What it is
A structured review of your governance, risk, and compliance documentation. GRC means how well-run, how risk-aware, and how accountable an organisation is. Each document is assessed against seven criteria.
Why it matters
Undiscovered gaps
Policies drafted years ago may no longer reflect how the organisation operates, or what regulators expect.
Incoherent document sets
Frameworks, policies, and procedures that do not join up create accountability gaps and delivery risk.
Unclear ownership
Documents without named owners, review cycles, or version control are governance liabilities.
How it works
- 1
Scope and agree
The documents are named and agreed in the engagement letter. No surprises mid-engagement.
- 2
Structured review
Each document is assessed against seven defined quality criteria.
- 3
Gap analysis
Findings are consolidated into a gap and recommendations register, in priority order.
- 4
Output and debrief
You receive a clear verdict. A facilitated debrief is available if you want it.
What you receive
- An overall red, amber, or green verdict for each document, and for the set
- A gap and recommendations register: immediate, short-term, and longer-term
- A one-page executive summary, written for a board
What changes
You know where the documentation stands: what is fit for purpose, what needs work, and what to do first. Gaps become visible before they are found at the wrong moment.
What a finding looks like
An illustrative example, written to show the form of the work. It is not a client record.
- Document
- Data protection policy
- Verdict
- Amber
- Finding
- The policy names a purpose. It does not name an owner, and the review date has passed.
- Priority
- Short-term
Fees
I do not publish a flat fee for this review. I scope it and price it before any work begins.