Risk, Governance & Regulation
Model risk, regulatory readiness, controls and audit trails: the governance that lets a regulated firm move, written to be used by your own people and to survive an examiner.
£70–95k, fixed · quoted before we start
Four parts, and what each is for.
Regulatory readiness
EU AI Act, DORA, Consumer Duty, Solvency II, classified system by system, obligation by obligation.
Model & decision risk
A register with tiers, owners and review dates that are actually kept.
Controls & audit trails
From data to decision, reconstructable long after the people have moved on.
Policy
Mapped to the regulation clause by clause, a challenge is answered by pointing.
Work that survives an examiner.
Governance work is usually written to pass a review and then filed. Ours is written to be used: a register your risk team maintains without us, an audit trail that reconstructs a decision two years later, and a policy set mapped to the regulation clause by clause, so a challenge is answered by pointing rather than by scrambling. The measure is not whether the framework exists. It is how long the next examiner's question takes to answer.
The measure
14 days
to audit-ready, from ninety
Agreed before the work starts, measured after it, published either way.
4 steps, in this order, every time.
The inventory
Every system and decision in scope, classified, with the obligations each tier carries.
The register
Risk tiers, owners and review dates your team can maintain without us.
The trail
Data to decision, reconstructable long after the people have moved on.
The mapping
Clause by clause, so a challenge is answered by pointing rather than scrambling.
What you are holding at the end.
You leave with
A register with risk tiers your team maintains without us
An audit trail from data to decision
A policy set mapped to the regulation, clause by clause
14 days to audit-ready, from ninety
Buy this when
01An examiner asked how a decision was reached and the answer took a week to assemble.
02You are in scope for a new regulation and nobody has classified the systems yet.
03Risk is blocking a launch and cannot say precisely what would unblock it.
If none of these is true yet, the audit is the cheaper place to start.
Where it has been bought, and what it came to.
Model-risk framework for Cobalt Bank
14 days
to audit-ready, from ninety
Regulatory reporting controls at Solent Water
0
late regulatory submissions in twelve months, from seven
The full record
64cases
Every engagement we are allowed to name, each with the figure agreed at the start.
All cases“The examiner's word for the register was “unusually legible”. We framed that.”
