01 / The Rulebook · 4 articles
The Rulebook
Policies kept current, consistent, and findable. The desk that owns what your company has written down and turns it into something the whole business can run.
Resources
A working library on business risk & governance.
Six functions of the governance office — the rulebook, risk, proof, decisions, AI oversight, and growth. Read any of it and you are reading how the work actually gets done, in plain language, so you can apply it to your own rules. This is the heart of what I publish.
02 / Risk & Dependencies · 3 articles
Risk & Dependencies
Seeing risk where it actually moves: your vendors, your AI features, your incident response, and the dependency map that shows what touches what before it breaks.
03 / Compliance & Proof · 5 articles
Compliance & Proof
SOC 2, ISO 27001, HIPAA, GDPR, the EU AI Act, and the enterprise buyers who enforce them. Proof kept continuously, ready before anyone asks.
04 / Decisions & Accountability · 3 articles
Decisions & Accountability
Who has authority to decide, how decisions get routed, and the record that proves the right person made the call.
05 / AI & Data Oversight · 4 articles
AI & Data Oversight
Every system you run now ships AI. The desk that keeps the inventory current, the oversight proven, and your data exactly where it belongs.
06 / Growth & Deals · 3 articles
Growth & Deals
Governance is not just defense. M&A, new territories, and enterprise deals all move faster for the company that can prove itself.
six desksone officeone record
Frequently asked
The questions every first call starts with.
01Do you take possession of my data?
No. This is the foundation of how I work, not a feature. I observe controls at their source and record proof that they operated: statuses, timestamps, configuration states, hashes. Your customer records, messages, files, and business content never enter my possession.
02Are you an auditor? Do you certify me?
No. Certification and attestation are the independent work of auditors and certification bodies; that independence is what gives them value. My work is everything underneath: controls mapped to frameworks, evidence kept continuously, and the record ready the moment they ask.
03Which systems can you govern?
The platforms running most mid-market companies: Salesforce, Microsoft 365, Google Workspace, AWS and Azure, Okta and Entra ID, plus ticketing and vendor-management systems. If a system holds proof of your controls, the pattern extends to it.
04Which frameworks do you cover?
SOC 2, ISO 27001, HIPAA, GDPR, and the EU AI Act, with NIST AI RMF as voluntary scaffolding where it helps. One control map serves all of them, so a control is proven once and answers many questions.
05How is this different from GRC software?
GRC software governs a control library inside the security lane, hands you a tool, and keeps the burden. I operationalize business governance: every commitment in every department, on your own documents, dependency-mapped across the company. The outcome is owned end to end, the automation runs underneath, and the record I keep contains evidence, never your data.
06What does an engagement look like?
Three depths. Depth 01 reviews and cleans your policies and maps your controls. Depth 02 connects your systems and keeps continuous evidence. Depth 03 runs your governance function end to end. Most companies start with the review and grow into the record.
07How fast do I see value?
The governance review produces findings in weeks: where your proof is strong, fragile, and missing, in plain language. The continuous record starts paying the day it starts running, and it compounds, because evidence that runs longer proves more.
08What happens if I leave?
You keep everything: the record, the control maps, the cleaned policies. The engagement is designed so that you walk away more provable than I found you, whatever you decide.