Taking 24 unowned risks to full ownership and monthly reviews from 6 hours to 1

The challenge

This mid-sized financial services firm operates under Financial Conduct Authority oversight, and growing regulatory pressure alongside expanding operations had outgrown its compliance workflow, which still ran on spreadsheets and policy documents scattered across multiple repositories.

The risk register was inconsistently updated and needed constant hand-maintenance, creating compliance blind spots and audit vulnerabilities. Twenty-four risks in the register had no named owner at all, sitting untracked rather than actively managed.

With no central access to policy documentation and no actionable guidance readily available to staff, the compliance team was burning time on repetitive lookups and manual updates rather than higher-value risk analysis. The firm wanted to modernise all of this without losing its own terminology, tone and procedural logic. The system had to sound and behave like them, not like an off-the-shelf compliance tool.

Our approach

1. 01

   Extracting and structuring the compliance knowledge base

   We ingested the firm's FCA regulatory documentation and internal policy documents into a structured SharePoint Online knowledge base, tagged with metadata and kept current as guidance changes, replacing scattered repositories with one central source.

2. 02

   Replacing the spreadsheet with a live risk register

   We rebuilt the risk register as a structured SharePoint list acting as the single system of record, with ownership, review dates and version history captured against every risk rather than relying on manual spreadsheet maintenance.

3. 03

   Building AI risk-mapping agents

   We built AI agents, orchestrated through Power Automate, that dynamically map individual risks to the appropriate mitigations and controls, turning a static register into a living compliance framework that updates as risks and controls change.

4. 04

   Deploying the compliance dashboard

   We deployed a Power BI and Power Apps compliance dashboard surfacing real-time recommendations and assignments with clear ownership and accountability, made visible to staff directly in Microsoft Teams, and ran departmental training alongside the rollout.

5. 05

   Automating regulatory-change alerting

   We built Power Automate flows that push notifications when regulations change, attaching an impact assessment and recommended actions and routing them straight to the named risk owner, rather than compliance staff needing to monitor for changes manually.

6. 06

   Personalising tone and fine-tuning to internal workflows

   We tuned the agents to mirror the firm's internal language, tone and procedural logic, so outputs read as the firm's own work, then fine-tuned the whole system against the firm's real workflows before full handover.

The outcome

Monthly compliance review time has dropped by 83%, from around 6 hours down to 1, and weekly manual policy lookups have fallen from 30 to 5, an equivalent 83% reduction, freeing the compliance team from repetitive lookups and updates.

Mitigation coverage has risen from 58% to 94% of identified risks, and all 24 risks that previously had no named owner are now assigned and actively tracked, giving the firm full risk ownership across the register for the first time.

The firm now has a complete audit trail across every compliance element, with live FCA alignment that updates automatically as regulations change, and compliance resource that used to go toward routine maintenance has been redirected onto strategic risk work instead.