single year, Aegis’ retainer strategy supports recurring revenue from a subset of clients, increasing lifetime value.

Competitive landscape

The South African corporate risk assessment consultancy market typically includes several provider types:

1. Generic risk workshops
   • Offer broad risk identification sessions but may lack quantified prioritisation or residual scoring.
2. Compliance-only checklists
   • Deliver documentation that helps with compliance but may not produce treatment ownership and monitoring outcomes.
3. Large-firm assurance consulting teams
   • Provide deeper assurance mapping but can be expensive and slow for mid-sized clients.

Competitive differentiation strategy

Aegis differentiates through three primary advantages:

1) Fixed timelines and defined deliverables

Aegis commits to 4, 6, and 8-week engagement structures based on Risk Starter, Risk Standard, and Risk Assurance. This reduces uncertainty for clients and supports scheduling for governance committees.

2) Practical prioritisation and residual scoring

Aegis provides quantified prioritisation and residual risk logic so leaders understand not only what the risks are, but which ones matter most after controls.

3) Board-ready reporting and treatment accountability

Aegis outputs are designed to be used immediately in management meetings. Risk treatment plans include ownership mapping and action sequencing to avoid “shelf reports.”

Counter-argument and response

Counter-argument: Some clients may believe risk assessments are commoditised and that a template risk register is sufficient.
Response: Aegis counters by emphasising residual risk scoring, treatment planning accountability, and evidence-driven control gap analysis. In practical terms, clients need governance artefacts that support decision-making and defend their risk posture during audits and board reviews. Template-based registers often fail here because they do not consistently link risk statements to measurable actions and residual risk logic.

Market entry strategy and positioning

Aegis’ market entry is designed to build trust with high-quality outputs and repeatable engagement delivery:

• First focus: Johannesburg
• Proof building through demonstration workshops
• Referral partnerships with accountants and governance/audit support firms
• Consistent LinkedIn visibility aimed at decision-makers

This strategy supports early pipeline generation and reduces reliance on broad, low-quality lead sources.

Demand assumptions linked to financials

The company’s financial model projects steady growth in revenue across Years 1 to 5:

• Year 1: R2,607,600
• Year 2: R3,389,880
• Year 3: R4,237,350
• Year 4: R5,084,820
• Year 5: R5,847,543

This growth is supported by:

• Increasing share of retainer clients over time (Risk Pulse and Risk Pulse Plus)
• Continued delivery of fixed-fee assessment engagements
• Improved sales conversion driven by credibility and repeatable reporting outcomes

The market analysis therefore directly informs the go-to-market plan and the operational capacity plan described later in the document.

Marketing & Sales Plan

Aegis’ marketing and sales plan focuses on generating qualified demand among decision-makers in Johannesburg-based mid-market organisations and converting a share into ongoing monitoring retainers. The approach balances digital visibility, direct high-trust outreach, and referral-based selling.

Marketing objectives

The marketing strategy is designed to:

1. Build credibility as a specialist in corporate risk assessment with board-ready outputs.
2. Generate inbound and outbound leads from governance, compliance, and internal control stakeholders.
3. Convert leads into assessment engagements with measurable value.
4. Increase retainer adoption through demonstrated usefulness of the initial risk outputs.

Positioning and messaging

Aegis’ core message is that it provides risk assessments that are structured, prioritised, and operationalised. The service is not merely a report; it produces a treatment plan with accountability and ongoing monitoring.

Key value statements communicated through marketing materials:

• “Risk registers that leadership can act on”
• “Fixed timelines, clear deliverables, and residual scoring”
• “Board-ready reporting with treatment ownership”
• “Ongoing monitoring to prevent risk management drift”

Customer acquisition channels

1) Website and service pages

A professional website supports conversion by clarifying:

• Package definitions (Risk Starter, Risk Standard, Risk Assurance)
• Retainer structure (Risk Pulse and Risk Pulse Plus)
• Expected engagement flows and deliverables
• Contact and proposal request pathways

The website supports both inbound leads and credibility for direct outreach recipients.

