We design and embed GRC frameworks for financial services firms and other regulated organisations: policies, risk registers, controls, management information (MI) and governance forums. Led by Stephen Mbuthia, who has more than 15 years in regulated financial services.
A risk taxonomy, scoring method and heat map that show your board what matters.
Mapping and implementing requirements such as the UK General Data Protection Regulation (UK GDPR) and Financial Conduct Authority (FCA) rules in the UK, and the Capital Markets Authority (CMA), Central Bank of Kenya (CBK) and Data Protection Act 2019 in Kenya.
Policies, standards, procedures and work instructions your team will use.
Anti-money laundering (AML), sanctions, anti-bribery and conduct frameworks for first and second line teams.
Risk reporting, dashboards and governance forums that give leaders real oversight.
Control assessments, gap analysis and remediation plans.
Workshops, regulatory mapping and a current-state risk assessment.
Framework, policies, controls, risk taxonomy and reporting.
Roll out documents, controls, training and a reporting cycle.
Periodic reviews, control testing and improvement.
Yes. We map Kenyan requirements, including the Capital Markets Authority (CMA), Central Bank of Kenya (CBK) and the Data Protection Act 2019, alongside UK requirements, and build them into your framework.
It depends on scope and the size of your organisation. We give you a written estimate after the scoping call.
Yes. Stephen has worked with both business teams (first line) and risk and compliance teams (second line).
Book a consultation. We'll agree scope, timings and next steps.
Book a GRC scoping call