Every control has one named owner
Shared ownership is no ownership. If a control cannot be assigned to a single named role, the control is wrong.
01Method
Our engagements are structured so that the deliverable is an operating system, not a document. The test we apply at handover is simple: can the client run the next cycle without us in the room?
Organizations rarely fail governance because nobody wrote a policy. They fail because the policy has no owner, the evidence lives in someone's inbox, and the review that was supposed to happen quarterly happened once. Our method attacks that gap directly.
We inventory obligations, map existing controls to them, and interview the people who actually perform the work. Output: a gap register with severity, owner and effort estimates. No recommendations yet — facts first.
We design the target structure: register schema, control taxonomy, documentation standard, approval routing and the reporting model. This is signed off before a single template is written.
Documentation gets written, templates issued, workflows configured, owners named and trained. Each control is tested against real historical cases, not hypotheticals.
Your teams operate the new system for a full cycle while we observe. Every friction point is logged and fixed in place rather than deferred to a phase two.
You receive the operating manual, the evidence library and a fixed-date review schedule. Optional quarterly assurance keeps the system honest as the organization changes.
02Principles
Shared ownership is no ownership. If a control cannot be assigned to a single named role, the control is wrong.
The artefact that proves a control ran is specified at design time, with a location and a retention rule.
Consultants draft the standard; the people who perform the process write the procedure. Otherwise nobody follows it.
A modest review that happens every month outperforms an exhaustive one that happens once.
We remove redundant controls before automating anything. Systematising waste just makes waste permanent.
If your team cannot run a full cycle unaided, the engagement is not finished, regardless of the calendar.
03People
We are a small practice, so there is no engagement manager between you and the person doing the work. These are the three people who sign off what leaves the office.
Practice Lead — Governance Architecture. Sets the register schema and control taxonomy on every engagement, and runs the final handover test. Fourteen years across internal audit and GRC implementation before founding the practice.
Assurance Lead. Owns the working-paper standard and reviews every assurance cycle before it reaches a client audit committee. Chartered Accountant, previously in internal audit for manufacturing and logistics groups.
Documentation Standard Owner. Maintains the in-house documentation standard and is the named reviewer for associates in their first three months. Background in regulatory reporting and company secretarial work.