A compliance program that isn't bloated from day one.
Most builds hand you a stack of templates for risks you don't carry. Yours starts with what your business actually needs—and nothing it doesn't.
The build starts by subtracting.
Most program builds are addition by default.
A consultant arrives, ports in a stack of templates, and hands you a program already carrying weight it doesn't need—controls for risks you don't run, policies for regulations that don't touch you, training nobody needed. It's thorough. It's also bloated on day one, and you'll spend the next three years trying to work out what you can quietly drop.
I build the other direction. Every engagement starts with a risk assessment, and the risk assessment isn't box-ticking—it's how I decide what not to build. We map where the real exposure lives in your specific business, and everything after that earns its place against that map. What your business carries, you get. What it doesn't, you don't.
That's the discipline of a mature program—the kind that's already survived the painful audit of its own bloat—except you get it at the start, before the weight ever accumulates.
You probably already know it's time.
The moment is usually one of these.
An enterprise customer or an acquisition conversation.
Due diligence just got real, and the buyer or customer is asking questions your current documentation can't answer.
A culture incident that surfaced something structural.
Something happened—and now you can see that the informal norms that worked at thirty people don't hold at a hundred and fifty.
The honest version.
No incident, no outside pressure. Just the quiet recognition that the business has outgrown the way it's been operating.
What the build covers
A program is more than a binder of policies. A full build includes:
Risk assessment — where the real exposure lives in your business, and the map everything else gets built against.
Policies — written for the people who have to follow them, not the auditor who reads them once. (Code of Conduct is scoped separately—more on that here.)
Infrastructure — the reporting mechanism, the hotline, and the communications and rollout plan that actually gets the program in front of people.
Training — role-relevant and connected to how people actually work, not a generic module everyone clicks through on mute.
Making it stick — manager enablement and a measurement framework, so the program keeps working after I'm gone.
Most compliance programs are built by attorneys.
An attorney builds to one question: will this hold up? It's the right question, and it's not enough. A program can be airtight on paper and still be ignored on the ground—technically sound, practically dead.
Holding up is the floor, not the finish. So I build to both: a program that survives the audit and one people actually use. The first keeps you out of trouble. The second is the whole point.
How it works
Every build is flat-fee and scoped to your organization — its size, risk profile, and what you're starting with. No hourly billing, no surprises. You'll know the number before we start, and most engagements run three to six months.
Three ways in:
Program Foundation — risk assessment, core policies, and a basic training framework. Sized for organizations at the earliest stage of formalizing.
Full Program Build — the complete build: policies, communications plan, reporting mechanism, and hotline setup, scoped to your size and complexity.
Build + Embed — the full build plus three months alongside you through rollout, which is when a program is most likely to stall. The highest-confidence path to one that actually takes hold.
All builds are flat-fee, with a minimum three-month commitment. Your tier and price are confirmed after an initial conversation — scoped to where your program actually is, not where you hope it'll be.
You're not paying for a binder. You're paying for a program your business will actually use.
Start with what you actually need.
Tell me where things stand—what you've got, what's prompting this, and where it feels like the business has outgrown its setup. We'll work out what the build actually needs to cover, and what it doesn't.