About $500,000 a year.
A standing risk-and-governance office — a Chief Risk Officer, governance staff, counsel, and systems — is what the full function costs to staff. Most SMBs carry the exposure without any of it.
Why Bylaw
More than insured. Protected.
Bylaw isn’t a tool, a consultant, or an insurance agency — it’s how I think about risk, and the method I bring when a company works with me. I’m a licensed producer and governance practitioner: I find where a business is exposed, decide what to transfer to a carrier, and prove the rest through the controls you already run. Insurance transfers risk; governance prevents it. A full corporate risk-and-governance office runs about $500,000 a year — I make that thinking reachable.
What it is
A way of working, not a GRC tool.
A GRC tool checks boxes. The Bylaw method does something structurally different: it audits your actual exposure, matches the right coverage to transfer the risk you can’t eliminate, and then governs your whole business so the rest never becomes a claim, an audit finding, or a lost deal. Most companies that need all three can’t justify a full risk-and-governance office — so I bring the method to them, sized to the company.
One expert, sized to you.
The same audit, insurance, and governance judgment — across risk and whole-business governance — brought to your company at the scale it actually needs, on your team or for an engagement.
The decisions and the data.
I run the audit, place the coverage, and govern the whole business. Your company adopts its own rules, owns every decision, and your underlying data never leaves your systems. Evidence, never your data.
Where it starts
Your documents are the framework.
A GRC tool imports a control library and calls it governance. I start from what your company has already committed to — to regulators, to customers, to your own people, to your brand — and govern against that. The rules are yours; I make them operable controls that catch exposure before it hits. That is why I’m not an insurance agent who added a software dashboard. I work as a licensed producer and a governance director at once — two disciplines in one accountable relationship.
Your documents are the framework.
Every governing document you have — compliance policies, brand guidelines, CRM sales flows, HR handbooks, ops runbooks — turned into live, provable controls checked against what you already committed to. No imported checklist. No vendor agenda. Nothing to buy that replaces what you have.
Protection over everything.
Insurance covers one risk at a time. A GRC tool covers one department’s slice. The Bylaw method works where you actually operate — sales, marketing, HR, operations, finance, brand, legal — so exposure is caught before it becomes a claim, an audit finding, or a lost deal.
Nothing moves. Nothing breaks.
I never move your data and never change your workflows. I meet your company where it operates today and make it provable for tomorrow — new territories, mergers, the enterprise deal on the table.
My specialty
Dependency mapping: seeing around corners.
Insurance pays after exposure becomes a loss. The dependency map catches it before. Every rule in your company touches other rules — across departments that never talk. I map every document to every other, so a decision in one room never quietly breaks something in another. A marketing data protocol that would stall a future acquisition. A compliance update that would break your sales team’s CRM flow. A new territory whose rules collide with an HR policy written years ago. The map shows it before it costs you — and before it becomes something a policy has to pay for.
The map is kept current as the company changes, which is what makes it useful — a one-time review goes stale the moment a rule moves.
The honest split
Three questions. Three different answerers.
Every rule in your company has to answer three questions — and most governance failures come from mixing up who answers which.
Can it be governed?
Is the rule clear, owned, measurable, free of conflicts, checkable in a system, and provable with evidence? That’s structural — and it’s exactly what the Bylaw method settles.
Is it wise?
Is this the right rule for your industry, your risk, your coverage, your moment? That’s judgment. I bring it as a licensed producer and a governance director — two disciplines in one relationship, never a checklist pretending to cover both.
Who decides?
Your company adopts its rules and accepts being held to them. I route the decision to the right authority and record it — the decision itself is always yours.
What it produces
Four standing outputs, kept current.
Insurance pays after something goes wrong. These four outputs catch it before. In most companies each exists only in fragments — a filed policy, a stale audit binder, a checklist nobody owns. I keep all four live, current, and connected so there are no gaps to fall through.
One current rulebook.
Every governing document, read and reconciled into a single set the whole company can run on.
A map of what connects.
Each rule linked to every rule it affects, across departments, so a change in one place does not quietly break another.
A continuous evidence record.
Proof that controls operate — statuses, timestamps, hashes — kept current and ready before an audit, a deal, or a claim ever asks. Evidence, never your data.
A record of who decided.
Every conflict and approval routed to the right authority and recorded, so any decision can be reconstructed later.