My Approach

Executive summary

Governance, Risk and Compliance (GRC) initiatives often begin with a legitimate business or regulatory need. Yet translating that need into a working technology solution can be surprisingly difficult. Regulatory requirements may be open to interpretation, business needs may be insufficiently defined, and Compliance, IT, Enterprise Architecture and technology vendors may approach the problem from different perspectives.

The result can be prolonged discussions, unclear requirements, unresolved design decisions, costly rework and implementations that satisfy technical specifications without adequately addressing the underlying business problem.

My approach to GRC IT consulting is designed to bridge this gap.

With over 30 years of IT experience, including 20 years in financial services across banking, insurance and commodity trading, I combine project management, IT business analysis, solution architecture and hands-on technical expertise to turn complex business and regulatory requirements into practical technology solutions. This enables me to work across the different stages of a GRC initiative: understanding regulatory and business requirements, evaluating implementation options, aligning stakeholders, shaping the solution and helping drive delivery.

I work directly with clients to clarify complex problems, make requirements actionable and establish a practical path towards implementation. Depending on the situation, this may mean stabilising a struggling project, structuring a new initiative, resolving a regulatory interpretation challenge or assessing emerging risks such as AI governance.

The objective is straightforward: turn complex GRC requirements into workable solutions, with clear decisions, accountable stakeholders and tangible outcomes.

1. The challenge: connecting compliance requirements with technology delivery

GRC technology initiatives rarely fail because an organisation has no requirements or lacks technical expertise. More often, the difficulty lies in connecting the two.

Compliance teams may understand the regulatory obligation but need support translating it into operational controls and system requirements. Business stakeholders may know where existing processes create friction but lack a clear view of the implications for architecture and implementation. IT teams and vendors may be able to build a solution, yet require clearer decisions about scope, data, workflows, controls and acceptance criteria.

These challenges are interconnected.

An ambiguous requirement can lead to competing interpretations. Competing interpretations can delay architecture decisions. Delayed decisions can affect delivery plans, budgets and stakeholder confidence. If the underlying issue is not resolved early, it may reappear later as rework, control weaknesses or operational disruption.

Effective GRC consulting must therefore do more than document requirements or monitor project milestones. It must connect the regulatory context, business process, target solution and implementation approach.

This requires someone who can move comfortably between business and technical discussions, understand the implications of different options and help stakeholders reach decisions that can be implemented and evidenced.

2. My approach: combine business understanding, technical depth and delivery experience

My consulting approach is based on three complementary capabilities.

Business and regulatory understanding

I work with business, Risk, Compliance, Legal and other relevant stakeholders to understand the underlying problem, clarify applicable requirements and distinguish mandatory obligations from assumptions, preferences or implementation choices. The objective is to establish what the organisation needs to achieve and what evidence will demonstrate that the solution meets those needs.

Solution design and technical understanding

I translate agreed requirements into practical solution options, considering business processes, system capabilities, data, architecture, controls and dependencies. I help stakeholders understand the trade-offs between alternatives and work with technical teams and vendors to ensure that the proposed design addresses the original problem.

Project delivery and stakeholder alignment

I help establish clear scope, responsibilities, decisions, dependencies and acceptance criteria. Where delivery is already underway, I identify obstacles and unresolved issues that prevent progress. Where a new initiative is being established, I help create a structured delivery blueprint that connects the intended outcome with the work required to achieve it.

These capabilities reinforce one another. Project management without sufficient understanding of the solution can struggle to resolve substantive design issues. Business analysis without technical awareness can produce requirements that are difficult to implement. Architecture without a clear understanding of the regulatory and business context can create technically sound solutions that do not fully meet the organisation's needs.

My role is to connect these disciplines and help turn analysis into implementation.

3. How I support GRC initiatives

My involvement is tailored to the client's situation rather than limited to a single role or project phase.

Clarifying requirements and resolving ambiguity

I help stakeholders interpret requirements, identify gaps and assumptions, explore implementation alternatives and agree on a practical target state. This is particularly valuable when regulatory language must be translated into operational rules, data requirements, system behaviour or controls.

Shaping solution architecture and implementation

I work across business and technology teams to evaluate solution options, clarify dependencies and translate agreed requirements into implementable specifications. Where vendors are involved, I help ensure that the proposed solution addresses the actual business and compliance needs rather than simply conforming to a predefined product design.