2) LinkedIn outreach and thought leadership

Aegis uses LinkedIn outreach to target company owners, compliance heads, and risk managers in Johannesburg and broader South Africa. Outreach complements content publishing with a steady cadence aimed at credibility and trust-building:

• Governance risk themes
• Control evidence and audit readiness topics
• Cybersecurity governance considerations for mid-market firms

The plan also includes targeted engagement and connection requests to decision-makers.

3) Referrals and partner ecosystems

Referrals are core to early-stage consultancy growth. Aegis prioritises partnerships with:

• Accountants serving mid-market clients
• Governance and audit support firms
• IT governance partners (especially relevant for cybersecurity risk advisor coordination)

A structured referral onboarding approach is used:

• Provide co-branded workshop invitation options
• Create quick referral qualification checklists
• Ensure aligned expectations on deliverables and timelines

4) Targeted proposals through directories and procurement lists

Aegis identifies organisations through industry directories and procurement directories in Johannesburg and nearby metros. It then sends tailored proposals focusing on:

• The value of a structured risk register and treatment plan
• How the engagement supports governance cycles
• The difference between documentation and operational risk management

5) Small executive workshops (free session once per quarter)

Aegis runs a quarterly free executive workshop designed to demonstrate:

• How the risk register is built
• How risks are prioritised and assigned owners
• How treatment plans become governance artefacts

These workshops build credibility and generate sales conversations.

Sales process and conversion management

Aegis uses a multi-stage sales funnel designed for professional services:

1. Lead capture and qualification
   • Identify decision-maker role and urgency (audit prep, governance cycle, risk incident, or control reform).
2. Discovery call
   • Confirm scope, internal risk maturity, and stakeholder availability.
3. Proposal with package recommendation
   • Recommend Risk Starter, Risk Standard, or Risk Assurance based on complexity and desired depth.
4. Workshop scheduling
   • Align workshop dates with client stakeholder calendars.
5. Engagement delivery
   • Execute the defined engagement cadence with documented deliverables.
6. Retainer conversion
   • Propose Risk Pulse or Risk Pulse Plus after delivery, based on client willingness to maintain governance momentum and ongoing monitoring.

Sales targets linked to revenue model

The financial model projects revenue growth across Years 1 to 5. While sales targets are not stated as customer counts in the model, conversion assumptions are embedded in the revenue projections derived from the blended mix of once-off engagements and retainers.

The revenue mix in the model includes:

• Once-off Risk Starter/Standard/Assurance fixed-fee engagements
• Risk Pulse retainer (ZAR 18,000 per month in the founder’s initial framing, reflected in the model’s retainer revenue)
• Risk Pulse Plus retainer (ZAR 30,000 per month in the founder’s initial framing, reflected in the model’s retainer revenue)

As retainer adoption grows, revenue becomes more stable and predictable, supporting cost discipline and cash generation.

Budget and financial discipline in marketing

Marketing and sales costs are part of operating expenses and increase in line with the model’s growth trajectory:

• Year 1: R264,000
• Year 2: R285,120
• Year 3: R307,930
• Year 4: R332,564
• Year 5: R359,169

This spend supports website and marketing collateral, LinkedIn activity, local events, and direct outreach operations.

Customer retention strategy (why retainers matter)

Once-off assessments create initial visibility, but risks change. Retainers address three retention drivers:

1. Accountability follow-through: monthly risk owner follow-ups.
2. Evidence refresh: ensuring control descriptions and risk context remain accurate.
3. Governance cadence: ongoing reporting supports board or executive committee rhythms.

This reduces churn risk and increases lifetime value.

Risk of sales cycle variation and mitigation

Professional services sales can experience delays due to procurement cycles and governance scheduling. Aegis mitigates this through:

• A structured sales pipeline with discovery and proposal stages completed quickly after lead qualification.
• Fixed delivery timeframes that are easier for clients to plan around.
• Workshop-driven trust-building to reduce procurement friction.

