How I Think About Governance, Risk & Assurance

A short articulation of how I approach complex governance and assurance challenges — shaped by two decades of delivery, audits, and executive conversations.

1. Governance is a decision system, not documentation

Policies, frameworks, and standards matter only to the extent that they enable clear decisions, accountability, and escalation. If a control cannot be explained in business terms, it is governance theatre.

2. Risk is contextual, not abstract

Risk does not exist in isolation. It exists in products, customers, jurisdictions, delivery models, and third-party dependencies. Effective risk management aligns risk conversations with how the business actually operates.

3. Assurance should reduce anxiety, not create it

ISO, SOC 2, CMMI, and similar frameworks are assurance mechanisms — not goals. The objective is to reduce uncertainty for leadership and stakeholders, not to create parallel compliance machinery.

4. One operating model beats many frameworks

Mature organisations do not run separate silos for quality, security, privacy, continuity, and delivery maturity. They design a single governance operating model that multiple standards can map into.

5. Maturity is demonstrated in calm moments

Real maturity is visible when incidents occur, audits begin, or scrutiny increases — and the organisation responds calmly, predictably, and transparently.

This page reflects how I approach advisory, assessment, and interim leadership roles — not a prescriptive methodology.