The Challenge
Operational gaps across three Fleet Logistics Inspections (FLIs) in 15 months revealed systemic deficiencies in deck-plate assurance. The existing approach relied on position power rather than systematic controls, creating compliance gaps that couldn't be sustained through personnel changes.
The Core Problem
Traditional naval assurance relied on the person, not the process. When that person left, the controls failed. The challenge was to design transferable governance that worked independently of who was in the role.
Specific Challenges:
- Inspection failure pattern: Three FLIs in 15 months exposed recurring control weaknesses
- Compliance gaps: Significant deficiencies inherited from previous management
- Person-dependent controls: Assurance relied on individual expertise, not documented processes
- No governance framework: Royal Navy logistics assurance standards existed but lacked systematic implementation methodology
- Cultural resistance: Junior ratings not positioned as first-line risk owners in Three Lines Model
Strategic Context
Rather than treating this as a compliance remediation exercise, I recognised it as an opportunity to apply commercial governance frameworks to military logistics. The question was: could ISO governance standards, Lean Six Sigma, and Three Lines Model close the gap between policy and practice at the operational level?
Approach
Greenfield Continuous Improvement Strategy
Adopted a greenfield approach rather than attempting to fix inherited broken processes. This meant designing new control mechanisms from first principles, grounded in commercial governance standards and academic change management theory.
Power Model Selection: Expert & Referent Over Position
Applied French & Raven's power taxonomy strategically. Rather than relying on rank (position power), built influence through demonstrated expertise (expert power) and cultural engagement (referent power). This was critical for embedding change that would survive leadership turnover.
Integrated Governance Framework
Combined four complementary standards to create a comprehensive assurance system:
- ISO 42001 (AI Management): Governance for analytics dashboard and data-driven decision-making
- ISO 27001 (Information Security): Controls for financial data integrity and access management
- ISO 27701 (Privacy): Personnel data protection in performance tracking systems
- Lean Six Sigma Green Belt: Process efficiency, waste elimination, continuous improvement discipline
Mapped these frameworks against Royal Navy logistics assurance standards to demonstrate that commercial governance and military compliance were describing the same controls in different vocabularies.
Three Lines Model
Re-positioned deck-plate roles within the 3LoD model:
- 1st Line (Risk Ownership): Junior ratings as first-line risk owners, not just task executors
- 2nd Line (Oversight): NCO/SNCO layer providing policy guidance and exception management
- 3rd Line (Assurance): Fleet Logistics Inspection as independent verification mechanism
Change Management Theory
Grounded the transformation in academic organisational change frameworks to ensure sustainability beyond my tenure. This became the basis for MSc-level research validating the approach.
Implementation: Control Mechanisms
New Control Mechanisms Established
1. Standardised Loss Validation Routines
Designed systematic protocols for investigating and documenting inventory discrepancies. Moved from ad-hoc "find the lost item" efforts to structured root-cause analysis using 5 Whys and fishbone diagrams.
2. Voucher Assurance Controls
Created financial transaction verification processes: segregation of duties, approval hierarchies, and exception reporting thresholds designed to catch misallocation before it reaches the ledger.
3. Enterprise Analytics Dashboard
Co-designed custom dashboard providing real-time visibility into:
- Stock variance trends by category and location
- Financial liability exposure by account line
- Compliance status against logistics assurance requirements
- Control effectiveness metrics (detection rate, closure time, recurrence)
Related Finding
These same voucher-assurance principles apply directly to the £2.4M misallocated-expenditure finding on an adjacent account: transactions recorded against incorrect budget codes, a systemic control failure rather than fraud, creating both financial liability and inventory discrepancies.
Recovery in that case required coordinating with finance teams, validating actual usage, correcting ledger entries, and establishing preventive controls to stop recurrence.
Infrastructure Resilience Business Case
Drafted business case for infrastructure upgrades to support the new control environment. Demonstrated ROI through risk reduction, efficiency gains, and inspection readiness. Business case approved and funded.
Inspection Recovery
Outcome: Full compliance rating on subsequent Fleet Logistics Inspection. Inspection report noted the transformation from unsatisfactory to compliant and highlighted control mechanisms as transferable best practice.
Institutionalisation: Scaling Beyond the Individual
The critical test of any assurance framework is whether it survives the departure of the person who designed it. To institutionalise this transformation, I operated on three parallel tracks: policy adoption, academic validation, and divisional awareness.
1. Policy Adoption: Junior Ratings Empowerment Day
Designed and piloted "JR Empowerment Day" to reframe junior ratings, accountable for their own controls rather than only following senior direction, as 1st Line Risk Owners under the Three Lines Model.
