What this looks like in practice.

The brief

The group knew ECCTA applied to it and had no clear view of what that meant operationally. Two separate obligations were being discussed as one: the Companies House identity verification regime and the corporate offence of failing to prevent fraud. The board wanted a defensible position on both and a way to report progress that did not depend on assertion.

What we did

We split the work into two phases so each could be closed out properly. Phase one covered Companies House and identity verification: entity mapping, who needed verifying, filing obligations and the process changes to keep it current.

Phase two built the reasonable procedures defence across six stages: fraud risk assessment, control gap analysis, procedure and policy design, training, implementation and independent assurance over the result.

The outcome

A documented position on both obligations ahead of the deadline, with a board-level report tracing each element of the defence to the evidence behind it. The assurance stage was performed by a team independent of the build, so the defence has been tested rather than only designed.

Why it mattered

A reasonable procedures defence that has never been independently challenged is an assertion. The independent assurance stage is the part most programmes skip and the part that matters if the defence is ever needed.

Related

Our Internal Audit & GRC practice

The brief

The firm needed to support a declaration on the effectiveness of its risk management and internal control framework and did not have the internal capacity to do the underlying work to the standard the declaration implies. The requirement was specific, time-boxed and did not justify a permanent hire.

What we did

We shaped the brief around what the engagement actually required: someone who had done controls testing against a governance framework before, not simply an auditor available at short notice. The technical screen was run by a practitioner and we presented a short shortlist.

The outcome

An Internal Audit Manager placed for six months who delivered the Provision 29 work within the window. The client subsequently engaged a second Internal Audit Manager through us for broader business audits, the strongest signal available that the first placement worked.

Why it mattered

This is the clearest example of the diagnosis question. A permanent hire would have been the wrong answer for a defined, time-boxed obligation. The permanent need appeared later, once the firm understood the shape of the function it wanted.

Related

How our recruitment works

The brief

The audit plan carried significant technology, cyber and change coverage that the function could not deliver credibly without a dedicated IT audit specialist. This is one of the thinnest talent markets in the discipline: the population that can genuinely audit cloud, change and cyber (and hold its own with a CTO) is small and very little of it is actively looking.

What we did

A mapped search rather than an advertised one. Candidates were screened on what they had actually tested and how they had handled disagreement with technology leadership, which is where IT audit appointments usually fail.

The outcome

An IT Internal Audit Manager appointed with coverage across technology, cyber and change risk, allowing the annual plan to be delivered as approved rather than re-scoped around a capability gap.

Why it mattered

Contingent search does not work in this market, because the right people are not applying to anything. The map and the direct approach are the work.

Related

Roles we place in GRC

The brief

We had already carried out a sustainability strategy and organisational design review for the group. That review identified the shape the CSO's team needed, including a Head of Communities role that did not yet exist. The client asked us to fill it.

What we did

Because we had designed the structure, the brief did not need reverse-engineering, we knew what the role had to deliver, who it would work with and where it would be contested internally. The search ran against that, rather than against a job description written after the fact.

The outcome

A Head of Communities appointed into the Chief Sustainability Officer's team, in a role scoped during our advisory work and filled through our search practice.

Why it mattered

This is the clearest illustration of why the firm does both things. A recruiter handed this brief cold would have spent the first month working out what the role was for. We had designed it.

Related

Our sustainability practice

The brief

A sustainable investing team needed someone who could work across both climate and nature. In practice these are separate disciplines with separate data, separate frameworks and separate communities of practice. A great many CVs claim both; comparatively few people have delivered both.

What we did

Screening focused on evidence rather than vocabulary: what had the candidate actually built on the nature side, what data had they used and where had it broken. A practitioner screen separates genuine dual capability from familiarity with a framework very quickly.

The outcome

A Climate & Nature Manager placed into the sustainable investing team, holding both specialisms rather than one plus an interest in the other.