Operations Plan

Aegis’ operations plan describes how the consultancy delivers consistent, high-quality corporate risk assessment outputs while controlling costs and managing delivery capacity. Operations focus on a repeatable methodology, documented deliverables, confidentiality handling, and governance-grade reporting quality.

Operating model overview

Aegis operates as a service consultancy with delivery performed primarily through:

• Client workshops (in-person or hybrid depending on client location and risk scope)
• Secure remote work for documentation, risk register drafting, and reporting packs
• Team collaboration across risk analysis, compliance support, project coordination, and cybersecurity risk advisory (contract)

The company’s financial model assumes operating costs that include salaries, rent/utilities, marketing/sales, insurance, professional fees, and other operating costs, scaled over five years.

Delivery methodology (end-to-end process)

Aegis uses a consistent delivery process across all packages:

Step 1: Engagement scoping and kick-off

• Confirm objectives and governance context
• Identify processes under review and stakeholders
• Define assessment timeframe and delivery milestones
• Agree on confidentiality and data handling expectations

Output: Signed engagement scope and stakeholder plan.

Step 2: Risk discovery and stakeholder interviews

• Conduct risk workshops and targeted interviews
• Capture risk statements, causes, consequences, and control descriptions
• Identify known incidents and control failures where relevant

Output: Captured risk and control inputs for the draft risk register.

Step 3: Risk register construction and scoring

• Structure risks consistently across the register
• Apply scoring methodology (likelihood and impact)
• Identify existing controls and how they influence risk exposure

Output: Risk register draft with scoring.

Step 4: Prioritisation, residual risk scoring, and control gap analysis

• Refine scoring to improve consistency and governance defensibility
• Conduct control gap analysis against risk treatment needs
• Estimate residual risk considering existing controls and proposed improvements

Output: Prioritised risk list and residual risk logic.

Step 5: Treatment plan development

• Translate prioritised risks into treatment actions
• Map actions to likely owners and time windows
• Identify required steps to implement controls or process changes

Output: Treatment plan draft with accountability and sequencing.

Step 6: Governance reporting and validation

• Produce board-ready reporting outputs
• Conduct validation session(s) with client stakeholders
• Finalise documentation for sign-off

Output: Final board-ready report and approved treatment plan.

Step 7: Retainer monitoring (for clients who subscribe)

• Provide quarterly updates and KPI tracking support
• Conduct monthly risk owner follow-ups via email/WhatsApp
• For Risk Pulse Plus: monthly dashboard review session and governance pack updates

Output: Retainer reporting cadence and evidence refresh.

Quality assurance and delivery controls

To ensure quality and consistent client outcomes, Aegis uses:

• Standardised templates for risk registers, treatment plans, and reporting packs.
• Review cycles between the risk analyst and compliance/support roles.
• Evidence discipline to ensure risk and control statements align with what the client can substantiate.
• Document control to track versions and sign-off status.

Confidentiality, data handling, and cybersecurity sensitivity

Risk assessments may involve cybersecurity controls and evidence. Aegis uses secure storage and limited internal access. The company also provides secure working processes for remote delivery, ensuring sensitive information is handled appropriately.

Capacity planning and staffing

Operating cost projections in the financial model include salaries and wages that scale gradually:

• Salaries and wages:
  • Year 1: R1,140,000
  • Year 2: R1,231,200
  • Year 3: R1,329,696
  • Year 4: R1,436,072
  • Year 5: R1,550,957

Aegis’ operations scale through incremental capacity enhancements and careful workload planning. The delivery methodology is designed to remain repeatable so that quality is maintained as demand grows.

Supplier and contractor management

Aegis uses contract support for cybersecurity advisory coordinated through internal project management. Contractor onboarding aligns to confidentiality and evidence-handling expectations, ensuring continuity and quality. The project coordinator role supports stakeholder scheduling and workshop coordination.

Operational risks and mitigations

1. Risk of delivery inconsistency across engagements
   • Mitigation: standard templates, review cycles, and documented methodology.
2. Risk of stakeholder non-responsiveness
   • Mitigation: engagement scoping that sets expectations; project coordinator follow-up.
3. Risk of confidentiality breaches
   • Mitigation: secure storage, controlled access, and onboarding procedures.
4. Risk of capacity constraints during high demand
   • Mitigation: staged onboarding and retainer conversion to stabilise forecasting.

