Advisory services
We work alongside compliance, records, and governance teams to build practices that are defensible on the day they are examined — not just on paper.
Compliance program design
We map obligations to controls, identify where a control exists in name but not in evidence, and design the artefacts — registers, schedules, and attestations — that let a team demonstrate compliance without a scramble. Engagements typically begin with a gap assessment and end with a control catalogue an internal auditor can test against.
Records and data governance
Every public-sector body carries retention obligations, freedom-of-information duties, and data-protection responsibilities that pull in different directions. We reconcile them into a single classification model and retention schedule, then write the handling controls that make the schedule real. Our data handling and retention policy shows the shape of the output.
Audit readiness
Before an external review, we run a dry examination against the same evidence an auditor would request: access logs, change records, retention proof, and exception handling. The result is a short list of fixes ranked by how likely each is to be tested — and by how bad it looks if it fails.
Reporting and disclosure
We help organizations publish quarterly and annual disclosures with a stated methodology, consistent figures, and a clear line from source data to reported number. Our Q2 2026 disclosure summary illustrates the structure we recommend.
How we engage
- Assess — a fixed-scope review of the obligations and current controls.
- Design — the schedules, registers, and policies that close the gaps.
- Embed — training and hand-over so the practice survives after we leave.