A 20-person contractor needs enough governance to prove, on any given day, who owns which risk and that the work is happening the way it is supposed to - not a governance framework built for a business five times its size. In practice that means a handful of documented core processes, one person clearly accountable for each, and a light internal-audit and management-review rhythm run a few times a year, not monthly. Scaled correctly, this typically sits at the lower end of Hillview's published services band ($1,500-$9,500), not a retainer. The mistake most 20-person contractors make is not under-governing - it is buying or building a system sized for a business three times their size, then drowning their own crews in paperwork nobody at 20 people has the hours to sustain.
What actually determines how much governance a business needs?
Headcount is a useful proxy, but it is not the real driver. Four things determine how much governance is proportionate:
- Number of concurrent projects and crews. One site and one crew needs far less coordination than five crews running in parallel.
- Degree of subcontracting. Every subcontractor you engage is a control you need evidence for, regardless of your own headcount.
- Tender and client scrutiny. Principal contractors and government clients increasingly ask for evidence, not just a certificate, and that evidence has to exist somewhere.
- Regulatory exposure. High-consequence work (excavation, confined space, plant, hazardous chemicals) carries governance obligations that do not shrink just because the business is small.
A 20-person business running one low-risk site needs less than a 20-person business running four high-risk sites with a dozen subcontractors. Headcount gets you in the right neighbourhood; these four factors tell you exactly how much house you need.
What's proportionate at 20 staff, 100 staff and 250 staff?
| Stage | What it typically looks like | Core governance elements | Typical investment |
|---|---|---|---|
| ~20 staff | 1-3 concurrent projects, one or two crews, founder or ops manager still close to every job | Lean documented framework, one accountable owner, light internal audit, review folded into existing ops meetings | $1,500-$9,500 (services, one-off or annual) |
| ~100 staff | Multiple sites and crews running in parallel, layered supervision, real subcontractor exposure | Structured framework, a real internal assurance program, formal record-keeping, retainer support begins | $4,000-$15,000 per month (retainer) |
| ~250 staff | Multi-site, multi-division, leadership several layers removed from the work, board or executive scrutiny | Harmonised multi-site framework, executive assurance reporting, embedded governance partnership, dedicated internal capability | $12,000-$20,000 per month (retainer) |
These are market ranges from Hillview's published pricing, not a quote. Where a business actually sits inside its stage depends on the four factors above, not headcount alone.
What does governance actually look like day to day at 20 staff?
Concretely, not abstractly: one set of core documents covering safety, quality and (if relevant) environmental obligations, built from a professionally authored system and tailored to how the business actually runs rather than written from scratch. One named owner - usually the operations manager or a senior supervisor, not a full-time hire - who is genuinely accountable, with the mandate and the hours to run it. A sampled internal audit a few times a year rather than a sprawling annual program. Management review folded into an existing operations meeting instead of a separate calendar event nobody attends with intent.
None of this needs a retainer. It needs a system sized to be run by people who already have a full-time job doing something else.
What changes at 100 staff?
At 100 staff, the business is usually running several sites or crews in parallel, with layered supervision between the owner and the work, and real subcontractor exposure. A single accountable person can no longer credibly verify the system is working across every site from memory. This is where a structured internal assurance program earns its keep - a genuine sampling schedule across sites, not a single annual walk-through - and where formal record-keeping stops being optional. Retainer-level support typically enters here, in the $4,000-$15,000 per month range depending on site count and risk profile, because the governance function now needs a rhythm someone maintains between visits, not just a document set someone wrote once.
What changes at 250 staff?
At 250 staff, leadership is usually several layers removed from the work itself, and the business is answering to boards, principal contractors or government clients who want evidence at an executive level, not just a site level. Governance at this scale means a harmonised framework that works the same way across every site and division, executive assurance reporting that gives leadership a genuine read on where risk sits, and typically an embedded governance partnership - external capability operating like an internal function, in the $12,000-$20,000 per month range - because building and retaining that capability in-house is expensive and slow, and the risk of getting it wrong at this scale is high.
What's the sign you've under-invested in governance for your size?
- The same nonconformities and incidents recur project after project, because corrective actions close the paperwork without closing the cause.
- Every audit or client review triggers a scramble, because evidence does not exist as a by-product of normal work.
- The whole system lives in one person's head, and if that person left tomorrow, nobody could say what would actually change day to day.
- Tenders are lost, or won and then queried, because the systems story cannot be evidenced when a client actually asks.
Any one of these at your size is a governance gap, not a bad-luck run. They are the signs the business has outgrown what it is currently spending on control.
What's the sign you're over-engineering it at 20 staff?
- Crews route around forms and processes that take longer to complete than the task they document.
- Documented processes exist that nobody below management could describe in their own words.
- Meetings and reporting about the system consume more hours than the system prevents in rework.
- Spend is climbing toward retainer-tier numbers for a business that has not grown into that tier's complexity.
Over-engineering at 20 staff usually comes from buying a system built for someone else's business - a template pitched at a 100-person operation, or a consultant scope that never got resized once the tailoring started.
So how do you actually check where you sit?
The honest answer is proportion, not ambition: match the governance to the risk, the site count and the scrutiny the business genuinely faces today, not the business it hopes to be in three years. Buying ahead of that curve wastes money crews will route around. Falling behind it shows up as repeat findings and tender losses. Most 20-person contractors sit closer to under-governed than over-engineered - a paper certificate with none of the underlying control - but the fix in either direction starts the same way: an honest, independent read on where the system actually sits today.
Not sure where your own governance actually sits? The Audit Readiness Check is free and takes a few minutes - an honest indication of whether your current governance is proportionate for where the business actually is.
FAQ
Does a 20-person contractor need a dedicated quality or HSE manager? Not usually as a full-time hire. At 20 staff, governance ownership typically sits with an existing operations or project manager who has a documented mandate and enough time carved out to run it, supported by a purchased or lightly customised system rather than a from-scratch build. A dedicated internal role tends to make sense once headcount and site count grow enough that the accountable person can no longer hold both jobs credibly.
Can governance actually cost too little? Yes. Under-spending shows up as the same nonconformities returning audit after audit, a scramble every time a client or certifier asks for evidence, and a single person holding the whole system in their head. The cost of under-governing rarely shows on an invoice - it shows in lost tenders and repeat findings instead.
When should a 20-person business move from a document system to a retainer? Generally once the business is running enough concurrent projects, sites or subcontractors that no single internal owner can credibly verify the system is working, or once client and tender scrutiny outpaces what an internally-run system can evidence. That transition commonly lands somewhere between 50 and 100 staff, though multi-site or high-risk operations can hit it earlier.
Is ISO certification necessary at 20 staff? Only if a client, tender or regulator requires it, or the business genuinely wants the external verification. Certification is a separate decision from governance itself - plenty of well-governed 20-person contractors run a proportionate, uncertified system until a tender specifically asks for the certificate.
How do I know if my governance spend is proportionate for my size? Compare what the system actually does against what it costs. A proportionate system produces evidence as a by-product of normal work, gets used by the people it covers, and costs roughly what the bands in this article suggest for your stage. If spend is climbing toward the next tier's numbers while the business hasn't grown into that tier, it is over-built for where you are.
Jemma Kennedy - Lead Auditor, 15+ years in civil, mining and infrastructure.
Founder, Hillview Business Services. 15+ years inside civil construction, mining and infrastructure businesses.