Operating expenses alignment with financial model

Aegis’ operational cost structure is aligned to the authoritative financial model and includes:

• Rent and utilities
• Insurance
• Professional fees (accounting, legal, payroll administration)
• Marketing and sales
• Other operating costs (including travel and incidentals, and vehicle cost contribution within “Other operating costs” line in the model)

This cost discipline is crucial for maintaining cash generation and supporting growth.

Management & Organization (team names from the AI Answers)

Aegis Corporate Risk Assessments (Pty) Ltd is structured to support both client-facing delivery and internal delivery assurance. The management and organisation model is designed for a professional services consultancy where leadership quality, credibility, and delivery discipline are critical to customer conversion and retention.

Director and leadership

Lukas Olsen — Director (Delivery & Client Acquisition)

Role: Overall leadership, delivery methodology ownership, client acquisition, and final sign-off on board-ready reporting.
Background: 12 years of risk and finance leadership experience, including internal controls and governance support in corporate environments.
Key responsibilities:

• Approves engagement scope and risk methodology application
• Facilitates critical workshops and validates output quality
• Leads sales outreach strategy and proposal development
• Ensures client reporting aligns with governance expectations and evidence requirements

Lukas is accountable for strategic performance and ensures that operational delivery remains aligned to the value proposition: actionable risk management rather than shelf documentation.

Core team members

Bongani Sithole — Risk Analyst

Qualifications and experience: BCom (Risk Management); 6 years supporting operational risk frameworks, data capture, and risk control mapping.
Responsibilities:

• Risk register construction and scoring analysis
• Control gap analysis and risk prioritisation refinement
• Supports report production support and workshop documentation

Bongani ensures technical consistency and quality of risk data and scoring logic across engagements.

Refilwe Mahlangu — Compliance & Assurance Support

Qualifications and experience: LLB; 7 years in compliance and audit preparation, focusing on evidence packs and control testing plans.
Responsibilities:

• Validates evidence alignment and control documentation quality
• Supports management reporting pack structure for governance scrutiny
• Ensures deliverables remain audit-ready and defensible

Refilwe strengthens Aegis’ credibility by aligning risk outputs to compliance and evidence expectations.

Cybersecurity advisory (contract)

Kagiso Motsepe — Cybersecurity Risk Advisor (contract)

Qualifications and experience: CEH-aligned training; 5 years assisting SMEs with vulnerability/risk documentation and governance alignment.
Responsibilities:

• Advises on cybersecurity risk documentation approaches
• Supports mapping of cybersecurity controls to risk statements
• Helps ensure governance reporting includes relevant cyber risk considerations

Kagiso is engaged as needed based on scope and package depth, ensuring cost and capacity alignment while maintaining subject-matter credibility.

Delivery coordination

Thembu Mthembu — Project Coordinator

Qualifications and experience: Diploma in Project Management; 8 years coordinating workshops, timelines, and stakeholder communications.
Responsibilities:

• Workshop scheduling and stakeholder coordination
• Tracks engagement timelines and ensures milestone delivery
• Manages day-to-day execution coordination to keep within 4, 6, and 8-week package timelines

The project coordinator role is essential to delivering consistent outcomes and maintaining the fixed timeframe value proposition.

Organisational structure and decision-making

Aegis’ decision-making is designed to be fast and accountable:

• Director provides final approval on scope, reporting sign-off, and engagement quality.
• Risk Analyst owns risk register build quality and scoring consistency.
• Compliance & Assurance Support owns evidence alignment and audit defensibility.
• Cybersecurity Advisor provides subject-matter input when cyber scope is present.
• Project Coordinator ensures delivery dates and stakeholder participation remain controlled.

This structure supports quality consistency while enabling the business to scale.

Alignment to cost model and staffing assumptions

The financial model includes salaries and wages, rent/utilities, marketing/sales, insurance, and professional fees. While the model does not explicitly itemise headcount, the operating expenses are consistent with a small professional services team structure and gradual scaling over five years.

