Governance systems built to turn risk into decisions.
Focused on
technology risk

Md. Abdullah Al Owasi · Technology Risk & AI Governance

Governance systems built to turn risk into decisions.

I design the operating logic behind technology risk, control assurance, third-party governance and AI risk: requirements, controls, evidence, ownership, exceptions, remediation, monitoring and residual-risk decisions. The portfolio is built so a reviewer can inspect how the reasoning works, not just read a list of frameworks.

NIST AI RMFISO/IEC 27001SOC 2 TSCISO/IEC 42001EU AI ActTPRM
Inspect the governance architectureReview portfolio
Open to high-ownership opportunitiesTechnology GRC · Security Compliance · TPRM · AI Governance abdullahalowasi369@gmail.com
Governance portfolioInspectable

0

governance systems designed from requirement to decision

0

AI use cases mapped across risk, oversight and transparency

0

buyer-diligence questions connected to evidence paths

0

vendor-risk questions structured for criticality and evidence

Signature operating model

Requirement → control → evidence → exception → residual risk → decision.

Business value

Builtaroundthedecisionsseriousgovernanceteamsown.

Customer assurance, control operations, technology risk, third-party governance and AI risk all converge on the same problem: turn requirements into evidence-backed decisions that technical and business stakeholders can act on.

Trust operations

Customer assurance that can be defended

Structure security and compliance responses around approved evidence, accountable owners, review cadence and explicit exceptions so recurring diligence is consistent and inspectable.

GRC operations

Control assurance with an operating cadence

Connect control intent to evidence, testing, exceptions, remediation and retesting so assurance work can operate continuously instead of becoming a one-time audit exercise.

AI risk

AI governance tied to real decisions

Translate AI inventories into risk classification, ownership, human oversight, evaluation, monitoring and transparency decisions using NIST AI RMF, ISO/IEC 42001 and EU AI Act concepts.

TPRM

Third-party risk proportionate to exposure

Prioritize vendor scrutiny by criticality, data exposure, assurance evidence, processor obligations and residual risk rather than treating every questionnaire as equally material.

Interactive evidence lineage

Follow a requirement until someone owns the decision.

Select any stage to inspect what changes upstream and what it enables downstream.

01 / 06

Requirement

Material obligation, risk expectation or business need.

Executive telemetry
Decision coverage

Control / evidence domains

0/15

Mapped

AI governance use cases

0/15

Mapped

Buyer diligence paths

0/25

Traceable

Vendor-risk questions

0/20

Structured
10systems

Portfolio topology

Depth across three governance surfaces.

Assurance / GRC4
AI governance3
TPRM / risk3
Executive risk model

Inherent Risk Score

51

Residual Risk Score

26

Inherent vs residual by decision line
Availability15 / 9
Privileged access14 / 8
Data exposure12 / 5
Third-party vendor10 / 4

Residual radar view

Open: 2Monitor: 2

Risk metrics evaluated continuously based on executive governance thresholds.

Architecture

Oneevidencearchitecture.Threeenterpriserisksurfaces.

Customer assurance, third-party risk and AI governance are treated as connected operating problems. Each layer follows the same discipline: requirement → control → evidence → exception → residual risk → decision.

Integrated modules

Layer 01 · Control & evidence architecture

Enterprise Assurance Evidence Fabric

A control-to-evidence architecture that decomposes broad trust claims into accountable owners, reviewable evidence, framework references, exceptions and remediation decisions.

15

Evidence domains

SOC 2 + ISO

Primary lenses

Traceable

Operating model

Evidence preview
Swipe / scroll horizontally on narrow screens →
DomainDecision questionEvidence pathPriority
AccessCan privileged access be defended?RBAC · MFA · access reviewHigh
EncryptionIs customer data protected in transit and at rest?TLS · storage · KMS evidenceHigh
IncidentCan escalation and notification be evidenced?IR plan · exercise · notice flowHigh
AssuranceWhat independent or internal evidence supports the claim?SOC scope · ISO evidence · control recordHigh
Evidence owner
Review cadence
Framework crosswalk
Exception state
Remediation owner
Open portfolioDownload evidence workbook
Executive telemetry
Decision coverage

Control / evidence domains

0/15

Mapped

AI governance use cases

0/15

Mapped

Buyer diligence paths

0/25

Traceable

Vendor-risk questions

0/20

Structured

Selected systems

Governancesystemsdesignedtowithstandscrutiny.

