What a risk function is actually for
A risk function can end up producing a register nobody reads and a control environment that exists for the auditor. The useful version is a decision-making capability: it tells executives which exposures are real, which are tolerable, and which are about to become expensive.
Quality has the same problem in a different shape. Treated as a phase at the end of delivery, it guarantees defects are found at the most expensive possible moment. Assurance is built into the delivery system itself, so standards, testing and audit operate while the work is still happening.
Wrenwell designs enterprise and portfolio risk frameworks, builds compliance architecture around the obligations that apply, including VGRMF and VPDSF, aligned to ISO 31000 and ISO 27001, and provides independent assurance over technical design and delivery outputs. The two disciplines are on one page because in practice they are the same job: knowing whether what you are building will hold, and being able to prove it.
Risk management
- Enterprise Risk Framework Design — Frameworks embedded into the operational rhythm, so risk awareness becomes part of how people work, not a quarterly procedure. The design follows the decisions the organisation actually makes.
- Regulatory Compliance — Compliance architecture built around obligations including VGRMF, VPDSF and ISO certification requirements. Obligation is mapped to control to evidence, so the attestation becomes a reporting exercise instead of an annual scramble.
- Cybersecurity & IT Risk — Advisory on data governance, cloud migration risk and technology change management. Technical exposure is translated into business consequence, so executives can price the decision.
- Business Continuity — Crisis management and continuity protocols that get designed, tested, and then revised in light of what the test actually revealed. Most plans are filed once they are approved and never touched again.
Quality assurance
- QA Framework Design — Standards that protect output quality without strangling delivery pace. Quality criteria are defined before work begins, when they can still be negotiated honestly.
- Technical Design Assurance — Independent review confirming that designs meet the requirement and will operate in the environment they are destined for. The review is against the obligation itself, which is a different exercise from comparing the design to the last one that happened to come past.
- Process Audit & Improvement — Structured audits that identify where quality actually leaks, delivered with a prioritised roadmap attached. An audit that changes nothing is an expensive way to feel assured.
Executive assurance
- Portfolio Risk Assurance — An independent view of delivery risk across the portfolio, reported in terms executives can act on. Heat-map colour is not one of those terms.
- Risk Culture & Capability — Training and embedding aimed at the people who make the decisions, not only at those who maintain the register, so that risk and quality practice outlives the engagement.
How an engagement runs
- Assess — Establish current framework maturity, control effectiveness and obligation coverage against evidence.
- Design — Build the framework, control set and quality standards around the decisions and obligations that matter.
- Embed — Install the operating rhythm, ownership and reporting that make the framework function day to day.
- Assure — Test independently, evidence the position, and keep the organisation audit-ready as a by-product.