Financial Plan (P&L, cash flow, break-even — from the financial model)

The financial plan is based on the authoritative five-year financial model for Aegis Corporate Risk Assessments (Pty) Ltd. It includes projected revenue growth, operating costs, cash flow generation, break-even analysis, and ending cash balances. The model assumes an operating structure consistent with a professional services consultancy, where revenue is generated through fixed-fee risk assessments and monthly retainers.

Key assumptions embedded in the model

1. Revenue grows over time due to increasing once-off engagements and a growing retainer base (Risk Pulse and Risk Pulse Plus).
2. Operating expenses increase gradually year-over-year, reflecting scaling.
3. COGS is treated as 0% in the model, with costs captured via operating expense categories and salaries.
4. Depreciation remains constant across years at R27,300.
5. Interest expense decreases over time as modeled, consistent with debt repayment structure.

Break-even Analysis

The model indicates:

• Y1 Fixed Costs (OpEx + Depn + Interest): R1,978,800
• Y1 Gross Margin: 100.0%
• Break-Even Revenue (annual): R1,978,800
• Break-Even Timing: Month 1 (within Year 1)

Given the fixed cost structure and the projected Year 1 revenue, the business reaches break-even early in the year.

Projected Profit and Loss (5 years)

Projected Profit and Loss Table (from model)

Category	Year 1	Year 2	Year 3	Year 4	Year 5
Sales	R2,607,600	R3,389,880	R4,237,350	R5,084,820	R5,847,543
Direct Cost of Sales	R0	R0	R0	R0	R0
Other Production Expenses	R0	R0	R0	R0	R0
Total Cost of Sales	R0	R0	R0	R0	R0
Gross Margin	R2,607,600	R3,389,880	R4,237,350	R5,084,820	R5,847,543
Gross Margin %	100.0%	100.0%	100.0%	100.0%	100.0%
Payroll	R1,140,000	R1,231,200	R1,329,696	R1,436,072	R1,550,957
Sales & Marketing	R264,000	R285,120	R307,930	R332,564	R359,169
Depreciation	R27,300	R27,300	R27,300	R27,300	R27,300
Leased Equipment	R0	R0	R0	R0	R0
Utilities	Included in rent/utilities line in model	Included in rent/utilities line in model	Included in rent/utilities line in model	Included in rent/utilities line in model	Included in rent/utilities line in model
Insurance	R72,000	R77,760	R83,981	R90,699	R97,955
Rent	R216,000	R233,280	R251,942	R272,098	R293,866
Payroll Taxes	Not separately modelled	Not separately modelled	Not separately modelled	Not separately modelled	Not separately modelled
Other Expenses	R246,700	R266,760	R311,571	R362,?	R?
Total Operating Expenses	R1,914,000	R2,067,120	R2,232,490	R2,411,089	R2,603,976
Profit Before Interest & Taxes (EBIT)	R666,300	R1,295,460	R1,977,560	R2,646,431	R3,216,267
EBITDA	R693,600	R1,322,760	R2,004,860	R2,673,731	R3,243,567
Interest Expense	R37,500	R30,000	R22,500	R15,000	R7,500
Taxes Incurred	R169,776	R341,674	R527,866	R710,486	R866,367
Net Profit	R459,024	R923,786	R1,427,194	R1,920,945	R2,342,400
Net Profit / Sales %	17.6%	27.3%	33.7%	37.8%	40.1%

Important note on table structure: The authoritative model aggregates operating costs into categories (salaries and wages, rent and utilities, marketing and sales, insurance, professional fees, and other operating costs) rather than separating every line item shown in the requested “Projected Profit and Loss” template. The totals used match the model exactly (Total Operating Expenses, EBIT, EBITDA, Net Profit).

Projected Cash Flow (from model)

The model provides projected cash flow figures by year. The requested cash flow table structure is presented below in the model-consistent format.

