Scattered obligations
Laws, sector rules, self-regulation and contracts pile up without a single map of who is accountable for what.
Consulting
Corporate Governance & Compliance
Traceable decisions, known risks and operations that keep running.
We strengthen controls, decision making and compliance in regulated sectors such as Healthcare, Financial Services, Insurance, Energy, Agribusiness, Fixed Odds Betting and Telecommunications. We bring compliance, risk management and business continuity together in a program you can actually execute.
- ISO 31000
- ISO 22301
- ISO/IEC 27031
- Sector regulation
The challenge
Traceable decisions, known risks and operations that keep running.
Risk left out of decisions
When risk has no criteria, owner or reporting, it never reaches the table where decisions are made.
A continuity plan never tested
A plan that has never been exercised only reveals its gaps on the day of the crisis.
How we help
Workstreams
Regulatory Compliance
Goal
Ensure regulatory adherence and reduce the risk of sanctions, operational restrictions and reputational damage, structuring a compliance program that can be executed day to day, with governance, controls, evidence and continuous monitoring, suited to the demands of regulated markets (Healthcare, Financial Services, Insurance, Energy, Fixed Odds Betting and Telecommunications).
What we do
Regulatory mapping and assessment
- Survey of applicable obligations (laws, sector regulations, self-regulation and contracts).
- Gap analysis by process and area, prioritized by risk and criticality.
Compliance program: structure and governance
- Governance model: roles, committees, meetings, reporting and decision trails.
- Compliance policy, code of conduct and operating guidelines by topic.
Controls and evidence
- Design and strengthening of controls (preventive and detective) and evidence requirements.
- Standardization of records, approvals, segregation of duties and audit trails.
Compliance risk management
- Methodology, risk matrix, KRIs, KPIs and treatment plans.
- Management of exceptions, acceptances and regulatory changes with traceability.
Monitoring, audits and continual improvement
- Periodic control testing, thematic internal audits and action plans.
- Tracking of metrics and effectiveness reviews (PDCA cycle).
Third parties and supply chain
- Due diligence and contractual requirements, including regulatory and conduct obligations.
- Monitoring of the performance and compliance of critical suppliers.
Training and culture
- Learning paths by audience (leadership, critical areas and operations), communication and campaigns.
- Attendance records and measurement of effectiveness.
Certification readiness
Goal
Prepare the company for certifications and technical and regulatory requirements, structuring governance, processes, controls and evidence in an auditable way, with minimal rework and maximum predictability. ISO 22301 is certifiable; ISO 31000 is a guideline and does not lead to a certificate, but the risk framework it guides is the foundation that audits, inspections and the certifications themselves expect to find.
What we do
ISO 31000: risk management framework
- Maturity assessment and design of the risk framework (principles, structure and process).
- Definition of appetite, tolerance, risk criteria and corporate methodology.
- Rollout of the risk register, the treatment plan and governance meetings (committees and reporting).
- KPIs and KRIs, integration with planning and support for internal audits and reviews.
ISO 22301: business continuity certification
- Readiness and scope definition of the BCMS (context, requirements and objectives).
- BIA (Business Impact Analysis), continuity strategies and recovery requirements.
- Drafting and updating of plans (continuity, crisis, communication, testing and lessons learned).
- Running exercises and tests, effectiveness adjustments and audit preparation.
Market specific technical certifications
- Mapping of applicable technical and regulatory requirements (for example, Fixed Odds Betting in Brazil) and a compliance matrix.
- Structuring of the required policies, plans, standards and procedures, with evidence.
- Assisted implementation of controls, governance and monitoring and reporting routines.
- Preparation for inspections, audits and certifications, including evidence files.
Risk Management
Goal
Establish and run an enterprise Risk Management model aligned with ISO 31000, bringing strategy, processes and governance together to support decisions, reduce uncertainty and increase predictability. We structure criteria, roles, meetings and metrics so that risk is managed continuously, with traceability and a focus on results.
