Controls & Operating Model Design

Policies are only useful if they change how work is done. We design the underlying operating model, people, processes, systems and evidence; so that your control environment is visible, manageable, and testable

Scope

RACI & Organisation Design

Define who is Responsible, Accountable, Consulted, and Informed for each control, with clear handoffs between first, second, and third lines.

Control Library

Build a register of preventive and detective controls, each linked to regulatory requirements, risk statements, owners, and frequency

Evidence Plan per Control

Specify exactly what artefacts prove operation (logs, samples, approvals), where they live, and how they’re retained.

Core Registers

Maintain risk, issues, breaches, vendor/outsourcing, training, and attestation registers with ownership, dates, and closure criteria.

Standard Operating Procedures

Translate policies into step-by-step procedures, forms, and checklists that staff can follow without ambiguity

KRIs/KPIs & Thresholds

Set Key Risk/Performance Indicators with triggers, tolerances, and escalation paths so exceptions are timely and measurable.

Workflow Gates in Existing Tools

Embed maker-checker, approvals, sampling, and exception capture into your current systems to avoid re-platforming

Data & MI Design

Define the data dictionary and board/management MI so control performance is visible and decision-useful