Programme Structure:
- Explained 3LoD architecture in operational context (not corporate theory)
- Mapped daily tasks to control objectives (showed them they were already running controls)
- Taught exception escalation protocols (when to escalate vs. resolve locally)
- Demonstrated how their observations fed into risk management decisions
Cultural Shift: From "I'm told what to do" to "I own this process and escalate when control boundaries are breached."
Outcome: Initiative formally adopted as Departmental Policy. Now runs as standing programme, not one-off training event. This is the institutional lock-in: the cultural change is now policy-mandated and resourced.
2. Academic Validation: MSc Research
Validated the transformation academically through two MSc dissertations, ensuring the approach was grounded in peer-reviewed theory and reproducible by others:
MSc Organisational Leadership & Change:
- Research title: "Reframing Junior Ratings as First-Line Risk Owners: A Three Lines of Defence Cultural Change Model"
- Validated JR Empowerment Day using Kotter's 8-step change model and French & Raven's power taxonomy
- Demonstrated that expert and referent power were more effective than position power for embedding cultural change
- Produced transferable change management framework for similar military-to-civilian governance transitions
MSc Decision Support:
- Research focus: "Modularisation of Royal Navy Training Pipelines: Optimising Force Generation Through Decision Analytics"
- Analysed how training pipeline design impacts operational readiness and skills availability
- Developed decision support framework for balancing throughput, quality, and adaptability
- Findings applicable to corporate capability development and workforce planning
3. Divisional Awareness: GRC Skills Mapping
Presented integrated GRC/Lean Six Sigma skills-mapping to Engineering Support Group leadership. Demonstrated how naval logistics checks map directly to corporate GRC roles (compliance analyst, internal auditor, risk manager, quality assurance specialist).
Strategic Impact: This addresses the military-to-civilian transition gap. Service leavers can now articulate their experience in corporate governance language, and civilian employers can recognise the commercial value of military logistics discipline.
Outcomes
- Voucher Assurance Controls Established: Segregation of duties, approval hierarchies and exception reporting thresholds, the same control type behind the £2.4M finding on an adjacent account
- Unsatisfactory → Fully Compliant inspection rating: Fleet Logistics Inspection outcome transformed through systematic control design, not person-dependent effort
- 3 Fleet Logistics Inspections navigated in 15 months: High operational tempo provided multiple validation cycles for the new control framework
- Enterprise analytics dashboard operational: Real-time visibility into compliance status, financial exposure, and control effectiveness; scoped for wider fleet adoption
- Departmental policy adoption (JR Empowerment Day): Cultural change initiative embedded as standing programme, ensuring sustainability beyond individual tenure
- Two MSc dissertations: Academic validation of the transformation methodology, producing transferable frameworks
- Infrastructure resilience business case approved: Investment secured for system upgrades supporting the new control environment
- Divisional awareness established: Engineering Support Group leadership now recognises GRC/LSS skills as transferable to civilian roles
The Transferability Test
The true measure of success: when I departed the role, the controls continued to function. The subsequent FLI (conducted after my departure) maintained the Fully Compliant rating. This confirms the framework was process-driven, not person-dependent.
Civilian Relevance
Skills Demonstrated
Civilian Sector Applications
GRC Manager / Head of Compliance:
- Designing enterprise GRC frameworks integrating multiple standards (ISO, SOC 2, GDPR)
- Building Three Lines Model risk ownership that distributes accountability appropriately
- Establishing financial controls and audit trails that detect misallocation or fraud
- Creating policy that embeds cultural change, not just compliance checklists
Management Consultant (Governance & Process Improvement):
- Diagnosing where controls are person-dependent and designing transferable processes
- Applying academic change management theory to real-world transformations
- Integrating multiple governance frameworks into coherent operating models
- Delivering measurable ROI through risk reduction and efficiency gains
Supply Chain Assurance / Operational Risk:
- Designing inventory and financial reconciliation controls at enterprise scale
- Building analytics dashboards that surface variance patterns and control effectiveness
- Establishing loss validation routines and root-cause analysis disciplines
- Linking operational controls to regulatory requirements (sector-specific compliance)
The Translation Challenge This Project Solves
Military logistics professionals often struggle to translate their experience into civilian governance language. This project demonstrates that the skills are identical. Only the vocabulary differs:
- "Fleet Logistics Inspection" = Internal audit / regulatory inspection
- "Logistics assurance compliance" = ISO 9001 / sector-specific regulatory compliance
- "Voucher assurance" = Financial controls / SOX compliance
- "Stock variance protocol" = Inventory reconciliation / shrinkage management
- "Junior ratings as 1st Line Risk Owners" = Embedded control ownership / risk-aware culture
By mapping military assurance to ISO frameworks and the Three Lines Model, I've created a bridge that allows civilian employers to see the commercial value of Defence logistics expertise.
Inspection outcomes and control details drawn from official appraisal records and correspondence are described here in general terms only; no internal documents, other individuals, or classified detail are reproduced.