Your control functions exist on paper. I make them work.

What I do, and what I do not

Most advisory in this field sells documents: a framework, a policy suite, a maturity report with a heat map on the cover. The documents are usually competent. The function they describe does not exist, because nobody designed the organization that was supposed to operate it.

 

My work starts where the document ends. Who holds the mandate, and does the mandate carry authority. Which committee decides, and what it is permitted to decide. Where one function stops and the next begins. Whether the people in the seats can do the work, and who replaces them when they leave. These are organization development questions. They happen to arise in the control functions, which is where I have spent more than two decades, inside banks, inside a central bank, and in front of boards.

 

I do not sell templates, I do not staff projects with juniors, and I do not write frameworks for the shelf.

 

 

The problems I am hired for

01 The function has a charter and no authority

 

The department exists. It has a head, a policy, and a line in the organization chart. It cannot stop anything, because its mandate was written to satisfy a regulator rather than to bind the business.

 

What I do: mandate and structure design, reporting lines, authority levels, escalation rights, and independence arrangements that survive the first serious disagreement with a revenue line.

 

02 Committees meet, note, and decide nothing

 

The calendar is full of committees whose minutes record that papers were noted. Decisions are taken in corridors and ratified later. The board believes oversight is happening because meetings are.

 

What I do: committee architecture, which committees should exist, what each is empowered to decide, charters, membership, delegated authorities, and reporting packs built to force a decision.

 

03 Three lines of defense have become one blur

 

Risk does compliance’s monitoring. Compliance tests controls. Internal control duplicates audit. Audit arrives last and finds what all three missed. Everyone assumes someone else is watching.

 

What I do: operating model design across risk, compliance, internal control, and internal audit, who owns what, where the handoffs are, what is tested once rather than four times, and how assurance reaches the board as a single picture.

 

04 The framework is approved and nobody operates it

 

Risk appetite, RCSA, key risk indicators, compliance monitoring, control testing, audit follow-up: all documented, all performed on schedule, none of it changing a decision.

 

What I do: operationalization, converting each process from a calendar ritual into a working mechanism with owners, thresholds, consequences, and evidence that it altered something.

 

05 People were trained and capability was never built

 

The training budget is spent, the certificates are framed, and the function still depends on two people who know how things really work.

 

What I do: capability development, role-based competency design for control functions, structured induction, licensed programs from my course catalog, and on-the-job transfer measured by what people can do afterward.

 

06 Succession lives in a nine-box grid

 

Key control roles have named successors on a slide that is ignored the day a vacancy opens. Regulators ask about succession for approved persons and receive the slide.

 

What I do: succession and people risk for control functions, built on Jaffar’s Model of Succession Planning, readiness evidenced by exposure and delegated authority, not by a talent rating.

 

 

The instruments

Jaffar Operational Risk Management Maturity Model

 

A structured assessment of where a risk function actually stands, dimension by dimension, and what the next level requires. It replaces the consultant’s impression with a scored position the board can track. Most engagements begin here.

 

Jaffar’s Model of Succession Planning

 

An alternative to talent pools and nine-box grids for roles the organization cannot afford to leave empty. Succession is treated as a risk to be managed with evidence, not a list to be maintained.

 

 

Where I work

Risk management. Does the risk function have the standing, the information, and the people to change a decision before the loss, or does it report on the loss afterward?

 

Governance. Does the board oversee the organization, or a filtered account of it prepared by the people being overseen?

 

Compliance. Is compliance a function that prevents breaches, or a function that evidences effort?

 

Internal audit. Is audit independent and useful at the same time, and does its work reach a committee that acts on it?

 

Internal control. Are controls designed as a system, or accumulated one incident at a time until they produce the next incident?

 

 

How an engagement runs

Diagnose. A maturity and organization assessment: mandates, structures, committees, processes, people. Two to four weeks. Ends with a scored position and a sequenced plan.

 

Design. The target structure, authorities, committee architecture, and operating model, agreed with the people who will have to live in it.

 

Build. Implementation alongside your team: processes made operational, reporting rebuilt, roles filled or reshaped.

 

Transfer. Capability handed over deliberately. The engagement is finished when the function runs without me.

 

Engagement forms

 

Diagnostic: a fixed-scope assessment of one function or the full control environment.

 

Function build or rebuild: establishing or restructuring a risk, compliance, internal control, or audit function, typically three to nine months.

 

Board and committee advisory: committee design, charters, reporting, and director briefings on retainer.

 

Capability programs: induction and role-based programs for control function staff, delivered live or licensed from the course catalog.

 

 

Who this is for

This is for. Boards and chief executives who suspect their control functions are performing rather than functioning. Regulated institutions facing a supervisory finding on governance or risk management. Organizations establishing a control function for the first time and unwilling to copy one from a larger firm.

 

This is not for. Organizations that need a document for an inspection next month. Anyone looking for a framework that leaves the structure untouched. Engagements where the conclusion has been decided before the diagnosis.