Collaborate
Technology risk governance and audit leadership, built for regulated financial services.
Who
25 years across banking, insurance, and asset management, in technology risk, audit, and controls.
The operating focus has not changed: controls that actually work, and evidence that proves it under scrutiny.
What
Four areas this work and these field notes keep coming back to.
Audit leadership & remediation validation
Defensible closure protocols, quality criteria, evidence expectations, and repeatable testing frameworks. Designed to hold up when examiners or internal audit functions look hard.
AI governance & GenAI controls
Audit programmes for Copilot, ChatGPT Enterprise, and LLM deployments in regulated environments. Control design, risk assessment, and evidence strategy for AI systems under DORA, EU AI Act, and FCA expectations.
Cloud, infrastructure & identity risk
Risk-based oversight across Microsoft 365, cloud controls, IAM/PAM, and production platform resilience. Assurance that maps to ISO 27001 and NIST CSF without the generic checklist approach.
Third-party & vendor assurance
SOC report analysis, pen-test deep dives, obligation mapping, and remediation tracking designed to survive audit time pressure. From intake to ongoing monitoring.
Start a conversation
Email is the right channel. Tell me what you are working on or thinking through. No intake forms, no sales process, no pitch.
Birmingham now, Mumbai from late 2026. Always glad to compare notes with practitioners across the UK, India, Singapore, the Gulf, and APAC.
Contribute or challenge
Field notes and control content improve when practitioners push back. Here is how.
Corrections and counterexamples
If something is factually wrong, missing a control, or breaks in real environments, email is the right channel. Include the URL and what should change.
Content requests
Suggest a field notes topic, request a Python Encounter, or flag a gap in a Dhārā. Requests are reviewed on clarity, relevance, and quality. Replies where possible.
Please do not include confidential or client-identifying material in any correspondence.