Global · Case study

Port of Tauranga, Board-Led Risk Governance

Tauranga, New Zealand2024 to present

Port of Tauranga is New Zealand's international hub port. It handles 39% of all shipping containers moving in and out of the country (Port of Tauranga Limited, 2025a). It is listed on the NZ Stock Exchange, and the investment arm of the Bay of Plenty Regional Council holds 54.14% of its shares (Port of Tauranga Limited, 2025a). The port's disclosed key risks include health, safety and wellbeing, cyber security, ship collision or grounding, key infrastructure resilience, and climate change impacts or a natural disaster (Port of Tauranga Limited, 2025a).

Approach

The Board owns the principal risks. The Board Charter makes the Board responsible for identifying principal risks and making sure controls and monitoring are in place (Port of Tauranga Limited, 2025c). The Board reviews all risks once a year and holds quarterly "deep dives" into specific risks (Port of Tauranga Limited, 2025b).

Risk appetite set by the Board, with quarterly escalation. After a framework review in FY2024, the port created a Risk Specialist role. This person prepares quarterly enterprise risk reports for senior management and the Board. The reports cover risks outside the risk appetite set by the Board, escalating or emerging risks, and top strategic risks (Port of Tauranga Limited, 2025b).

Committees with written charters. The Audit Committee is made up only of non-executive directors, most of them independent, with at least three members. It checks that management has a framework to manage key financial risks and can recommend other assurance reviews to the Board (Port of Tauranga Limited, 2025d). A separate Board Health and Safety Committee runs periodic deep dives into critical risks and their controls and seeks external assurance reporting (Port of Tauranga Limited, 2024).

One register and one method. The framework is aligned to AS/NZS ISO 31000. Risks are recorded in a risk register and rated for likelihood and impact before and after mitigation (Port of Tauranga Limited, 2025b).

Climate risk in the same structure. The Board has overall responsibility for the port's climate change response. The Audit Committee reviews all climate risk and opportunity work and approves publication of the Climate-related Disclosures (Port of Tauranga Limited, 2025b).

Results

The port publishes its key risks in its annual report, with consequences, mitigation strategies and key controls set out in its Corporate Governance Statement (Port of Tauranga Limited, 2025a). In October 2024 it published its first report under the Climate-related Disclosures regime (Port of Tauranga Limited, 2025a). Its FY2025 climate report is prepared under the Aotearoa New Zealand Climate Standards (Port of Tauranga Limited, 2025b). In FY2025, every member of the senior management team had a climate-related KPI worth 5% of their short-term incentive (Port of Tauranga Limited, 2025b).

Transferability

A port board can hold clear accountability for risk without a stand-alone risk committee if roles are written down. DMC port boards can start with three low-cost steps: approve a short risk appetite statement, name one officer to send the board a quarterly report on risks outside appetite and hold one full board risk review each year. Audit and safety committees can work from short charters that set out membership, independence and the risks they oversee. One risk register, aligned to ISO 31000, lets climate, safety and financial risks be rated on the same scale. Climate disclosure and pay links can follow once the basic reporting cycle is running.

Sources

All information used for this case study was based on publicly available resources.