Risk Management and Consulting

A security risk assessment is a structured process of identifying the threats relevant to your organisation, analysing the vulnerabilities that could allow those threats to cause harm, and assessing the likely consequences. Barrick Group's assessments follow an eight-stage methodology: establishing context, identifying and analysing risks, evaluating and prioritising them, developing treatments, strengthening organisational resilience, and monitoring outcomes over time. The output is a documented risk register with risk ratings, evidence and prioritised treatment recommendations your organisation can act on, together with a plain-language summary suitable for board and executive review. Assessments are conducted independently of any product or service recommendation. Barrick Group aligns its methodology with ISO 31000 and, where relevant, government protective security frameworks such as the PSPF, producing findings that are defensible to regulators, insurers and boards.

A security company's commercial interest is to sell you security services, guards, monitoring, technology installations. An independent consultant's interest is to give you accurate advice. Barrick Group has no financial stake in what solutions you choose or which suppliers you engage, which means the advice you receive reflects your actual risk environment rather than what is most profitable for us to recommend. Where a related entity could plausibly deliver a recommended solution, we disclose this upfront and the decision remains entirely with you. This distinction matters most when you are making significant procurement decisions, briefing a board on a security investment, or need advice you can rely on at a regulatory or tender-response level, where a genuine absence of conflict of interest is often a stated requirement.

A Protective Security Risk Assessment is a formal risk assessment conducted in accordance with Australian Government and state government protective security frameworks, including the Protective Security Policy Framework (PSPF). PSRAs assess an organisation against the PSPF's governance, information, personnel and physical security outcomes, and are typically required for Commonwealth entities, government tenants, critical infrastructure operators, regulated facilities, and organisations that handle sensitive or classified information. Barrick Group conducts PSRAs across both Commonwealth and state frameworks, producing a documented maturity rating and treatment plan that satisfies regulatory and tender requirements. See our dedicated PSPF Risk Assessment page for a full breakdown of scope, process and timeframes.

Barrick Group's risk management work is primarily structured around ISO 31000 (Risk Management, Guidelines), the foundational standard for enterprise risk management in Australia, and the Three Lines Model for governance and assurance. Depending on the client's sector and obligations, we also work with the Protective Security Policy Framework (PSPF), the Security of Critical Infrastructure Act 2018 and its associated Rules, the NIST Cybersecurity Framework, and sector-specific standards in healthcare, construction and government. Our approach integrates risk management into existing enterprise risk architectures rather than treating it as a separate silo, and every engagement is scoped to the frameworks that genuinely apply to your organisation rather than a generic template.

Barrick Group provides risk management and advisory services across more than twenty industry sectors, including government, critical infrastructure, health and aged care, education and training, construction and property, transport and logistics, mining and resources, manufacturing, retail, financial and insurance services, utilities, and hospitality and events. Our assessments have covered engagements including protective services advice for a major light rail infrastructure build and an ongoing risk program for a hospital, among others. See our Industries We Advise page for the full list. Whether your obligations arise from formal regulatory frameworks or a board-level responsibility to manage risk, we have the sector experience to advise you. Contact us to discuss your specific context and requirements.