What we do
ISO 31000 framework: structure and process
- Definition of policy, principles, scope and integration with how the company is managed.
- Governance model: roles, committees, lines of defense and executive reporting.
Criteria and risk appetite
- Appetite, tolerance, impact and likelihood scales and risk categories.
- Rules for acceptance, exceptions, escalation and prioritization.
Identification, analysis and evaluation
- Workshops with key areas and risk mapping by process and objective.
- Qualitative assessment, quantitative where applicable, and consolidation of the risk register.
Treatment and continuous monitoring
- Treatment plans with owners, deadlines, costs and evidence.
- KPIs and KRIs, periodic review, change management and effectiveness checks.
Standardization and sustainment
- Templates and guides: risk matrix, register, action plan and reports.
- Training for business areas and routines to keep the risk cycle alive (PDCA).
Business Continuity
Goal
Structure and operationalize Business Continuity to ensure resilience, reduce impact and quickly resume critical operations. We combine the risk perspective of ISO 31000 with the management system structure of ISO 22301 and with ISO/IEC 27031 (ICT readiness for business continuity), creating processes, plans and evidence that work in practice and hold up over time.
What we do
Strategy and scope (ISO 22301 and ISO/IEC 27031)
- Definition of the BCMS scope, context, requirements and objectives.
- Governance model, roles, meetings and crisis communication.
BIA and prioritization (ISO 22301, ISO/IEC 27031 and ISO 31000)
- Conducting the BIA: critical services, impacts, dependencies and recovery timeframes.
- Recovery requirements (RTO and RPO) and minimum service levels.
- Integration with the risk register and with risk appetite and tolerance (ISO 31000).
Plans and operational controls
- Continuity and contingency strategies by scenario (people, processes, technology and third parties).
- Continuity, Crisis Management and Communication Plans, with checklists and responsibilities.
- Alignment with critical suppliers and contractual continuity requirements.
Tests, exercises and continual improvement
- Planning and running exercises (tabletop and simulations) and periodic tests.
- Recording of lessons learned, corrective actions and effectiveness checks.
- Metrics and a review routine to keep the program alive and auditable.
Audits
Goal
Assess, independently and based on evidence, the effectiveness of governance, risk management and business continuity, verifying adherence to ISO 31000 and ISO 22301 as well as compliance requirements in regulated markets. The focus is to anticipate critical issues before external audits and inspections, reduce exposure to nonconformities and strengthen continual improvement.
What we do
Internal audit of risk management (ISO 31000)
- Framework review: policy, roles, appetite, tolerance and integration with the business.
- Process consistency testing: identification, assessment, treatment and monitoring.
- Evidence validation: risk register, acceptances, plans and executive reporting.
- Report with gaps, recommendations and an action plan prioritized by risk.
ISO 22301 internal audit
- Verification of the BCMS: scope, context, governance and documentation requirements.
- Review of the BIA, continuity strategies, plans and communication mechanisms.
- Assessment of tests and exercises, lessons learned and the effectiveness of corrective actions.
- Report with nonconformities, improvements and preparation for the external audit.
Compliance audit in regulated markets
- Mapping of obligations and audit criteria (standards, sector rules and technical requirements).
- Testing of controls and evidence trails (critical processes, records, segregation and reporting).
- Readiness assessment for inspections and regulatory examinations, with a remediation plan.
References
Standards, laws and frameworks that guide the work and the evidence.
- ISO 31000
- Guidelines for risk management. Guides the framework; not certifiable.
- ISO 22301
- Requirements for a Business Continuity Management System. Certifiable.
- ISO/IEC 27031
- ICT readiness for business continuity.
- Sector regulation
- Each market’s regulations, such as those that apply to Fixed Odds Betting in Brazil.
Related training
For the team that will run the program once the project ends.
In Galáxia
The Galáxia systems that sustain this work after the engagement, with the same method.
Request a proposal
Shall we organize risk, compliance and continuity?
Tell us your sector and the requirements you need to meet. We will reply with a first scope outline.
cyber@cyberconsulting.com.br