Stabilising struggling projects

When an initiative is delayed or lacks direction, I assess the state of delivery, identify the underlying obstacles and establish priorities for recovery. This includes reviewing requirements and solution design, surfacing unresolved decisions, clarifying accountability and aligning stakeholders on the steps required to regain control.

Establishing new initiatives

For new implementations, I help define scope, objectives, governance, requirements, delivery responsibilities and acceptance criteria. The aim is to create a sufficiently clear and actionable foundation before significant implementation effort is committed.

Assessing GRC and AI governance challenges

I also help organisations assess emerging governance and technology risks. This includes examining accountability, risk classification, controls, data dependencies and implementation readiness, and translating identified gaps into prioritised actions. My ongoing research into AI governance, technology risk and digital transformation informs this work, connecting practical delivery experience with developments in governance practice.

4. A practical delivery method

Although each engagement is different, I generally follow a structured approach.

Step 1: Understand the problem

I review the available documentation, current processes, project status, requirements, architecture and known risks. I engage the relevant stakeholders to understand their perspectives, constraints and expectations.

Step 2: Establish the facts and identify gaps

I distinguish confirmed requirements from assumptions, identify inconsistencies and surface unresolved questions. I examine where the current process, design or delivery approach falls short of the intended outcome.

Step 3: Develop and evaluate options

I work with the relevant experts to develop feasible alternatives and assess their business, regulatory, operational and technical implications. The goal is not to impose a predetermined solution, but to make the available choices and trade-offs clear.

Step 4: Align stakeholders and agree decisions

I facilitate discussions to establish a shared understanding of the problem, the preferred approach, the decisions required and the responsibilities for moving forward. Where decisions require formal regulatory, legal or risk approval, the appropriate accountable owners remain responsible for them.

Step 5: Translate decisions into delivery

I help convert the agreed approach into actionable requirements, design decisions, delivery priorities, acceptance criteria and implementation tasks. Where appropriate, I continue supporting the team through implementation and validation.

This approach is intended to produce tangible progress at each stage. It also makes the consulting engagement easier to evaluate: the client can see what has been clarified, which decisions have been made and what remains to be done.

5. Illustrative example: translating an ambiguous regulatory requirement

On a banking transformation mandate, I was responsible for helping translate an ambiguously defined data-protection requirement into an implementable approach.

Compliance, IT and Enterprise Architecture had different perspectives on how the requirement should be addressed. The challenge was not simply to interpret the requirement in isolation, but to establish a common understanding and evaluate the practical consequences of alternative implementations.

I brought the relevant experts together, developed alternative approaches and documented the advantages, disadvantages and implications of each. I then prepared two versions of the decision material: a detailed paper for technical stakeholders and an executive presentation for senior management.

This helped move the discussion away from competing interpretations towards a structured decision.

The example illustrates how I work: clarify the underlying obligation, involve the right experts, make implementation trade-offs explicit and communicate the options in a way that supports decision-making at both technical and executive levels.

My contribution is not to replace the expertise of Compliance, Legal or Enterprise Architecture. It is to connect that expertise, facilitate an informed decision and help ensure that the agreed approach can be implemented.

6. Turning a difficult situation into a clear plan

A client does not always need a large transformation programme or a lengthy consulting engagement. Sometimes the immediate need is to understand why an initiative is struggling and what should happen next.

For a troubled GRC implementation, I would typically propose a focused diagnostic over approximately two weeks.

The work would include reviewing project status, requirements, solution design, delivery risks and key dependencies, alongside discussions with stakeholders across the business, Compliance, IT and the vendor.

The output would be a concise assessment covering:

• The principal issues affecting delivery.

• Gaps or inconsistencies in requirements and solution design.

• Decisions that remain unresolved and the stakeholders accountable for them.

• Key delivery risks, dependencies and priorities.

• A prioritised action plan with recommended ownership and next steps.

For a new initiative, the same underlying approach can establish the foundations for implementation: a clearer scope, aligned stakeholders, an initial solution direction, a defined delivery structure and measurable acceptance criteria.

The purpose is to give the sponsor a reliable basis for deciding what intervention is needed before committing to a larger programme of work.

