-
Compliance and audit reviews
From mandates, best practice procedures or accreditations, to simply gaining peace of mind, our technical and industry experts have you covered.
-
External audit
Strengthen business and stakeholder confidence with professionally verified results and insights.
-
Financial reporting advisory
Deep expertise to help you navigate New Zealand’s constantly evolving regulatory environment.
-
Corporate tax
Identify tax issues, risks and opportunities in your organisation, and implement strategies to improve your bottom line.
-
Indirect tax
Stay on top of the indirect taxes that can impact your business at any given time.
-
Individual tax
Preparing today to help you invest in tomorrow.
-
Private business tax structuring
Find the best tax structure for your business.
-
Tax disputes
In a dispute with Inland Revenue or facing an audit? Don’t go it alone.
-
Research & development
R&D tax incentives are often underused and misunderstood – is your business maximising opportunities for making claims?
-
Management reporting
You’re doing well, but could you be doing even better? Discover the power of management reporting.
-
Financial reporting advisory
Deep expertise to help you navigate New Zealand’s constantly evolving regulatory environment.
-
Succession planning
When it comes to a business strategy that’s as important as succession planning, you can’t afford to leave things to chance.
-
Trust management
Fresh perspectives, practical solutions and flexible support for trusts and estate planning.
-
Forecasting and budgeting
Prepare for every likely situation with robust budgeting and forecasting models.
-
Outsourced accounting services
An extension of your team when you need us, so you can focus your time, energy and passion on your business.
-
Setting up in New Zealand
Looking to set up a business in New Zealand? You’ve come to the right place.
-
Policy reviews & development
Turn your risks into strengths with tailored policies that protect, guide and empower your business.
-
Performance improvement
Every business has untapped potential. Unlock yours.
-
Programme & project management
Successfully execute mission-critical changes to your organisation.
-
Strategy
Make a choice about your vision and purpose, where you will play and how you will win – now and into the future.
-
Risk
Manage risks with confidence to support your strategy.
-
Cloud services
Leverage the cloud to keep your data safe, operate more efficiently, reduce costs and create a better experience for your employees and clients.
-
Data analytics
Use your data to make better business decisions.
-
IT assurance
Are your IT systems reliable, safe and compliant?
-
Cyber resilience
As the benefits technology can deliver to your business increases, so too do the opportunities for cybercriminals.
-
Virtual asset advisory
Helping you navigate the world of virtual currencies and decentralised financial systems.
-
Virtual CSO
Security leadership and expertise when you need it.
-
Debt advisory
Raise, refinance, restructure or manage debt to achieve the optimal funding structure for your organisation.
-
Financial modelling
Understand the impact of your decisions before you make them.
-
Raising finance
Access the best source of funding for your business with a sound business strategy and rigorous planning.
-
Business valuations
Valuable decisions require valued insights.
-
Complex and international services
Navigate the complexities of multi-jurisdictional insolvencies.
-
Corporate insolvency
Achieve fair and orderly outcomes if your business – or part of it - is facing insolvency.
-
Independent business review
Is your business viable today? Will it be viable tomorrow? Give your business a health check to find out.
-
Litigation support
Straight forward advice from trusted advisors to support litigation and arbitration matters, expert determinations and other specialist hearings.
-
Business valuations
Valuable decisions require valued insights.
-
Forensic accounting & dispute advisory
Understand the true values, numbers and dollars at stake, as well as your obligations and rights to ensure value is preserved and complexities are managed.
-
Expert witness
Our expert witnesses analyse, interpret, summarise and present complex financial and business-related issues which are understandable and properly supported.
-
Investigation services
A fast and customised response when misconduct occurs in your business.

What is multifactor authentication?
Multifactor authentication means accessing a particular app or system requires more than one method of identification. Without MFA, you log on via one device, with a single set of credentials. MFA requires more from users based on three factors:
- Something you have, like a smartphone or a secure USB key
- Something you are, like a fingerprint or facial recognition.
- Something you know, like a password or PIN.
