Delivery services Advisory & Strategy Data & Analytics Security & Cyber Customer & Growth Regulation & Risk Sustainability & ESG Finance Procurement
Delivery service
Regulation, Risk & Compliance
Meet the regulator’s bar without crowding out everything else.
Regulatory change lands as a programme in itself – Consumer Duty, operational resilience, price controls, separation. We deliver it with controls intact and the business ready, and build reporting once that the regulator trusts and operations can use.
The problems we hear
“Regulatory change is the whole portfolio now.”
Mandatory programmes crowding out the ones that would grow the business.
“We report to the regulator and run the business on different numbers.”
Reporting built as a separate exercise rather than a by-product of operations.
“We’re separating from the group and don’t know every dependency.”
Touchpoints that only surface when they break.
What we deliver
01
Regulatory change delivery
Programmes delivered to the deadline with controls designed in and the business ready.
02
Risk and controls frameworks
Three lines that work in practice, with risks that get decided rather than logged.
03
Regulatory reporting
Built once, trusted by the regulator, useful to operations.
04
Separation and standalone operating models
Every dependency mapped, a target model designed, on a fixed price and a fixed date.
05
Governance for AI and data
Approval routes, risk assessment and evidence the risk function owns.
06
Independent assurance
A clear view for the sponsor – not the supplier – of whether a regulated programme will land.
07
Operational resilience
Important business services, impact tolerances and scenario tests the regulator will accept.
08
Conduct and customer outcomes
Consumer Duty and fair-value evidence built from how customers are actually treated.
A way in, not a methodology.
Every delivery service starts small and earns the next step. Most begin with a short diagnostic that tells you what’s true before anyone commits to a programme.
Step 1
Assess
Obligations, exposure and the current control environment, by jurisdiction where needed.
4–6 weeks
Step 2
Design and plan
Target controls, reporting and operating model, sequenced into the portfolio.
6–10 weeks
Step 3
Deliver and assure
Programme delivery with independent assurance to the deadline.
To the regulatory date
Who delivers it with
Delivery services are staffed from the practices below and, where it fits, run through our as-a-service offices so governance and value tracking come built in.
Often paired with
Security & Cyber Resilience → Finance Transformation → Data & Analytics →
Seen in practice
Case study · Energy & Resources
Gas market data services body: Standing up an independent organisation in 8 weeks
Every dependency mapped and a standalone operating model designed on a fixed price.
Read the case study →
Case study · Healthcare & Life Sciences
Health tech scale-up: Data governance readiness ahead of a funding round
Exposure mapped across 3 regulatory regimes and a prioritised action plan for investor scrutiny.
Read the case study →
Practitioners at a glance
Three of the people who lead Regulation, Risk & Compliance work. Drawn from a network of 5,000+ practitioners averaging 14 years in their field.
Nadia
Nadia gives sponsors an independent view of whether regulated programmes will land.
Sarah
Sarah delivers mandatory change to the date with controls intact – and reporting built once that operations can use.
Mark
Mark maps every dependency and designs standalone operating models on a fixed price and a fixed date.