A practitioner-led practice for governance, risk, and operational resilience. Knowledge, templates, and advisory built from twenty years of running enterprise programs, not from a framework binder.
PivotRisk exists because most of what gets written about GRC and operational resilience focuses on frameworks, certifications, and compliance checklists. That's useful, but it's not where programs actually fail or succeed.
Programs fail because of ownership gaps, unclear escalation paths, governance structures that don't reflect how the organization actually makes decisions, and testing programs that validate process without validating capability. Those failure modes show up everywhere, at organizations ranging from a 200-person SaaS startup to a $3B global infrastructure provider, and fixing them is the work this practice was built around.
PivotRisk puts that experience into a form that's useful to working practitioners: articles that are specific rather than generic, templates that were built for real programs rather than invented for a product page, and advisory work that starts with how your organization actually operates rather than how a framework says it should.
The operating model is where the practice spends the most time, because it's where most of the leverage is. You can have the right framework, the right tools, and a capable team, and still underperform if the governance structure doesn't work. Getting that right is usually more valuable than any technology investment or framework upgrade.
The PivotRisk Operating Model is a public, interactive map of what a GRC and resilience function must be able to do, from governance through detection, response, recovery, and assurance. Operating model design engagements start from it and are tailored from there, so you can inspect the starting point before any work begins.
Explore the Operating ModelPivotRisk is run by a practitioner who is still in the seat: more than twenty years building governance, risk, continuity, and security programs across global fintech, SaaS, and enterprise technology.
Every article, template, and engagement on this site comes from programs personally built, run, or repaired. That is the point of the practice: advice that can show its work.