The twelve questions, and what a good answer looks like
Read the question, give yourself an honest answer, then look at the “good answer” and “failure mode” columns. Mark each one as pass or fail and your score totals itself at the end.
1
Who, other than your primary corp sec person, has the registered agent portal login?
Good answer
At least one other person at the firm has independent access. The credential is also stored in the firm's password manager (not in someone's email).
Failure mode
No one. The login lives in one head or one desktop.
Your answer
2
Who has CAS360 (or equivalent) admin access?
Good answer
A nominated administrator who is not the primary user, plus the primary user. Access roles documented.
Failure mode
Just the primary user. If they leave, no one can administer the system without a vendor support call.
Your answer
3
Where is the master list of every client entity's ASIC lodgement dates?
Good answer
In CAS360 or equivalent, with a written export procedure. Backed up monthly.
Failure mode
In a spreadsheet on someone's laptop. The spreadsheet has not been backed up in over a month.
Your answer
4
Who covers if the primary corp sec person is out for two consecutive weeks?
Good answer
A named second person with documented access and standing instructions for routine work. The primary person has actually taken two weeks off in the last 12 months.
Failure mode
No one. The primary person never takes two consecutive weeks off, or when they do, partners cover ad hoc.
Your answer
5
Are standing instructions for each material client documented?
Good answer
A written file per client covering quirks, share class structures, foreign person status, and any client-specific lodgement preferences.
Failure mode
The instructions are in the primary person's memory. They explain client quirks verbally when a question comes up.
Your answer
6
How often is your client entity list reconciled with the ASIC register?
Good answer
At least quarterly. A documented reconciliation that catches any entities the firm has gained or lost responsibility for.
Failure mode
Annually at best, often less. Several entities may be listed under your registered agent number that the firm no longer manages.
Your answer
7
How are change notifications captured? (new directors, new addresses, share allotments)
Good answer
A written intake process that catches changes before the 28-day deadline starts. Every change logged in the system within one business day of being notified.
Failure mode
Email forwards from partners that may or may not get actioned. No formal log.
Your answer
8
What is your late fee history over the last three years?
Good answer
Zero, or close to it. If late fees occurred, root causes are documented and the process changed.
Failure mode
A handful per year, generally absorbed quietly without root-cause analysis.
Your answer
9
Are share registers reviewed by anyone other than the corp sec person?
Good answer
Annual review by a partner or senior accountant for top clients. Any unusual movements queried before the next lodgement.
Failure mode
Reviewed only by the corp sec person. Errors might persist for years before discovery.
Your answer
10
How are director ID checks managed?
Good answer
Every new director appointment goes through a documented DIN-check workflow. Records kept on file.
Failure mode
Done case by case, sometimes missed for foreign directors where the process is more complex.
Your answer
11
Is there a written disaster recovery procedure for the corp sec function?
Good answer
A short document explaining what to do if the primary person is suddenly unavailable, with portal logins, vendor contacts, and a triage list.
Failure mode
Nothing written. Partners would call IT and the corp sec person's personal phone in panic.
Your answer
12
When did you last test continuity?
Good answer
Within the last 12 months. The primary person took two weeks off and the firm's second person handled all material work without escalation.
Failure mode
Never tested. The plan exists in theory but has never been exercised.
Your answer
What your score means
Total your passes
0 / 12
Nothing marked yet. Answer each question above to build your score.
10–12 passes
In good shape
Your continuity discipline is strong. Consider testing it more aggressively (a fortnight without the primary person) to keep the muscle warm.
6–9 passes
Real exposure
Common at firms that have not specifically invested in continuity. Pick the three highest-impact failures and address them first; don’t try to fix all of them at once.
5 or fewer
Significant gap
You have a meaningful continuity exposure. Either invest in documentation and cross-training (12+ months of focused work) or outsource. Hybrid is also fine, outsource the core function while keeping a senior internal contact.
If you fail more than half
Your options, in order of effort
- 1.Document the highest-risk three. Pick the three failures with the most consequential downside (usually #1, #3, and #11) and write something down this month. Even partial documentation halves your exposure.
- 2.Cross-train a second person. Identify a junior who could plausibly cover for the primary person within 12 months. Block out four hours a week for them to shadow specific tasks.
- 3.Outsource the function. The structural fix. Your provider's entire business model is continuity, so the redundancy is built in. We are happy to talk through how the transition would work for your firm specifically.