Enterprise Risk and Governance

The need

Most policy libraries are inherited, not designed — stitched together across mergers, audits, and departing employees, with no single owner accountable for currency or coherence. Regulators do not accept “we have a document”; the FCA's SYSC provisions and the UK Corporate Governance Code both test whether governance arrangements are effective in practice, board-approved, version-controlled, and reviewed on a defined cycle. A policy set that cannot survive cross-examination is a liability dressed as a control.

What Droiture delivers

• Policy gap assessment against ISO 31000, COSO, FCA SYSC, and sector-specific expectations
• Drafting and harmonisation of enterprise-wide policies across multi-entity and cross-border structures
• Board- and committee-ready governance documentation, with defined review cadence and ownership
• Alignment of policy language to what teams actually do — not aspirational best practice

The need

Operational failures are rarely caused by a single dramatic error — they accumulate quietly in undocumented handoffs, manual workarounds, and processes nobody has walked through since they were first built. Basel's operational risk principles and BCBS 239 both push in the same direction: an organisation should be able to aggregate its risk data and evidence how exposure is identified, not discover the breakdown after a loss event, a customer complaint, or a supervisor's letter.

What Droiture delivers

• End-to-end process walk-throughs across core operational, financial, and compliance workflows
• Enterprise risk management framework design and RCSA aligned to COSO ERM and Basel principles
• Risk data aggregation and reporting review informed by BCBS 239 expectations
• Risk heat-mapping with clear ownership and remediation timelines, not just a spreadsheet of findings

The need

A control that exists only in a narrative description — never tested, never mapped to the risk it is supposed to mitigate — offers false comfort. Under SOX, management must assess and attest to the effectiveness of internal control over financial reporting, and the UK Corporate Governance Code now asks boards to declare on the effectiveness of material controls. An organisation that cannot produce evidence of design and operating effectiveness testing is exposed at exactly the moment scrutiny is highest.

What Droiture delivers

• Full control inventory build-out, mapped one-to-one against identified risks
• SOX-style design and operating effectiveness testing, with defensible evidence trails
• Readiness support for board declarations on material internal control effectiveness
• Remediation roadmaps prioritised by control criticality, not alphabetical convenience

The need

Organisations often cannot answer a simple question with evidence: how good is our governance, compared to what it should be? Regimes such as the FCA's Senior Managers and Certification Regime and the EU's DORA have sharpened this considerably — both require that accountability for specific risks can be traced to a named individual and an evidenced arrangement. Without a maturity baseline, improvement work becomes a series of disconnected fixes.

What Droiture delivers

• Governance framework reviews benchmarked against Basel, FCA, SEC, and EU expectations
• Governance maturity assessments with a clear current-state and target-state baseline
• Accountability and responsibility mapping in the spirit of SM&CR-style regimes
• Operational resilience governance informed by DORA and Basel resilience principles