Regulatory Advisory

Gap Analysis and Readiness Reviews

Assessment of existing arrangements against applicable regulatory requirements and expectations, producing a prioritised view of what is working, what needs attention and what can reasonably wait, with the reasoning attached.

Entity Risk Assessments

Development, review and enhancement of business level risk assessments. The entity risk assessment is meant to drive the control environment, the customer risk methodology and resourcing decisions. Where it has become a document that is produced once and filed, it is doing none of that.

Policies and Procedures

Drafting, review and enhancement of compliance frameworks that reflect the organization’s actual activities and risk profile. A manual that restates the regulations back at you satisfies nobody. Typical coverage includes customer due diligence standards and the evidence expected at each risk tier, enhanced due diligence, ongoing monitoring and trigger events, internal escalation and suspicious activity reporting, sanctions screening and alert handling, and record keeping.

Where a workable framework already exists we would rather strengthen it than replace it. Continuity matters, and a rewrite that discards institutional knowledge usually costs more than it saves.

Governance Health Checks

Focused reviews of governance arrangements, oversight, reporting and accountability:

• Whether compliance reaches the governing body in a form it can act on, and whether decisions are minuted
• Whether accountabilities are defined, understood and matched to people with the time and standing to discharge them
• What has been delegated, and what evidence exists that it is overseen rather than assumed
• Whether management information shows the state of compliance or simply confirms that reporting happened
• Whether known issues have owners, dates and evidenced closure

Remediation Support

Practical assistance addressing audit findings, regulatory issues and identified control weaknesses. A finding that reappears at the next review is materially worse than a new one, because it establishes that the deficiency was identified, recorded and not acted on.

Most repeat findings are not caused by disagreement about the fix. They are caused by nobody owning it, no realistic timeframe, or a fix that closed the symptom and left the cause. Support runs from triage and root cause through to the remediation work itself and closure evidenced as it happens.

Regulatory Inspection Support

Preparation for regulatory inspections, support throughout the process and assistance with remediation where required.

Preparation is largely a matter of looking at the framework the way an inspector will: whether policies, risk assessments, minutes, training records, screening logs and management information are current, consistent with each other and retrievable without a scramble; whether sample files meet the organization’s own standard; and whether the people who will be interviewed can describe the process they actually follow.

During an inspection, support covers interpreting information requests, assembling what is asked for in a form that answers the question, and keeping responses consistent across workstreams.

General Regulatory Advisory

Practical advice and support when regulatory questions, changes or compliance issues arise. Not every question needs a project attached to it, and a short conversation at the right moment is often worth more than a report after the fact.

Working alongside your other advisors

Advisory work often runs alongside a law firm, an auditor, an administrator or an existing compliance team. We would rather coordinate with them directly than have a client relay messages between advisors who each hold a piece of the picture.