Compliance

A compliance program must work in the moments when people are under pressure, information is incomplete and commercial incentives point in different directions. Documents matter, but the decision pathways behind them matter more.

Matters we support

Risk assessment

Defining the conduct, regulatory and third-party risks relevant to the organization; connecting each risk to an owner, a control and evidence that the control is operating.

Program and control design

Developing policies, approval pathways, reporting channels and escalation protocols that reflect actual roles and information flows rather than an abstract organizational chart.

Internal investigations

Establishing scope, authority, confidentiality, evidence handling, interview sequence, decision rights and reporting lines before substantive work begins.

Remediation

Translating findings into actions with accountable owners, realistic dates, closure evidence and a method for testing whether the underlying risk has changed.

A defensible response has structure

1. Triage: protect people, evidence and immediate decision integrity.
2. Scope: define the question, authority, independence and reporting line.
3. Fact development: preserve chronology and distinguish evidence from inference.
4. Decision: document the applicable standard, options and rationale.
5. Remediation: assign actions and evidence of closure.

Questions we put on the table

• What risk is the control intended to change?
• Who can approve an exception, and how is it recorded?
• Which facts are known, disputed or still being tested?
• Who receives the report and who decides the response?
• What evidence will demonstrate that remediation is complete?