For security leaders without a full-time GRC lead
A GRC lead for programs that don’t need a full-time one.
I run your policies, risk register, exception queue, and audit prep a few days a month, so findings get owned before the auditor arrives.
Your call is with Glenn, author of The GRC Exception Handbook · CISSP, CISM, CISA
What I find first
Programs rarely get audit findings because they lack a framework. They get them where no one owns the work: risks accepted with no end date, issues reopened under new ticket numbers, and aging items no one can see.
That is not a documentation problem. It is an operating problem, so I look at the program as it runs, not as the policy says it should.
The exception queue shows it fastest:
One issue opened three times, three ticket numbers, no one sure which record is true.
An action plan that restates the problem and names no owner.
A risk accepted for ninety days, then ninety more, for three years.
Chronic items never surface because the dashboard shows only this week’s opens.
In the first year of fixing similar issues at a large SaaS company, I cut open findings 42%, SLA breaches 35%, and repeat issues 28%. The policy did not get stricter. Every exception had an owner, an expiry date, and a recorded residual risk.
Three ways to work with me
1. Program Assessment: Start here
A fixed-fee review of policies, risk register, exception queue, and audit readiness. You get a findings report you own.
$6,500-$9,000 · 2-4 weeks
See what’s in the assessment →
2. Process Build
I design the lifecycle, documentation standard, review cadence, and aging view that make chronic items impossible to hide. Then I train the person who owns the program. The deliverable is built to survive my absence.
Fixed fee - Scoped to findings
See how a build works →
3. Fractional GRC Lead
A set block of hours each month. I can help with policy reviews, the risk register, exception decisions, and audit prep. Month-to-month.
Monthly rate depending on scope
See how a Fractional GRC Lead works →