Governance architect
In most large banks, regulations, policies, risks, controls and evidence each live with a different team, in a different system, under a different taxonomy. I build the line that connects them: a new way of working for risk and control functions, shared by the first line, the second line and internal audit. 20+ years doing it at Goldman Sachs, Morgan Stanley, Moody's, MUFG, Wells Fargo, BNY Mellon and American Express.
300+
regulations mapped into one tracker at Wells Fargo
2
firmwide Codes of Conduct authored, at Goldman Sachs and BNY Mellon
40,000+
controls rationalized with NLP at BNY Mellon, cutting duplication by about 15%
The problem
At a global systemically important bank, staying compliant is split across functions that rarely share a data model. Each one does its job well, in its own system and its own taxonomy. The failures happen in the gaps between them.
Regulatory compliance
Keeps the inventory of obligations.
Policy office
Writes, approves and attests the policies.
Operational risk
Owns the risk taxonomy and the RCSA.
Controls and testing
Designs, tests and certifies the controls.
Risk reporting
Tracks indicators and loss events.
Audit and issues
Logs findings and tracks remediation.
So when an examiner asks how a rule is met, the answer takes weeks of spreadsheets, meetings and reconciliation. When a rule changes, no one can say quickly which policies, controls and evidence it touches. And when something breaks, each function can show its own piece was in order.
Not another system and not another committee. One line, from rule to proof, that every function works from and keeps current.
Every link from regulation to evidence is connected, so a question about any one of them can be answered from all the others.
Each function keeps its own tools. The chain maps between their taxonomies, so nothing has to be rebuilt to be seen.
A regulation with no control, or a control with no evidence, appears as a broken link on your own map before it appears in an exam finding.
Built for all three lines of defense
Today each line builds its own map of the same risks. With the chain, the first line, the second line and internal audit work from one structure. Each keeps its own role and its independence. None has to rebuild the map.
First line
See which obligations each control carries, what breaks if it fails, and which indicators and evidence prove it works.
Second line
Trace every regulation through policy and risk to the controls that meet it, and challenge coverage gaps and single points of failure with one view.
Third line
Test the same chain end to end, trace any obligation to its evidence in minutes, and send findings back in as control weaknesses with owners.
Eight links that cross every function's boundary. When a control fails, the chain shows which link gave way, which team held it, and what would have held.
Open the full methodPublic enforcement events mapped link by link, broken links in red.
Every case and shared thread as one network you can explore or download.
Run 1,000 events through a chain and see where it gives way.
Top down, a graph underneath, and a loop back from every failed test.
The same eight links, applied domain by domain. Because every chain shares one structure, a control that serves several risk types is recorded once and seen by every team that relies on it.
EU AI Act, NIST AI RMF, SR 11-7, NYC Local Law 144 and state AI laws, traced to evidence.
10 regulations · 14 requirements
From outsourcing rules to the vendor evidence that proves oversight.
14 laws · 7 jurisdictions
Employment law across the US, UK, EU, India, Australia, Canada and Singapore, including AI in hiring.
27 regulations · 6 groups
Privacy, security and records rules mapped to the controls that satisfy them.
7 scenarios
APP scams, account takeover, synthetic identity, deepfakes, insider and conduct risk.
How a change in processing or technology flows back through the chain.
Built to run in a single file, in the browser, with nothing to install. The stress test is live on the method page.
Which banks and card networks let outside AI agents into customer accounts, who carries the loss, and the controls that follow.
Query every case in SQL, right in your browser: where chains break, which controls fail, and which rules share them.
Severity, containment and scrutiny as levers. A teaching model, not a forecast.
The chain schema and controlled tag vocabulary, to be published openly.
Trying to connect compliance, risk and controls data that lives in separate teams and systems? I'd enjoy comparing notes.