Skip to content

Operations

The tools, decision rights, and governance that keep the firm running day to day. This is the connective-tissue function — where something doesn't cleanly belong to sales, delivery, people, or finance.

Systems of record

Domain System Notes
Pipeline / CRM HubSpot Deals, contacts. Synced into ops-hub every 4 hours + webhooks on stage change.
Finance Xero Invoices, accounts. Same sync pattern.
People / payroll Employment Hero Employees, leave. Polling only — no webhook support.
Internal dashboard ops-hub Read-only aggregation of the above, plus the native project delivery module. Never a system of record itself.
Identity Google Workspace (@lumarisco.com.au) SSO into ops-hub via Supabase Auth, domain-restricted.
Security & compliance ISO 27001 ISMS documentation (Google Drive) Information Security Policy, ISMS Scope, Statement of Applicability, Operations Register. This Company OS does not restate security controls — see that documentation directly.

Decision rights

TODO: no confirmed decision-rights framework found. For a principal-led firm this size, a simple RAPID- or RACI-style split by function is usually enough — who decides, who's consulted, who's just informed. Suggested starting shape:

Decision type Decides Consulted
New engagement pricing below target margin Principal Delivery lead
ops-hub role assignment Director —
Hiring / subcontractor engagement Principal Delivery lead, Finance
Client engagement scope change Engagement lead Principal (if margin/timeline impact)

Replace once the principals confirm how decisions are actually made.

Known operational characteristics

(from the ISMS scope statement — worth knowing outside a security context too, since they shape how the whole firm should operate)

  • Remote-first, no permanent office — distributed by design, not by exception.
  • Principal-led, deliberately small — this concentrates key-person risk. Any process that depends on one person having exclusive knowledge or access is a risk to flag, not just accept.
  • AI-native delivery — the firm builds and advises on AI systems, governed by a Responsible AI Use Policy (see ISMS docs).
  • Multi-framework client obligations — engagements often carry client-mandated frameworks (APRA CPS 234, IRAP, ASD ISM, Essential Eight) on top of Lumaris's own baseline. Engagement leads own tracking both simultaneously.