Governance systems built to turn risk into decisions.
Focused ontechnology risk

Md. Abdullah Al Owasi · Technology Risk & AI Governance

Governance systems built to turn risk into decisions.

I design the operating logic behind technology risk, control assurance, third-party governance and AI risk: requirements, controls, evidence, ownership, exceptions, remediation, monitoring and residual-risk decisions. The portfolio is built so a reviewer can inspect how the reasoning works, not just read a list of frameworks.

NIST AI RMFISO/IEC 27001SOC 2 TSCISO/IEC 42001EU AI ActTPRMGDPR Art. 28
Inspect the governance architecture ↘Review portfolio ↗
Open to high-ownership opportunitiesTechnology GRC · Security Compliance · TPRM · AI Governanceabdullahalowasi369@gmail.com
Interactive operating modelTap any stage to inspect the decision lineage
→→→→→
Requirement: material obligation, risk expectation or business need.
01 / Executive value

Built around the decisions serious governance teams own.

Business value appears when evidence, ownership and risk treatment move together.

01

Customer assurance that can be defended

Structure security and compliance responses around approved evidence, accountable owners, review cadence and explicit exceptions so recurring diligence is consistent and inspectable.

02

Control assurance with an operating cadence

Connect control intent to evidence, testing, exceptions, remediation and retesting so assurance work can operate continuously instead of becoming a one-time audit exercise.

03

AI governance tied to real decisions

Translate AI inventories into risk classification, ownership, human oversight, evaluation, monitoring and transparency decisions using NIST AI RMF, ISO/IEC 42001 and EU AI Act concepts.

04

Third-party risk proportionate to exposure

Prioritize vendor scrutiny by criticality, data exposure, assurance evidence, processor obligations and residual risk rather than treating every questionnaire as equally material.

Risk score model
208Inherent Risk Score127Residual Risk Score
Availability
15/9
Privileged access
14/8
Shadow AI
15/10
Third-party AI
14/9
Article 50
12/8
Questionnaire accuracy
13/8
Vulnerability remediation
14/8
AI change governance
13/8
Privacy deletion
14/8
Logging
13/8
AI reliability
14/8
Continuity
15/9
Data retention
14/8
Subprocessor chain
14/9
Evidence freshness
14/9
Residual radar view15 sample risks

Open risks: 8 · Monitor risks: 7 · Inherent 208 → Residual 127.

Control coverage

Evidence coverage matrix

Assurance operations

Evidence cadence

A recurring assurance rhythm connects evidence freshness, exceptions and remediation decisions.

Framework crosswalk

One control, multiple lenses

02 / Architecture

Enterprise Assurance Evidence Fabric.

Integrated modules turn assurance, third-party risk and AI governance into traceable decision systems.

Control & evidence architecture

Enterprise Assurance Evidence Fabric

A control-to-evidence architecture that decomposes broad trust claims into accountable owners, reviewable evidence, framework references, exceptions and remediation decisions.

15Evidence domainsSOC 2 + ISOPrimary lensesTraceableOperating model
DomainDecision questionEvidence pathPriority
AccessCan privileged access be defended?RBAC · MFA · access reviewHigh
EncryptionIs customer data protected in transit and at rest?TLS · storage · KMS evidenceHigh
IncidentCan escalation and notification be evidenced?IR plan · exercise · notice flowHigh
AssuranceWhat independent or internal evidence supports the claim?SOC scope · ISO evidence · control recordHigh
Vendor risk decisioning

Third-Party Risk Decision Engine

A vendor-governance model that turns criticality, public assurance evidence, processor obligations and AI-provider risk into approve, remediate, accept or reject decisions.

10Vendors modeled20Risk questions4Decision states
DomainDecision questionEvidence pathPriority
OpenAITier 1Retention / model data-use configurationMedium
AWS BedrockTier 1IAM / KMS / region designLow-Med
SlackTier 1Sensitive collaboration data / appsMedium
GitHubTier 1Source code / secrets / AI toolingMedium
AI risk operations

AI Governance Decision Register

An enterprise AI inventory model connecting business purpose, stakeholders, oversight, NIST AI RMF functions, risk treatment, monitoring and EU AI Act transparency decisions.

