Following a regulatory examination, the firm received a formal requirement to remediate a set of risk and control gaps within an aggressive timeline. The board had been briefed and was watching closely — the program needed to be credible from day one.
There was no existing program infrastructure. Scope shifted repeatedly as new findings emerged, internal stakeholders disagreed on ownership, and the regulator's expectations were only partially specified. The program had to remain executable regardless of what moved.