01
Compliance framework design
A compliance management system that fits how you actually operate, aligned to ISO 37301: scope, roles, controls and the evidence trail, sized to your organisation rather than a large corporate template.
Compliance & risk management advisory · Updated October 2026
I help owners and managers build compliance and risk management that really does protect the business. A binder that gets through the audit and changes nothing is no use to anyone. The practice takes work in the United Kingdom, the European Union and Malta. I work to ISO 37301 and ISO 31000, and always under the law that governs you. I recommend starting with a Diagnostic. It takes two or three days, and what you pay for first is an honest picture of where you are.
Compliance and risk management is my specialism. The work spans the whole picture, from the framework on paper to the behaviour on the floor, and it is built to be run by the people already in the business.
01
A compliance management system that fits how you actually operate, aligned to ISO 37301: scope, roles, controls and the evidence trail, sized to your organisation rather than a large corporate template.
02
Risk identified, rated and owned, aligned to ISO 31000: a working risk register, a clear risk appetite, and controls tied to the risks that actually threaten the business, not a list nobody reads.
03
The duties that apply to you, made practical: data protection and GDPR, anti-money laundering, health and safety, anti-bribery, whistleblowing, and newer duties such as the EU AI Act, tied to your jurisdiction.
04
An honest read of where you stand against the standard and the law, what is missing, and what to fix first, with a prioritised plan you can act on rather than a report that sits in a drawer.
05
The step most compliance skips: making the compliant way the easy way, so policies become what people actually do. Where formal training is the answer, I design it and can point you to delivery.
06
Compliance and risk framed for the people who carry the accountability: what to worry about, what to measure, and how to show a clean, provable posture to clients, regulators and partners.
A fine. A regulator's letter. A customer who drops you because the due diligence form went back half empty. I go through what the law and your contracts ask of you and put a name against each item. Then I set a few checks that flag trouble early, while it costs little to put right.
Once the board has agreed how much risk it will take, and who decides what, managers stop sending everything upstairs. I put that on a page or two. Not a manual.
Large customers and public buyers send supplier questionnaires on data protection, anti-bribery, health and safety and more. I help you keep the evidence in one place, so answering one is quicker and far less of a scramble.
One clear method, worked at three levels at once, so the strategy, the system and the day-to-day decision all point the same way.
Strategic
The board-level view: the risks that could actually harm the business, the posture that wins trust and work, and where compliance stops being a cost and starts being an asset.
Operational
The live framework, not a dead binder: controls, owners, evidence and review, built so the organisation can run and prove it without a large function behind it.
Tactical
Where compliance is won or lost: the everyday choice made the compliant way because that is the easy way, with managers as the control rather than a policy nobody reads.
I work in plain language, from practice rather than theory, and I keep a clear line between what the standard requires and what is my judgment. Guidance is always tied to the jurisdiction that governs you, because the United Kingdom and Malta diverge on points that matter.
I do not start a compliance project from a downloaded template. I start with two or three days spent finding out where you really are. After that, every step is your call.
I offer three compliance build projects. We agree the scope in writing first, so you know exactly what you will be holding when I finish.
ISO 37301 aligned
It begins with an obligations register, which is simply a list of what the law and your contracts demand of you. Around that go a set of policies written for your business, a named owner for each duty, a monitoring plan and a reporting line up to the board or the owner. I build it for the organisation you have today, and the evidence trail is part of it from day one.
ISO 31000 aligned
First we settle how much risk you are willing to carry. Then comes one risk register and one way of scoring, used the same way in every department. Any risk over your limit gets a treatment plan. The reviews go in the diary with dates.
Regulated sectors
Some organisations have to prove their people are competent. For them I build a competence matrix for each role and a training needs analysis. I add a method for assessing and signing people off, and the records to go with it. Last comes a test of whether the training changed anything people do. I designed it for professional services firms, FCA-regulated firms, healthcare providers and construction dutyholders in Great Britain.
A framework begins to go stale the day you sign it off. Laws change and staff move on, and a control that everyone followed in March can be dropped by October without anyone noticing. I offer three maintenance arrangements. Keep, Assure and Assure Plus each run for 12 months.
| What is included | Keep | Assure | Assure Plus |
|---|---|---|---|
| Policies and frameworks updated once a year, in line with new law and standards | Yes | Yes | Yes |
| Regulatory watch bulletin for your sector and jurisdiction | Quarterly | Monthly | Monthly |
| Account review call | Annual | Quarterly | Quarterly |
| Compliance monitoring: sampling and spot checks | No | Quarterly | Quarterly |
| Refresher session for staff | No | One a year | Two a year |
| Mock audit or mock inspection | No | One a year | One a year |
| Management review facilitation | No | No | One a year |
| Renewal and certification management | No | No | Yes |
| New policy or procedure each year | No | No | One |
| Report for the board, the owner or the MLRO | No | No | Annual |
Swipe sideways to compare the three columns.
If you need someone to run the operation part-time, with compliance and quality checked inside it, that is the Fractional COO role: one to eight days a month. The Fractional COO packages page sets out what each option includes and costs.
Some jobs are too small for a project and do not need a 12-month term. You can buy any of these on its own, or add it to Keep, Assure or Assure Plus.
A named law, rule or standard has changed. I write a note on what it means for you and update the documents it touches.
I spend a day with you, on site or remotely, and work through the areas your regulator has published as its inspection focus. You get the findings in writing afterwards.
