Services · Risk & GRC Advisory

A risk register the board can actually use.

Risk assessments, governance frameworks, and compliance programmes.

What this covers

Risk assessment: Enterprise and IT risk captured in a register that carries a named owner and a real date against every entry.
Control evaluation: Whether the control claimed to treat a risk demonstrably reduces it, or merely appears in the register beside it.
Stakeholder management: Risk owners who know that they own it, agreed at a level that can actually fund the remediation.
Policies and procedures: Written to be followed by the people doing the work, rather than produced for the week of an audit.
Reporting and dashboards: Board-level reporting that says what changed, what is overdue, and what the firm decided to accept.
Strategy and improvement: Framework alignment to ISO 27001, NIST CSF and COBIT, revisited on a cadence instead of at renewal.

How the work runs

Risk & GRC Advisory, end to end.

A register nobody acts on is a filing exercise. This sequence produces one the board uses, and keeps using.

Set the appetite
What the board is actually willing to carry, stated as a level rather than as an adjective. Without it, every risk is important and therefore none of them is.
OutputRisk appetite statement and taxonomy
Identify
Workshops with the people who own the processes, not a template. Interdependencies are captured here — the risks that only matter because of what they are attached to.
OutputRisk universe
Assess
Likelihood and impact scored on a defined scale, with the reasoning recorded so the score can be argued with. Control effectiveness is assessed separately from risk, because a strong control on a weak process is not a low risk.
OutputScored register with rationale
Treat
Accept, mitigate, transfer or avoid — each with a named owner, a date and a defined control. Anything above appetite gets a plan; anything accepted gets a signature.
OutputTreatment plans with owners
Report and keep it live
A board view that shows movement, not just position — what changed since last quarter and what is now above the line. Reviewed on a cadence so the register stays true.
OutputBoard dashboard and review calendar