Ten systems spanning assurance, technology risk, third-party risk and AI governance. Each shows the operating logic, evidence path, ownership model, exception state and decision structure behind the work.

Filter
10 Governance Systems · horizontal evidence track Scroll / Swipe

Capabilities

Capabilitiesconnectedtoevidence.

Each capability points to a system, artifact, control model or decision structure that can be inspected and discussed in a technical interview.

Capabilities · grouped swipe deck Scroll / Swipe

Technology GRC

GRC & Compliance

Risk, controls, evidence, ownership, exceptions, remediation and assurance workflows.

Applied in · 10-system operating portfolio

SOC 2

GRC & Compliance

Trust Services Criteria translated into control, evidence, testing and assurance structures.

Applied in · 15-domain control inventory

ISO/IEC 27001

GRC & Compliance

ISMS control architecture, risk treatment, ownership and evidence mapping.

Applied in · Control-to-evidence architecture

Security Questionnaires

GRC & Compliance

Governed buyer answers with evidence paths, accountable owners and review cadence.

Applied in · 25-question assurance knowledge base

Control Testing

GRC & Compliance

Population/sample logic, expected results, exceptions, remediation and retesting.

Applied in · Audit-operations system

NIST AI RMF

AI Governance

Govern, Map, Measure and Manage applied to enterprise AI inventory and risk decisions.

Applied in · 15-use-case AI governance register

EU AI Act Article 50

AI Governance

Provider/deployer transparency analysis for interactive and synthetic AI use cases.

Applied in · 15-use-case transparency register

ISO/IEC 42001

AI Governance

AI management-system concepts integrated with accountability, risk and evidence workflows.

Applied in · AI governance operating architecture

AI Risk Registers

AI Governance

Purpose, data, stakeholder, oversight, evaluation, monitoring and residual-risk mapping.

Applied in · AI governance decision register

Shadow AI Governance

AI Governance

Approved channels, prompt classification, secret detection, redaction and unsanctioned-use controls.

Applied in · 12-control governance standard

Third-Party Risk

TPRM & Risk

Criticality tiering, evidence review, contractual risk, findings and treatment decisions.

Applied in · 10-vendor TPRM register

GDPR Article 28

TPRM & Risk

Processor instructions, subprocessors, assistance, deletion, audit rights and evidence requirements.

Applied in · 12-clause processor control set

Vendor Risk Assessments

TPRM & Risk

Evidence requests spanning assurance, IAM, cryptography, privacy, resilience and AI providers.

Applied in · 20-question vendor-risk assessment

Executive Risk

TPRM & Risk

Likelihood, impact, residual risk, appetite, treatment, KRI and escalation logic.

Applied in · 15-risk executive register

Python

Automation & Technical Systems

Data transformation and repeatable artifact-generation workflows for governance and evidence operations.

Applied in · GRC evidence workbooks

TypeScript / React

Automation & Technical Systems

Typed interfaces for decision systems, interactive evidence views and portfolio tooling.

Applied in · This portfolio

Next.js App Router

Automation & Technical Systems

Static-first web architecture, metadata, accessibility and deployment discipline.

Applied in · This portfolio

Git / GitHub

Automation & Technical Systems

Version control, change traceability, repository documentation and delivery workflow.

Applied in · Portfolio repository

Data Modeling / SQL

Automation & Technical Systems

Structured thinking for evidence inventories, risk registers, ownership and relational decision data.

Applied in · Computer Science systems foundation + GRC systems

Systems Thinking

Automation & Technical Systems

Technical foundation for decomposing governance problems into inputs, states, dependencies and decision logic.

Applied in · Computer Science systems foundation + operating portfolio

05 / Operating thesis

Governanceearnsitsvaluewhenitchangesdecisions.

My operating thesis is simple: material requirements need accountable controls; controls need evidence; exceptions need treatment; residual risk needs a decision owner. The portfolio applies that logic across assurance, third-party risk and AI governance.