Why it mattered

Nature data is roughly where carbon data was several years ago. Hiring someone who understands that, rather than someone who expects a clean dataset, is what makes the role survivable.

Related

Sustainability roles we place

The brief

A sovereign investment group wanted to understand what its sustainability investment was actually returning and to review whether its strategy and roadmap still matched where the organisation and its portfolio had moved to.

What we did

Four strands. An Impact Framework to quantify the return on sustainability investment in terms the investment committee recognised. A strategy and roadmap review. A market review on AI and its relevance to the group's sustainability agenda. And direct engagement with portfolio companies, where most of the real exposure sits.

The outcome

An Impact Framework in use, a reviewed strategy and roadmap and a structured basis for engaging portfolio companies rather than surveying them once a year.

Why it mattered

Quantifying the return on sustainability investment is the question most investors avoid, because the honest answer is often uncomfortable. Asking it properly is what makes the rest of the programme defensible.

Related

How our delivery works

The brief

The bank's finance function was being handed sustainability reporting responsibilities it had not been trained for. The people were capable; the subject matter was new. Hiring specialists for every team was neither affordable nor necessary.

What we did

An enterprise-wide training programme built for finance professionals rather than sustainability professionals: reporting frameworks and what they actually require, GHG and climate fundamentals, social and governance topics and a module on how to audit sustainability data.

The outcome

A finance function able to engage with sustainability reporting on its own terms, including the assurance dimension that determines whether a disclosure survives external review.

Why it mattered

Where a client has capable people who are simply missing the subject matter, training is cheaper and more durable than consultancy. We would rather say that than sell the alternative.

Related

Our training work

The brief

The Sustainable Investment team had the mandate and the relationships but not the capacity to deliver three significant pieces of work at once. The requirement was additional senior capability working inside the team, not an external report delivered to it.

What we did

Placed an embedded consultant inside the team, working to its priorities and reporting lines. The work covered climate strategy, nature strategy and a review of the investment framework through which both would be applied.

The outcome

Climate and nature strategies delivered and the investment framework reviewed, with the work owned by the client's team rather than arriving as a document from outside it.

Why it mattered

A strategy the team built with support gets implemented. A strategy delivered to the team as a report frequently does not.

Related

Co-sourced & embedded delivery

The brief

Four separate obligations were being managed as four separate exercises: the ESOS Phase 3 update, ESOS Phase 4, annual SECR reporting and a Carbon Reduction Plan needed for public sector tendering. All four draw on substantially the same underlying energy and emissions data.

What we did

Ran them as one integrated programme with a single data collection exercise, delivered with an accredited ESOS Lead Assessor. Collect once, use four times and keep one consistent set of numbers across all four submissions.

The outcome

ESOS Phase 4 and the Phase 3 update completed, FY26 SECR reporting delivered and a Carbon Reduction Plan in place to the standard public sector tenders require, all reconciling to the same data.

Why it mattered

Run separately, these exercises cost three times over and routinely produce figures that do not agree with one another. Inconsistency between your own published numbers is the problem that is hardest to explain afterwards.

Related

UK compliance work

The brief

A fast-growing business with enterprise clients was being asked, repeatedly and with increasing specificity, for ESG documentation it did not have. Each client asked in a slightly different format. The commercial risk was immediate: contracts were beginning to depend on the answers.

What we did

Built the full documentation suite in one pass rather than responding request by request: a Scope 1-3 carbon footprint, a Carbon Reduction Plan, a governance framework, a supplier questionnaire for their own supply chain and EcoVadis readiness.

The outcome

A single, consistent ESG evidence pack that answers most client due-diligence requests directly, with EcoVadis readiness in place for the clients who require a rated assessment.

Why it mattered

Being out of scope for regulation does not put you out of scope for your customers' regulation. This is the route by which most mid-market businesses arrive at sustainability reporting, through a procurement form, not a legal obligation.

Related

Our sustainability practice