7. Applying the same principles to AI governance

AI governance presents a related challenge. Organisations may be experimenting with AI or planning new applications without having a complete picture of their use cases, responsibilities, risk exposure, controls and implementation dependencies.

A practical AI Governance Diagnostic applies the same principle of connecting governance expectations with operational reality.

Over two to four weeks, depending on scope and complexity, I would review relevant AI use cases, existing governance arrangements, accountability, risk classification and controls. Interviews with stakeholders across the business, Risk, Compliance and Technology would help establish how AI is being used, how decisions are made and where the main gaps lie.

The resulting assessment would provide:

• A view of the current governance position and key limitations.

• A prioritised register of identified gaps and risks.

• Recommended actions, proposed owners and priorities.

• A 90-day roadmap for strengthening AI governance.

• An indication of where additional analysis of specific use cases, data architecture or technology dependencies is warranted.

The diagnostic is designed to support informed decisions, not to promise a predetermined compliance outcome. Findings would need to be assessed against the organisation's applicable obligations, with legal and regulatory interpretations validated by the appropriate accountable experts.

The same delivery principle applies: establish the facts, identify the gaps, agree priorities and translate the outcome into a practical plan.

8. What makes my approach different?

My value lies in the combination of practical delivery experience, technical understanding and the ability to work across organisational boundaries.

Over 20 years in financial services, I have worked as a Project Manager, Solution Architect, IT Business Analyst and Technical Product Owner. These roles have given me experience across the lifecycle of GRC-related initiatives, from understanding requirements and shaping solutions to coordinating implementation and addressing technical delivery questions.

As an independent consultant, I work directly with the client throughout the engagement. This provides continuity between problem definition, design and delivery, without requiring the client to bridge separate consulting workstreams.

I also bring an external perspective informed by experience across banking, insurance and commodity trading, alongside research into AI governance, technology risk and digital transformation. This helps me question assumptions, consider alternative approaches and bring relevant ideas into practical discussions.

I do not position myself as a replacement for a large consultancy or a team of specialist experts. For engagements that require extensive specialist resources, I can complement the existing team by providing hands-on leadership, connecting disciplines and helping the wider programme move forward.

My focus is on practical outcomes: clearer requirements, better-aligned stakeholders, informed design decisions, fewer avoidable misunderstandings and a credible path to implementation.

9. Measuring value through tangible outcomes

Consulting should create value that the client can evaluate.

At the beginning of an engagement, I aim to agree on its objectives, scope, deliverables and success criteria. Depending on the assignment, these may include:

• Requirements that are clarified, prioritised and traceable to agreed objectives.

• Documented solution options and decisions.

• Clear ownership of outstanding issues and approvals.

• An agreed target approach and actionable implementation plan.

• Improved visibility of project risks, dependencies and delivery priorities.

• A prioritised set of governance gaps and recommendations.

• Defined acceptance criteria and a clearer basis for validating the outcome.

Not every engagement can guarantee a particular business or regulatory result. What can be established is a clear scope of work, a defined set of deliverables and a transparent basis for evaluating progress.

The aim is to leave the client better positioned to make decisions and move forward, whether implementation continues with me, the existing internal team or another provider.

Conclusion

GRC technology initiatives require more than regulatory knowledge, project coordination or technical expertise in isolation. They require the ability to connect these disciplines and turn them into a coherent, implementable solution.

My approach combines 20 years of financial-services experience with practical capabilities in business analysis, solution architecture, project delivery and technical implementation. I help organisations clarify complex requirements, align stakeholders, resolve design questions and establish a realistic path from problem definition to delivery.

Whether the need is to stabilise a struggling implementation, prepare a new GRC initiative, resolve a regulatory design challenge or assess AI governance readiness, the objective remains the same: make the problem clear, make the decisions actionable and help deliver a solution that works in practice.

For organisations facing a difficult GRC or technology challenge, a focused diagnostic is often a useful starting point. It establishes the current position, identifies the most important gaps and provides a practical basis for deciding what to do next.

GRC Advisory — bridging Compliance, business and IT from requirements to implementation.

Contact

Reach out via email for inquiries.

Email

Subscribe to newsletter

info@grcadvisory.ch

© 2025. All rights reserved.