Risk and compliance

Name the obligation, the gap, and the evidence you will leave.

Compliance consultants sell to companies that have been asked for a policy, an assessment, or a control they cannot describe. The proposal should name the ask, the work that answers it, and the limit of your role.

The obligation and the gap

Quote the ask. A customer's data-processing addendum. A regulator's letter. An internal audit point. A board that wants a risk register before a fundraise. The proposal is an answer to that document. A general compliance health-check, unattached to an ask, invites every policy on the shelf into your scope.

Say what you are not. You are not their external counsel, their statutory auditor, or the regulator. You prepare drafts, map gaps, and tell them what evidence would satisfy a careful reader. A lawyer or an auditor signs what their profession requires them to sign. Write the handoff.

Evidence you will leave behind

The deliverable is a pack a third party could read: the policy or the register, the list of gaps you did not close, and the owner of each gap. A slide that says the company is 'on a journey' is not evidence. Clients under pressure will try to turn your draft into a certificate. The proposal should say there is no certificate in this fee.

Implementation of every control, staff training across every site, and a tool subscription are the overrun. Close the named gap. List the others. Offer a second engagement if they want them, after the ask that brought you in has been answered.