A day of audit against ISO 37301, or against your own framework if you prefer, carried out by me or by a registered lead auditor I bring in. You get a report and a list of actions.
Every quarter I write a report on the state of your compliance for the board, the owner or the MLRO. Where I built or maintain the framework, the report says so.
I put the inputs together, chair the meeting and write up the minutes. The aim is a review that ends in decisions.
Ten hours of advisory time, paid in advance and valid for 12 months. It is meant for the questions that come up between projects.
Owners, managers and department heads at small and mid-sized organisations that carry real compliance and risk without a large function behind them, across the United Kingdom, the European Union and Malta. The practice is aimed mainly at gambling, FCA-regulated finance, care and construction. In those sectors the rules ask you to show that staff are trained and competent for their work: the Gambling Commission code in Great Britain, the FCA rules across the United Kingdom, the CQC regulations in England and the construction regulations in Great Britain. My own background covers finance, iGaming, manufacturing, hospitality, retail and property. I also teach compliance management, at university and to professionals, so what I advise has to stand up in front of a room as well as on paper. Compliance sits naturally alongside my quality assurance work: the same discipline of building a system that holds up and can be shown, applied to how you comply rather than how you deliver.
Compliance Beyond Ticking the Box sets out the compliance method I use in advisory work, as a workbook you can run yourself, with a fill-in tool in every chapter and real, documented company cases. Its two companions carry the same approach into supplier spend and into training.
Compliance
Turn compliance from a cost you endure into a system that protects the business and drives its growth.
View on Amazon →
Procurement
Turn supplier spend into growth and performance, using AI where it earns its place, with no procurement team.
View on Amazon →
Learning & development
Make the courses you pay for actually change what your team does, and prove it, with no training department.
View on Amazon →Here are twenty of the models I lean on in compliance and risk work. Each one takes about a minute to read and comes with a real company case. They are taken from my book Key Compliance Models.
Business Insights
Three teams were watching the risk. All three had gone slack at the same time. That is the HSBC story in one line.
Business Insights
RBS confused capacity with appetite. Which is another way of saying it was willing to bet its own existence.
Business Insights
A firm can comply with the letter of every rule and still treat its customers badly. Conduct regulation exists to close that gap.
Where the rest of the picture lives, and the record behind the advice.
The sibling practice: quality management systems aligned to ISO 9001, internal audit and certification readiness.
Selected engagements, anonymised case studies, and advisory board and non-executive work.
Qualifications, the teaching warrant, and the standards the practice is aligned to.
The full record of education, lecturing and published work behind the advisory.
Who I am, how I work, and why compliance and quality sit at the centre of it.
Tell me your organisation and the pressure you are under, and I will come back on fit and scope.
Why me
I am a doctoral candidate in business administration, hold a master's from the College of Europe and a Malta teaching warrant, and I have lectured in compliance management, governance, GDPR, AML and internal audit since 2013 alongside running businesses in education, property and supply chain. I write on the subject as well: Compliance Beyond Ticking the Box sets out the method in full. The full record of education, publications and lecturing is on my CV page, and selected engagements, anonymised case studies and my advisory board and non-executive positioning are set out in my consultancy and boards portfolio.
A note on scope: this is advisory work tailored to your organisation and its jurisdiction. It is not legal advice, and it does not replace your regulator's own guidance or, where you need it, a qualified lawyer. For compliance and governance training as a product, see Auren Institute.
It is practical advisory work that helps an organisation build compliance and risk management that protects the business and holds up under scrutiny, rather than a binder of policies that passes the audit and changes nothing. It covers the framework, the risk assessment, the regulatory duties that apply, and the way all of it turns into behaviour on the floor.
Yes. The practice is set up for owners, managers and department heads who carry compliance and risk without a large function behind them. The method is built to be run by the people already in the business, not to depend on a department they do not have.
Compliance management systems are aligned to ISO 37301 and risk management to ISO 31000, with anti-bribery work referencing ISO 37001. Regulatory areas commonly include data protection and GDPR, anti-money laundering, health and safety, whistleblowing, and newer duties such as the EU AI Act, applied to the jurisdiction that governs you.
Yes. The practice is run from Malta and takes work in the United Kingdom, across the European Union and in Malta itself. Guidance is always tied to the jurisdiction that applies to you, because the UK and Malta diverge on important points.
A review with a fixed scope. It takes me two or three days. I go through your documents and talk to two or three of your people. Then I score the gaps against the standard, or against what your regulator expects. You come away with a short findings report and a 90-day plan. If you sign a Build project within 60 days of the findings call, I credit the Diagnostic fee in full against the project fee.
I write to you within 30 days of sign-off with a proposal. You can choose from three arrangements, and each one lasts 12 months. With Keep, I update your policies and frameworks once a year for changes in the law and the standard, and I send you a regulatory watch bulletin each quarter. Assure adds monitoring every quarter, a refresher session for staff and a mock audit. Assure Plus adds renewal management, a management review and one new policy a year. You are free to say no to all three.
I lead every engagement, and my team does the work with me. Each member of my team holds at least a degree and has experience in or close to quality, curriculum development or accreditation. I check both before anyone works on a client engagement, I review the work before it reaches you, and you will know who is working on yours before it starts.
Use the contact page to outline your organisation, the pressure you are under and roughly what you need. You will get a straight answer on fit, scope and how the work would run, usually within a couple of working days.