We help organisations build the governance, regulatory and risk frameworks they need to operate responsibly and grow with confidence, from corporate governance and regulatory compliance to data protection, technology governance and enterprise risk.
Compliance obligations do not arrive in one piece. They accumulate: a licence condition here, a data protection duty there, a filing deadline that passed while the team was shipping until the organisation is carrying a liability it never priced and cannot easily quantify.
The same is true of governance. Structures that worked with four people fail at forty, not through anyone’s fault but because nobody’s job was to notice. Decisions get made by whoever is available. Nobody can say who approved what. And then an investor, a regulator, an acquirer or a donor asks a question the organisation cannot answer.
Governance is not documentation. It is the machinery through which an organisation allocates authority, manages risk and demonstrates accountability.
Our work takes two shapes.
Remedial. An honest assessment of where the organisation actually stands against what it is required to do, and a sequenced plan to close the gaps, ranked by consequence rather than by ease. A good assessment often reveals that an organisation’s most consequential gaps are not the ones management expected to find.
Architectural. Building the board structures, policy frameworks, risk registers, controls and reporting lines that let a growing organisation govern itself without the founder in every decision. This is the work that makes a company investable, acquirable and durable.
Data protection is a substantial part of this practice. We advise on the Nigeria Data Protection Act and applicable NDPC requirements and, where clients’ activities extend internationally, on relevant cross-border privacy obligations including the EU GDPR and UK GDPR. As artificial intelligence moves into decisions that affect people, governance of those systems has become part of the same conversation: what the model was trained on, who is accountable for its output, how it is tested and supervised, and what happens when it is wrong.