Operating principle

Evidence must survive challenge.

I design governance work so every important claim can be traced to a requirement, control, evidence path, accountable owner, exception state and decision. The objective is not documentation volume; it is decision quality under scrutiny.

Evidence architectureControl assuranceDecision quality

Enterprise assurance

Trust becomes valuable when it is operational.

Customer diligence, audits and executive risk reporting should draw from the same governed evidence system. That reduces contradiction, clarifies ownership and creates a cleaner path from security claim to business decision.

SOC 2ISO 27001Customer trust

AI governance

AI risk needs operating mechanics, not principles alone.

My AI governance work connects inventory, purpose, data, stakeholders, human oversight, evaluation, monitoring, transparency and residual risk so governance produces decisions rather than policy theatre.

NIST AI RMFEU AI ActISO 42001

Technical foundation

Computer Science · SEGi University

Bachelor of Computer Science (Hons) — AI & Cybersecurity Specialization at SEGi University. This technical foundation strengthens governance architecture through software engineering, data structures, databases, automation and disciplined decomposition of complex technical problems.

Computer ScienceSystems thinkingAutomation

06 / Framework depth

Standardstranslatedintooperatinglogic.

Framework knowledge matters when it changes how controls are designed, evidence is collected, ownership is assigned, exceptions are handled and decisions are made. These are the primary lenses behind the portfolio architecture.

Primary-source links are attached so the framework basis can be inspected directly.
Source-linked
Framework depth · interactive standard deck Scroll / Swipe
AI risk management
Core operating lens

NIST AI RMF 1.0

Govern, Map, Measure and Manage provide the primary risk lifecycle used across the AI inventory, oversight, evaluation and monitoring architecture.

Applied in the architecture

GovernMapMeasureManage
Information security
Control architecture

ISO/IEC 27001:2022

ISMS requirements inform risk treatment, accountable control ownership, evidence structure and the relationship between governance intent and operating proof.

Applied in the architecture

ISMS contextRisk treatmentAnnex A
SOC 2 assurance
Assurance criteria

AICPA Trust Services Criteria

Security, availability, processing integrity, confidentiality and privacy criteria inform control-and-evidence structures used in customer assurance and audit operations.

Applied in the architecture

Common criteriaLogical accessChange management
AI transparency
Applicable from 2 Aug 2026

EU AI Act · Article 50

Provider and deployer transparency obligations are translated into applicability, interaction disclosure, synthetic-content marking and communication decisions for relevant AI use cases.

Applied in the architecture

Interaction disclosureContent markingDeployer notice
Processor governance
Third-party control lens

GDPR · Article 28

Processor and subprocessor obligations drive DPA evidence requests, assistance duties, deletion/return controls, audit rights and vendor-governance decision points.

Applied in the architecture

Documented instructionsSubprocessorsAudit & deletion
AI management system
AI management lens

ISO/IEC 42001:2023

AI management-system requirements inform accountability, risk/opportunity management, governance structure and continual-improvement patterns across the AI operating model.

Applied in the architecture

AI policyAccountabilityContinual improvement

Direct conversation

Bringthegovernanceproblemthatcannotstayambiguous.

I am open to high-ownership opportunities across Technology Risk, GRC, Security Compliance, Third-Party Risk and AI Governance. Send the role, business context and hardest unresolved risk question. My portfolio shows the architecture and decision logic I would bring to the conversation.

Direct path

Role, context, hard problem.

The fastest useful conversation starts with the mandate and the unresolved risk decision. The evidence behind the work is already available below.

Start the conversationReview resume

Best-fit mandate

Technology Risk · GRC · Security Compliance · TPRM · AI Governance

Control-to-evidence architecture · TPRM decisioning · AI risk operations

Kuala Lumpur, Malaysia · open to remote and relocation discussions

Portfolio, resume and evidence workbooks available now

PortfolioGovernance architecture and case studiesExecutive PDFBoard-ready governance portfolioPresentationExecutive governance deckWorkbookDetailed controls, risks and evidence modelsEvidence matrixRequirement-to-evidence traceability