15AI use cases15Transparency cases4RMF functions
DomainDecision questionEvidence pathPriority
Support chatbotEscalation requiredDisclosure / qualityImplement
Voice agentMaterial-issue escalationInteraction transparencyImplement
Code assistantDeveloper + CI reviewSecret / vulnerabilityControl
Risk summarizerCISO / GRC approvalRisk misstatementControl
AI risk & transparency matrixRisk exposure vs. human oversight
Risk exposure →Human oversight ↑

Tap a use case to inspect oversight and transparency evidence.

Portfolio domain mix10 systems
10
Assurance / GRC 4AI governance 3TPRM / risk 3
03 / Selected systems

Governance systems designed to withstand scrutiny.

Ten systems spanning assurance, technology risk, third-party risk and AI governance. Each shows the operating logic, evidence path, ownership model, exception state and decision structure behind the work.

Revenue-sensitive assurance

Assurance Architecture

Architects a governed path from buyer question to evidence, owner, exception and remediation decision.

SOC 2 TSC · ISO/IEC 27001:2022 · GDPR Art. 28
AI risk operations

AI Governance OS

Turns AI principles into an accountable inventory, risk model, oversight structure, evaluation plan and monitoring workflow.

NIST AI RMF 1.0 · NIST GenAI Profile · ISO/IEC 42001:2023
Vendor assurance

TPRM Decisioning

Creates an evidence-led approve / remediate / accept / reject decision trail for critical vendors and AI providers.

GDPR Art. 28 · SOC 2 · ISO/IEC 27001
Audit operations

Control Evidence

Connects control intent to evidence, cadence, ownership, test logic, exceptions and retesting.

AICPA Trust Services Criteria · ISO/IEC 27001:2022
Risk communication

Executive Risk

Translates control and compliance activity into accountable residual-risk decisions, treatment plans and KRIs.

ISO 27001 risk treatment · NIST AI RMF · Enterprise GRC
EU AI transparency

Article 50

Maps interactive and synthetic AI use cases to provider/deployer transparency, provenance, marking and disclosure decisions.

EU AI Act Article 50 · NIST AI RMF · ISO/IEC 42001
Data protection

Shadow AI DLP

Defines preventive and detective controls for sensitive-data exposure through unsanctioned or poorly governed AI use.

NIST GenAI Profile · ISO/IEC 27001 · ISO/IEC 42001
Customer trust operations

Security Triage

Standardizes high-friction security answers around governed evidence, ownership and review dates.

SOC 2 · ISO 27001 · GDPR · NIST AI RMF
Processor governance

Article 28

Converts processor and subprocessor obligations into operational controls, evidence requests and accountable decisions.

GDPR Article 28 · ISO 27001 supplier/privacy controls
Continuous assurance

Audit Operations

Structures evidence cadence, request ownership, exception tracking, remediation and retesting for repeatable assurance operations.

SOC 2 · ISO/IEC 27001 · Continuous GRC
← Scroll / Swipe →
04 / Capabilities

Capabilities connected to evidence.

Each capability points to a system, artifact, control model or decision structure that can be inspected and discussed in a technical interview.

Technology GRC

GRC & Compliance

Risk, controls, evidence, ownership, exceptions, remediation and assurance workflows.

Applied in · 10-system operating portfolio

SOC 2

GRC & Compliance

Trust Services Criteria translated into control, evidence, testing and assurance structures.

Applied in · 15-domain control inventory

ISO/IEC 27001

GRC & Compliance

ISMS control architecture, risk treatment, ownership and evidence mapping.

Applied in · Control-to-evidence architecture

Security Questionnaires

GRC & Compliance

Governed buyer answers with evidence paths, accountable owners and review cadence.

Applied in · 25-question assurance knowledge base

Control Testing

GRC & Compliance

Population/sample logic, expected results, exceptions, remediation and retesting.

Applied in · Audit-operations system

NIST AI RMF

AI Governance

Govern, Map, Measure and Manage applied to enterprise AI inventory and risk decisions.

Applied in · 15-use-case AI governance register

EU AI Act Article 50

AI Governance

Provider/deployer transparency analysis for interactive and synthetic AI use cases.