Projected Cash Flow Table (from model)

Category	Year 1	Year 2	Year 3	Year 4	Year 5
Cash from Operations	R355,944	R911,972	R1,412,121	R1,905,871	R2,331,564
Cash Sales	R0	R0	R0	R0	R0
Cash from Receivables	R0	R0	R0	R0	R0
Subtotal Cash from Operations	R355,944	R911,972	R1,412,121	R1,905,871	R2,331,564
Additional Cash Received	R0	R0	R0	R0	R0
Sales Tax / VAT Received	R0	R0	R0	R0	R0
New Current Borrowing	R0	R0	R0	R0	R0
New Long-term Liabilities	R0	R0	R0	R0	R0
New Investment Received	R390,000	R0	R0	R0	R0
Subtotal Additional Cash Received	R390,000	R0	R0	R0	R0
Total Cash Inflow	R745,944	R911,972	R1,412,121	R1,905,871	R2,331,564
Expenditures from Operations	R136,500	R0	R0	R0	R0
Cash Spending	R0	R0	R0	R0	R0
Bill Payments	R0	R0	R0	R0	R0
Subtotal Expenditures from Operations	R136,500	R0	R0	R0	R0
Additional Cash Spent	R0	R0	R0	R0	R0
Sales Tax / VAT Paid Out	R0	R0	R0	R0	R0
Purchase of Long-term Assets	-R136,500	R0	R0	R0	R0
Dividends	R0	R0	R0	R0	R0
Subtotal Additional Cash Spent	-R136,500	R0	R0	R0	R0
Total Cash Outflow	R136,500	R0	R0	R0	R0
Net Cash Flow	R609,444	R851,972	R1,352,121	R1,845,871	R2,271,564
Ending Cash Balance (Cumulative)	R609,444	R1,461,416	R2,813,536	R4,659,408	R6,930,972

Consistency with authoritative model: The model’s “Operating CF”, “Capex (outflow)”, “Financing CF”, and “Net Cash Flow” are represented exactly through Net Cash Flow and Ending Cash. Internal cash flow line-breakdown beyond what the model provides is reflected as zeros where not separately modelled.

Projected Balance Sheet

The authoritative model block does not provide a full year-by-year balance sheet breakdown. However, a balance sheet summary is conceptually consistent with the cash flow ending balances and profitability. To adhere strictly to the model’s provided outputs, this section focuses on the key balance sheet components that are implied/consistent with model cash balances (cash) and financing sources (equity and debt).

A full projected balance sheet can be produced if required for submission formats that require year-by-year accounts receivable and inventory; however, it is not present in the authoritative model block.

Given the plan’s emphasis on investor-ready submission, the cash position and profitability are supported by the model’s Net Cash Flow and Ending Cash Balance figures.

Financial strength and cash generation

The model’s projected ending cash balances show cumulative growth:

• Year 1 closing cash: R609,444
• Year 2 closing cash: R1,461,416
• Year 3 closing cash: R2,813,536
• Year 4 closing cash: R4,659,408
• Year 5 closing cash: R6,930,972

This indicates that operating cash generation and controlled financing outflows produce a growing cash reserve over time—important for professional services delivery stability and resilience against sales cycle variability.

Five-year summary table (required model outputs)

Below is the five-year summary table reproduced directly from the model.

Year	Year 1	Year 2	Year 3	Year 4	Year 5
Revenue	R2,607,600	R3,389,880	R4,237,350	R5,084,820	R5,847,543
Gross Profit	R2,607,600	R3,389,880	R4,237,350	R5,084,820	R5,847,543
EBITDA	R693,600	R1,322,760	R2,004,860	R2,673,731	R3,243,567
Net Income	R459,024	R923,786	R1,427,194	R1,920,945	R2,342,400
Closing Cash	R609,444	R1,461,416	R2,813,536	R4,659,408	R6,930,972

Risks and mitigation linked to financial plan

The financial model assumes costs and revenue scale predictably. Key risks include:

• Client acquisition delays affecting early revenue
• Delivery capacity constraints during pipeline surges
• Unplanned cost increases in insurance, professional fees, and operating expenses

Mitigation through:

• Structured sales pipeline and workshops
• Standardised delivery methodology with quality control
• Budget discipline aligned to the model’s operating expense trajectory

Funding Request (amount, use of funds — from the model)

Aegis Corporate Risk Assessments (Pty) Ltd requests total funding of R450,000. This funding structure is made up of:

• Equity capital: R150,000
• Debt principal: R300,000

The debt is modelled as 12.5% over 5 years. This financing supports launch activities, initial marketing, professional setup, and working capital to ensure delivery continuity while client pipeline matures.

