Governance, policy and compliance help
Need policies, controls or compliance help?
Your policies are out of date, controls are missing, or audit actions are overdue. We write the policies, help you set up and run the controls, build the risk register and work through the remediation with you.
The problem
Signs you need help getting compliant
For business owners, AI owners, technology leaders, risk teams and anyone handed a compliance requirement without a team to meet it. The work can cover a few essential policies or a whole framework.
Policies are missing or out of date
AI tools, vendors and data flows have changed since anyone last wrote a policy, or the policies a customer or auditor asks for do not exist.
Nobody is sure who is responsible
Teams read the same policy differently, approvals are informal and exceptions pile up with no owner or expiry.
Controls exist on paper only
The policy says access is reviewed quarterly and backups are tested, but nobody does it and there are no records.
Audit actions are overdue
An audit or assessment produced a list of findings months ago and the people who should close them have no time.
How we help
Put policies and controls into practice
We do the writing and the set-up with the people who will own it, so the documents match how work is actually done and your team can keep the controls running.
Policies and procedures
We write or update the policies and procedures you are missing, in plain language, matched to how your teams actually work. Each one names an owner, an approver, a review date and the records that show it is followed.
Control design and implementation support
Where a policy describes a control your team has not implemented, we help choose the process or tooling, assign an owner and put it into use. We also help retain records for a later review of whether it works.
Risk assessments and risk registers
A risk assessment that names the systems, the impact, the control and the person who accepted or treated each risk, and a register your team can keep up to date without us.
Remediation help after an audit
Audit findings and overdue actions worked through with you: what each finding actually needs, who owns it, the fix, the evidence to show it is done and a short status report for the board or the auditor.
Clear responsibilities
Who approves AI use, controls, exceptions and escalations, written down and realistic for the people named. Exceptions get an approver, an expiry date and a risk acceptance record.
System inventory
One list of the AI systems and tools in use, their purpose, owner, model, vendor, data and access, built from procurement records, sign-on logs and interviews, with the uses nobody recorded.
Staff training and awareness sessions go with this work when you need them. Company training
A typical engagement
Different teams give different answers about the systems they use.
Company names and figures are invented.
- What we did
- FirstReconcile the inventories against procurement, sign-in records and owner interviews.
- ThenDraft the acceptable-use policy and approval process, assign owners and prepare a management review copy.
- What the firm received
- An inventory, policy drafts, ownership list and open decisions for management.
- What the firm kept
- Policy approval, risk acceptance, operational responsibility and ongoing updates.
Limits
We help implement policies and controls; this work does not provide a certification or an independent audit opinion.
You end up with policies people can follow, controls with named owners and the records that show them operating, a risk register your team can keep up to date and audit actions you can show are done. Management approves and owns the result; we mark the decisions only you can make.
See an example policy register
Policy register — excerpt
v1.0
- Policy owner
- Named role, e.g. Head of Engineering
- Approval
- Approving body and approval date
- Review cycle
- Period and review triggers (new vendor, new AI use case)
- Exceptions
- Approver, expiry date, risk acceptance record
| Policy | Owner | Approved | Next review | Open exceptions |
|---|---|---|---|---|
| Acceptable use | [role] | [date] | [date] | [count] |
| Access control | [role] | [date] | [date] | [count] |
| Technology vendor risk | [role] | [date] | [date] | [count] |
Topics
Policies we commonly write or update
If the policy you need is not listed, ask; these are the common ones.
Governance policiesExamples
- Acceptable use
- Model and system governance
- Human oversight and escalation
- Responsible use and risk assessment
- Technology vendor risk
- Incident response
- Training data and data usage governance
IT and security policiesExamples
- Information security
- Access control
- Change management
- Logging and monitoring
- Vendor risk management
- Data classification and retention
- Business continuity and disaster recovery
- Secure software development
Need help getting compliant?
Tell us which policies need updating and when your team needs them. We can help with writing, implementation and staff awareness.