Advisory

Conducting a holistic assessment of your control environment against the relevant frameworks and guidance. 

This typically includes: 

• Mapping obligations from DORA, NIS2, DNB Good Practices, DigiD, and other national or European requirements to your current processes and policies 
• Assessing maturity across governance, risk, IT, outsourcing, and incident response domains 
• Identifying where your controls are proportionate - and where complexity can be reduced

The outcome: a transparent baseline that distinguishes genuine compliance gaps from cosmetic documentation issues.

Next, we develop a pragmatic improvement roadmap. 

Each identified gap is prioritised according to its impact, urgency, and ease of implementation. 

Our focus is not on creating more controls, but on strengthening the most important ones. 

Where appropriate, we suggest smart control substitutions: efficient ways to meet supervisory expectations without unnecessary overheads. 

A solid compliance foundation starts with a coherent Policy House. 

We help our clients to design, structure, and align their governance documentation, including policies and procedures, to standards and guidelines. 

Our policy house approach ensures every document has a clear owner, purpose, as well as a traceability link to regulatory requirements. 

We can draft or refine policies covering ICT risk, outsourcing, data management, operational resilience, and incident reporting, all of which are written in plain, audit-proof language. 

We prepare board-level reports and management briefings that demonstrate your progress, residual risks, and next steps. 

 We also support clients during supervisory dialogues - such as inquiries from the AFM or DNB - by helping management to explain their regulatory position confidently and credibly. 

 Our advisors are adept at translating complex technical topics into concise, defensible narratives that demonstrate both control and intent. 

Regulation doesn't pause, and neither should readiness. 

We design lightweight monitoring routines, such as regulatory trackers, self-assessment checklists, and dashboards, to keep your compliance sustainable and future-proof. 

This ensures that regulatory awareness becomes a living part of your governance rhythm, rather than a one-off exercise.