For example, to log into Xero online, you enter your email and password. With MFA, you then need to confirm your identity another way – such as on your phone via the Xero app. If MFA is enabled for Microsoft Outlook and you log on using a device that isn’t trusted, you will also need to enter a security code that has been sent to a trusted email account or phone number.
Whether it’s a text code, a fingerprint or a phone confirmation, MFA ensures more than one ID method is required to get into your important data. Most platforms and applications give you the option to switch it on through your security settings.
It seems inconvenient – why would you bother?
Single-factor authentication can make it much easier for a cybercriminal to compromise your bank accounts, accounting software, or business systems from anywhere in the world. All they need is your email address and password, which might have been stolen or leaked, or gained through phishing.
With two-factor authentication, it becomes exponentially more difficult for malicious users to get access to your systems. According to Microsoft, there are more than 300 million fraudulent sign-in attempts on its cloud services daily: “All it takes is one compromised credential or one legacy application to cause a data breach.” It estimates that MFA can block more than 99.9% of account compromise attacks. If that seems too high, perhaps it is, but MFA is still highly effective; Google says its implementation of MFA halved the number of account compromises.
When you have MFA enabled, it’s less concerning if your password is leaked or compromised. That alone won’t be enough to allow a hacker to gain access.
Without MFA, you’re probably in breach of the Privacy Act
The Office of the Privacy Commissioner recommends all organisations, regardless of their size to introduce MFA. When a breach occurs, one question often asked is whether an organisation has taken reasonable steps to protect the data they hold. If it is deemed the organisation did not take reasonable steps to protect its data, this could result in a breach of the Privacy Act. What’s reasonable depends on the size of the organisation breached and the scale and sensitivity of data it holds. No matter how small your business or charity might be, it almost certainly holds some personal information. It might be as basic as a list of members’ names, phone numbers and email addresses. Or perhaps it’s a more complex customer management system that includes payment details, health information or biometric data. As such, implementing the MFA is no brainer.
Under the Privacy Act, every organisation or individual that holds data must collect it appropriately, keep it safe and allow the people it concerns to be able to access it (for more details, read the Privacy Principles).
The Office of the Privacy Commissioner describes two-factor authentication as a bare minimum for small businesses or organisations that hold digital information. Without MFA in place, if someone unauthorised accesses your business data, you are likely to be in breach of the Privacy Act. This could lead to a penalty under the Act starting from $10,000; the most ever awarded is just over $168,000.
The risks of a data breach go far beyond penalties, though. Your organisation may also experience potentially huge financial losses, reputational damage, and be forced to shut down. We know of one instance where a small online business experienced a data breach, and the cost of remediation and compliance was so high that dissolving the business was the best outcome. Cyber incursions are such a significant risk it’s hard to overstate their potential impact – yet many organisations are unaware of their responsibilities and risks.
It’s all part of everyday risk management
Cyber security can feel like a particularly thorny specialist topic that sits outside business as usual. But there’s a better way to think about it – cyber security is simply another risk management activity.
It’s not separate or unique or different to other risks in your business, so managing it should equally be an everyday task. This means switching on MFA and getting everybody using it automatically, as well as keeping up to date with software patches and managing passwords effectively. Simple steps like these go a long way to protecting your organisation from breaches.
In some cases, you might need to switch platforms to be able to access MFA for your organisation. We also occasionally see small regional organisations in areas that are digitally excluded, which can make this tricky. There may be workarounds available, or alternative platforms that can help.
Create awareness and provide training
We know that it can feel inconvenient to add MFA to apps you use frequently. If those who use your systems don’t understand the importance of using MFA, they may find this extra effort irritating, or try to switch it off.
It’s essential to have all users on board. Education is the key – you need to explain to everyone why MFA is vital and why it is well worth the additional effort. You need to create awareness and provide training. According to research by Verizon, 82% of all cyber attacks “involved a human element”, and phishing scams still dominate social engineering attacks.
We know that many small and medium enterprises and Not for Profits, don’t have in house IT and cyber expertise, however, being small or local doesn’t exempt you from the Privacy Act, so you still need to make the effort to not only enable MFA, but to understand your obligations under the Act, establish cyber security policies, and incorporate MFA into your overall approach to risk management.