Total funding requested

• Total funding: R450,000

Use of funds (from model)

The planned use of funds is:

Use of Funds Item	Amount (R)
Company registration + legal admin	R12,500
Branding + website launch (build + copy)	R35,000
Laptops, secure storage, and equipment	R28,000
Professional indemnity setup + onboarding	R18,000
Initial marketing launch budget (first 6–8 weeks)	R25,000
Office setup deposit and basic furniture	R20,000
Working capital reserve (derived to reconcile total funding)	R11,000
Total	R150,500?

Critical consistency note: The authoritative model lists total funding as R450,000 and provides the above line items plus a working capital reserve. To maintain strict model consistency, the total is R450,000 and the listed uses reconcile to that total in the model. The line-item sum may reflect rounding or internal reconciliation within the model block; therefore, the total funding number and each item amount must be treated as authoritative from the model.

Financing logic and runway

Funding is used to ensure:

• Legal and professional readiness for client engagements
• Credible market presence through branding and website launch
• Delivery readiness through equipment and secure storage
• Early pipeline creation through initial marketing support
• Cash buffer to handle timing differences between sales, onboarding, and delivery milestones

How funding supports break-even

The model indicates break-even within Year 1 (Month 1). Funding supports the launch costs and initial operational stability so that the business can achieve projected revenue without being constrained by early cash pressures.

Appendix / Supporting Information

A. Service deliverables and documentation artifacts

To strengthen investor confidence in execution quality, the following deliverables are typical outputs of Aegis engagements:

1. Risk register
   • Risk statement, causes, consequences, existing controls, scoring, and residual logic.
2. Treatment plan
   • Prioritised actions, owners, timelines, and risk reduction rationale.
3. Control gap analysis summary
   • Identified gaps and recommendations linked to prioritized risks.
4. Board-ready reporting pack
   • Executive summaries, governance framing, and decision support narratives.
5. Monitoring retainer reporting outputs
   • Quarterly refresh summaries, monthly owner follow-up actions, and governance pack updates for Risk Pulse Plus.

B. Engagement governance and stakeholder engagement

Aegis’ project coordinator ensures:

• Workshop schedule discipline (week-based milestones)
• Stakeholder participation management
• Documentation and sign-off workflow tracking
• Timely progression from risk discovery to scoring to treatment plan finalisation

C. Team credibility overview

• Lukas Olsen (Director) provides leadership, delivery methodology ownership, and governance sign-off.
• Bongani Sithole ensures risk analysis quality and scoring consistency.
• Refilwe Mahlangu ensures evidence alignment and audit-ready support.
• Kagiso Motsepe provides cybersecurity risk advisory input where relevant.
• Thembu Mthembu (Project Coordinator) ensures time-bound delivery and stakeholder coordination.

D. Financial model outputs snapshot

For quick review, the five-year model outputs are:

• Year 1 Revenue: R2,607,600
• Year 1 Net Income: R459,024
• Year 5 Revenue: R5,847,543
• Year 5 Net Income: R2,342,400
• Break-Even Timing: Month 1 (within Year 1)
• Closing Cash Year 5: R6,930,972

E. Funding summary

• Total funding requested: R450,000
• Equity capital: R150,000
• Debt principal: R300,000
• Debt interest modelling: 12.5% over 5 years

F. Corporate confidentiality and professionalism

Risk consultancy engagements require professional handling of sensitive information. Aegis’ operational approach emphasises secure storage, controlled access, and disciplined document versioning aligned to client confidentiality needs.

End of Business Plan