Work · All Frameworks & Reference Material
All frameworks & reference material
Frameworks informed by real operational problems and adapted into public, civilian-readable tools. The three most complete are Third-Party Risk, End to End, An Internal Audit, End to End and One Register, Every Supplier. All ten are here, and each links to the case study or framework that shows it in use. Each is a public reference framework that draws on published sources and my experience, and none reproduces an internal system, policy or procedure. For a curated view organised by theme, see Supply Chain Assurance and Third-Party Risk & Supplier Assurance.
Working tools
Methods with a working tool at each stage, for third-party risk, audit and supplier verification.
Third-Party Risk, End to End
A full supplier lifecycle methodology, from onboarding through segmentation, due diligence, contractual controls and monitoring to incident management, remediation and exit, with a working tool at every stage.
For third-party-risk and supplier-assurance teams: a lifecycle you can adopt stage by stage.
Related evidence: Closing Asset-Accountability Gaps
Open the framework →An Internal Audit, End to End
A full audit cycle worked against a fictional company: scoping, risk-based planning, control objectives, testing, evidence standards, graded findings, owned actions, follow-up and independent closure.
For internal audit and GRC teams: what a complete cycle looks like, from scoping to independent closure.
Related evidence: Restoring Control to a Failing Account
Open the demonstration →One Register, Every Supplier
The schema, a worked example across four risk tiers, and a downloadable blank template: the single document that ties onboarding, monitoring and remediation together into one live view.
For supplier-assurance leads: a working register with a blank template to start your own.
Related evidence: Building Fleet-Wide Inventory Visibility
Open the framework →OSINT Supplier Verification
A seven-stage open-source verification sequence for the case where a supplier's paperwork is complete, its certifications are valid, and something has stopped adding up. Runs from corporate structure through to synthesis, with a confidence grading key and the legal constraints it operates under.
For due-diligence and procurement teams: verifying a supplier whose paperwork is complete.
Related evidence: Identifying £2.4M in Misallocated Funds
Open the framework →Demonstrations and reference material
Tables that translate defence logistics roles into the language civilian assurance functions use.
Same Control, Two Vocabularies
Nine things military logisticians do every week, described in the language a civilian assurance function would use, mapped against ISO 27001, ISO 19011, COSO and the Three Lines Model. Built for service leavers who cannot name what they have already been doing.
For recruiters and hiring managers: reading defence logistics experience in assurance terms.
Related evidence: Recovering a Non-Compliant Account at NATO SHAPE
Open the table →Independently Verified Skills Mapping
Royal Navy role descriptions, rank by rank, mapped against public civilian control frameworks: Logistics checked against my own service, Engineering, Warfare and Healthcare & Medical mapped and open for correction.
For service leavers and employers: a role-by-role skills mapping checked against public civilian frameworks.
Related evidence: Restoring Control to a Failing Account
Open the table →Thought leadership and specialist models
Papers and specialist models that extend the working tools.
Supplier Concentration Risk: Measuring It Tier by Tier
Why supplier count is the wrong diversification metric, a concentration index adapted from antitrust practice, and what a high score actually means for a risk register.
For supplier-assurance and procurement risk teams: how to measure the concentration that a supplier count hides.
Related evidence: Third-Party Risk, End to End (framework)
Read the paper →The Physical Assurance Gap in Third-Party Risk
Two 2026 KPMG surveys map where third-party risk management is putting its attention: data, AI, managed services. Physical verification barely appears in either, and the people already doing it have never been told that it counts.
For third-party-risk professionals: finding the physical dependencies that registers miss.
Related evidence: Closing Asset-Accountability Gaps
Read the paper →The Three Lines of Defence: From Warships to AI
The Royal Navy's four-tier logistics assurance model mapped against ISO/IEC 42001 AI governance: Supersession, Minimum Viable Bureaucracy, and why assurance is what gives command the confidence to deploy. Presented to the Global Skill Development Council.
For AI governance and assurance leaders: military assurance mapped to ISO/IEC 42001.
Related evidence: Modernising Assurance Across Inspections
Open the framework →Change Management in a Rank Hierarchy
Lewin, Kotter and ADKAR applied to a culture-change intervention I designed and ran for junior sailors, measured with real before/after survey data, including exactly where the models predicted the hierarchy would pull back.
For culture-change and leadership practitioners: Lewin, Kotter and ADKAR applied in a real rank hierarchy.
Related evidence: Modernising Assurance Across Inspections
Open the framework →Get in touch
If any of these frameworks are relevant to a role you're hiring for, I'd welcome a conversation now.
Request the Full CV: email your name, organisation and the role you're exploring, and I'll send it directly.