Applied in · 15-use-case transparency register

ISO/IEC 42001

AI Governance

AI management-system concepts integrated with accountability, risk and evidence workflows.

Applied in · AI governance operating architecture

AI Risk Registers

AI Governance

Purpose, data, stakeholder, oversight, evaluation, monitoring and residual-risk mapping.

Applied in · AI governance decision register

Shadow AI Governance

AI Governance

Approved channels, prompt classification, secret detection, redaction and unsanctioned-use controls.

Applied in · 12-control governance standard

Third-Party Risk

TPRM & Risk

Criticality tiering, evidence review, contractual risk, findings and treatment decisions.

Applied in · 10-vendor TPRM register

GDPR Article 28

TPRM & Risk

Processor instructions, subprocessors, assistance, deletion, audit rights and evidence requirements.

Applied in · 12-clause processor control set

Vendor Risk Assessments

TPRM & Risk

Evidence requests spanning assurance, IAM, cryptography, privacy, resilience and AI providers.

Applied in · 20-question vendor-risk assessment

Executive Risk

TPRM & Risk

Likelihood, impact, residual risk, appetite, treatment, KRI and escalation logic.

Applied in · 15-risk executive register

Python

Automation

Data transformation and repeatable artifact-generation workflows for governance and evidence operations.

Applied in · GRC evidence workbooks

TypeScript / React

Automation

Typed interfaces for decision systems, interactive evidence views and portfolio tooling.

Applied in · This portfolio

Next.js App Router

Automation

Static-first web architecture, metadata, accessibility and deployment discipline.

Applied in · This portfolio

Git / GitHub

Automation

Version control, change traceability, repository documentation and delivery workflow.

Applied in · Portfolio repository

Data Modeling / SQL

Automation

Structured thinking for evidence inventories, risk registers, ownership and relational decision data.

Applied in · Computer Science systems foundation + GRC systems

Systems Thinking

Automation

Technical foundation for decomposing governance problems into inputs, states, dependencies and decision logic.

Applied in · Computer Science systems foundation + operating portfolio
Capabilities · grouped swipe deck · Scroll / Swipe →
05 / Framework depth

Standards translated into operating logic.

Framework knowledge matters when it changes how controls are designed, evidence is collected, ownership is assigned, exceptions are handled and decisions are made.

Source-linked

NIST AI RMF 1.0

Govern, Map, Measure and Manage provide the primary risk lifecycle used across the AI inventory, oversight, evaluation and monitoring architecture.

Open primary source ↗Source-linked

ISO/IEC 27001:2022

ISMS requirements inform risk treatment, accountable control ownership, evidence structure and the relationship between governance intent and operating proof.

Open primary source ↗Source-linked

AICPA Trust Services Criteria

Security, availability, processing integrity, confidentiality and privacy criteria inform control-and-evidence structures used in customer assurance and audit operations.

Open primary source ↗Source-linked

EU AI Act Article 50

Transparency obligations guide deployer/provider decisions for interactive AI, synthetic media, generated text and disclosure contexts.

Open primary source ↗Source-linked

GDPR Article 28

Processor obligations are translated into subprocessor, audit-right, deletion, assistance, confidentiality and security-evidence requirements.

Open primary source ↗
Framework depth · interactive standard deck · Scroll / Swipe →
Direct conversation

I am open to high-ownership opportunities across Technology Risk, GRC, Security Compliance, Third-Party Risk and AI Governance. Send the role, business context and hardest unresolved risk question. My portfolio shows the architecture and decision logic I would bring to the conversation.

Direct path

Role, context, hard problem.

The fastest useful conversation starts with the mandate and the unresolved decision. The evidence behind the work is already available below.

Start the conversationReview resume
PortfolioGovernance architecture and case studiesExecutive PDFBoard-ready governance portfolioPresentationExecutive governance deckWorkbookDetailed controls, risks and evidence modelsEvidence matrixRequirement-to-evidence traceability
Direct conversation

Bring the governance problem that cannot stay ambiguous.

Open to high-ownership opportunities across Technology Risk, GRC, Security Compliance, TPRM and AI Governance.