Service
GRC & Risk Advisory
Governance, risk and compliance that a board can read and an engineer can act on.
Governance, risk and compliance ties your security work to the decisions the business actually makes. We help you identify what matters, rate it honestly, assign ownership and track it over time, so risk stops being a spreadsheet nobody reads.
The output is a risk register and governance structure that your leadership trusts and your teams can act on, aligned to the frameworks and regulations you are held to.
What we cover
Risk identification
We catalogue the assets, threats and obligations that apply to your business so the register reflects your actual exposure rather than a generic template.
Risk rating and treatment
We apply a consistent scoring method and agree a treatment decision for each entry, whether that is mitigate, transfer, accept or avoid.
Governance and ownership
We define the roles, committees and reporting lines that decide on security matters and assign a named owner to every risk.
Policy framework
We map your policies to the obligations you are held to and flag where a policy is missing, stale or contradicted by practice.
Third-party and vendor risk
We review how suppliers are assessed and monitored so risk introduced through vendors is tracked alongside your own.
Board and leadership reporting
We set up reporting that summarises what changed and what needs a decision, so oversight is based on current evidence.
Standards we work to
What's included
- A risk assessment methodology that suits your size and sector
- A living risk register with owners, ratings and treatment plans
- Governance structures, roles and reporting lines for security decisions
- Policy frameworks mapped to your obligations
- Third-party and vendor risk review
- Board-level reporting that is clear without being alarmist
What you walk away with
- A risk register your leadership actually uses
- Clear ownership and treatment plans instead of open-ended lists
- Governance that satisfies auditors and guides real decisions
How it runs
Assess
We work through your assets, threats and obligations to build an honest view of where real risk sits.
Rate
We rate each risk with a consistent method, so comparisons across the business mean something and priorities are defensible.
Own
Every risk gets an owner and a treatment plan, so accountability is clear rather than implied.
Report
We set up reporting that tells leadership what changed and what needs a decision, without drowning them in detail.
How we approach it
There is a real difference between a risk register that lives and one that sits in a folder until an auditor asks.
| A managed programme | A spreadsheet and a template | |
|---|---|---|
| Risk rating | Scored with a consistent method so priorities are defensible | Rated on gut feel that varies by whoever filled the row |
| Ownership | Every risk has a named owner and a treatment decision | A shared list that nobody is accountable for |
| Reporting | Leadership sees what changed and what needs a decision | A static document reviewed once a year if at all |
| Framework fit | Mapped to the obligations you are actually held to | Generic entries that an auditor will question |
What this supports
A working risk and governance programme feeds the controls that these frameworks expect you to evidence.
- ISO 27001
- Supports the risk assessment and treatment process at the core of ISO 27001, along with Annex A organisational controls for policy and supplier relationships.
- NIST CSF
- Underpins the Govern and Identify functions, where risk is assessed, prioritised and tied to organisational decisions.
- SOC 2
- Provides the risk assessment and governance evidence that the SOC 2 Trust Services Criteria expect under the common criteria.
FAQ
- What is the difference between GRC and compliance?
- Compliance is meeting a specific set of requirements. GRC is the wider discipline of governing security decisions, understanding risk and tying both to the business, with compliance as one part of it.
- Do we need a formal risk methodology?
- If you are pursuing frameworks like ISO 27001 or NIST CSF, a defensible methodology is expected. Even without that, a consistent method makes your priorities credible to a board.
- Can you work with our existing register?
- Yes. We will review what you have, keep what works and improve the rating, ownership and reporting rather than start from scratch for its own sake.
Related services
Related reading
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read
SOC 2 vs ISO 27001: an honest comparison to help you choose
A plain-English guide to the real differences between SOC 2 and ISO 27001: what each one is, who asks for which, how the audits work, what you end up holding, and whether you should do both.
8 min read