Senior Governance, Risk & Compliance Professional
Risk, made clear enough to act on.
I turn frameworks like NIST CSF 2.0 and ISO/IEC 27001 into controls teams own, evidence auditors trust and reporting boards can decide on.
About
Senior GRC professional with seven years of experience building and running risk-based governance, compliance and third-party risk programs across financial services, logistics and healthcare-adjacent environments.
I translate frameworks such as NIST CSF 2.0, ISO/IEC 27001:2022, COSO and SOC 2 into practical controls, policies and audit-ready evidence. As an Executive MBA holder, I pair control expertise with business acumen, presenting risk posture to boards and executive committees in clear, decision-ready terms.
Bilingual in English and French, I have supported cross-border and multi-regulator programs.
Experience
From testing controls to leading an enterprise GRC program — each role built on the evidence, reporting and relationships of the last.
Selected work
A few of the initiatives I have led, and what changed because of them.
ISO 27001Certification
Led the organization through certification against the 2022 standard, from scoping and Statement of Applicability to internal audit and the certification audit itself.
GV.SCThird-party risk
Tiered 300+ vendors by criticality so due diligence effort matched real exposure, with clear questionnaires, SOC report review and contract security clauses.
ID.RARisk management
Built a single register of 250+ risks across 14 business units with owners, KRIs and treatment plans, reported quarterly to the Board Risk Committee.
GV.OVGRC automation
Moved control testing, evidence collection and policy attestation out of spreadsheets and into a GRC platform that audit teams could rely on.
Core competencies
Governance, risk, compliance, third parties and resilience — designed to work as one program rather than five separate checklists.
Policy & standards lifecycle, GRC program design, board & committee reporting, KRIs/KPIs, RACI and control ownership.
Enterprise & IT risk assessment, risk registers, risk appetite & tolerance, quantitative and qualitative analysis, risk treatment plans.
Control design & testing, internal and external audit coordination, gap assessments, remediation tracking, evidence management.
Vendor due diligence, security questionnaires, SOC report review, contract security clauses, ongoing monitoring.
Business continuity & DR planning, incident response governance, data protection (GDPR, Ghana Data Protection Act 2012).
Building and mentoring GRC teams, annual audit and assessment planning, bilingual (English/French) stakeholder engagement.
Codes reference the matching NIST CSF 2.0 function or category.
Education & credentials
A political science foundation, an executive business degree, and hands-on GRC training.
Kwame Nkrumah University of Science and Technology (KNUST), Kumasi, Ghana
University of Ghana, Legon, Ghana
Schnell Academy, including an end-to-end GRC capstone for a logistics organization.
From the blog
Practical notes on governance, risk and compliance — frameworks, third-party risk, audits and talking about risk with the people who decide.
A framework only works when every outcome has a named owner, a control that delivers it, and evidence that shows it ran. Here is the approach I use.
Read article →: Turning NIST CSF 2.0 into controls people actually ownSending the same 300-question questionnaire to every vendor wastes everyone's time. Tiering by criticality is how we halved due-diligence cycle time.
Read article →: Third-party risk: why tiering your vendors comes firstBoards do not need a heat map with fifty dots. They need to know what changed, whether it is within appetite, and what decision is being asked of them.
Read article →: How to talk about risk so a board can decideContact
Open to senior GRC roles, advisory work and speaking about governance, third-party risk and board reporting — in English or French.
Send an email