Setting the PA/CE℠ for effective compliance.

Effective compliance.
From design to delivery.

Develop and implement effective compliance programs. Streamline document-heavy processes with automation, integrated risk assessment and coordinated workflows. Get experienced support from strategy through implementation.

Contact Steve Explore our expertise

Project-based and fractional AML and compliance leadership engagements available.

INTERNATIONAL COMPLIANCE AND RISK MANAGEMENT SERVICES

EFFECTIVE COMPLIANCE FROM DESIGN TO DELIVERY

PRACTICAL ADVICEDesignSound judgment. Clear direction.

CE CAPABILITIES THAT ENDURE

01 / PRACTICAL SOLUTIONSImplementPut people, controls & technology to work.

MonitorLearnAdapt

CONTINUOUS
IMPROVEMENT

Review results. Respond to change.

The ICRM PA/CE℠ Approach↗

THE ICRM APPROACH

The ICRM
PA/CE^℠ Approach

Practical Advice.
Capabilities that Endure.

Sound judgment.
Practical solutions.
Lasting capability.

Steve Marshall brings four decades of compliance and internal audit experience, including developing and implementing compliance programs and innovative technical solutions. ICRM connects that experience with the people, processes, controls and governance needed to make a program work in daily operations.

For financial institutions, that means practical support from program design through implementation and improvement. For technology companies, it means helping sell and implement document automation, risk engines and workflow orchestration that fit the client’s compliance needs.

PA / PRACTICAL ADVICE

Sound judgment.
A workable path forward.

Practical advice starts with understanding your risks, objectives and operating environment. It combines experienced judgment with evidence about your people, processes, data and technology—then turns that understanding into clear priorities and an achievable implementation path.

The test is whether your team can put the advice to work: who owns each action, what needs to change, how controls will operate and how you will know the changes are effective.

CE / CAPABILITIES THAT ENDURE

Built to adapt.
Equipped to remain effective.

Enduring capability is the ability to keep learning, changing and improving. As risks, regulatory expectations, business activities and technology evolve, your program and operating model must evolve with them.

ICRM helps establish the ownership, skills, data, governance and feedback needed to recognize change, reassess decisions and update controls and workflows. What endures is your organization’s ability to respond effectively—not a fixed set of processes or tools.

PA/CE IN PRACTICE

Effective programs.
Connected execution.

One approach applied to program development,
product design and technology implementation.

PA/CE connects the advice to the outcome. Practical Advice defines the risks, regulatory requirements and results that matter. Capabilities that Endure turns that direction into people, controls, products and workflows that work together—and adapt as conditions change. Our expertise in compliance programs and technology enablement puts this approach into practice.

01 / COMPLIANCE PROGRAMS

Develop. Implement. Improve.

Apply Practical Advice to build a compliance program around actual risk and the three objective categories in COSO’s Internal Control—Integrated Framework: effective and efficient operations, reliable reporting, and compliance with applicable laws and regulations. Steve’s program development, implementation and audit experience connects those objectives with practical policies, accountable ownership, staff capabilities and evidence that controls are working.

Technology is part of that control design. Automated validation, screening, risk rules, approvals and exception handling can perform preventive or detective control activities within the program. Their effectiveness depends on reliable data, appropriate configuration, access and change controls, human oversight and ongoing testing. Capabilities that Endure brings these elements together so the program and its technology can adapt as risks, requirements and business activities evolve.

Program development & implementationDesign the program around actual risk and put it into daily operation
Risk-based policies, controls & governanceConnect requirements to practical controls, accountable ownership and oversight
Training, rollout & effectiveness reviewEquip teams, support implementation and use review findings to improve

Explore program development & implementation

02 / TECHNOLOGY ENABLEMENT

From product design
to effective compliance.

Steve helps technology companies align product outcomes with regulatory requirements and the challenges clients face. Client collaboration maps establish what the client does now, what they want to achieve and what they need to resolve the underlying challenge. That shared understanding guides product development, solution positioning and consultative sales, then becomes the basis for a practical implementation scope.

AI implementation starts with a particular need: for example, extracting information from a defined document set, resolving a recurring review bottleneck or supporting a specific risk decision. ICRM helps select an appropriate use case, define success, preserve human review and integrate the solution into existing controls and workflows. Results guide refinement and any decision to expand.

Client collaboration mapsMap current practices, desired outcomes and the needs arising from specific client challenges
Regulatory alignment & product developmentTranslate requirements into intended outcomes, product capabilities and acceptance criteria
Consultative sales & solution alignmentConnect the client’s needs with product capabilities, demonstrate relevant outcomes and set realistic implementation expectations
Focused AI & document automationTarget a defined document or workflow need, with clear outcomes and appropriate human review
Screening & risk enginesConnect screening and assessment outputs with risk-based decisions and review
Workflow & program integrationImplement review, approvals and escalation within the control environment; test outcomes and improve

Explore product & implementation advisory

THE CONTROL FOUNDATION

Aligned with COSO.
Applied through PA/CE.

Connecting objectives, risk, controls
and evidence of effectiveness.

Steve’s experience in compliance program development, implementation, internal audit, data governance and technology oversight aligns with the five components of COSO’s Internal Control—Integrated Framework. PA/CE brings that integrated control perspective to practical decisions: define what needs to work, implement it, evaluate the results and adapt.

Control environment

Establish accountable ownership, clear roles, oversight and the skills to operate the program.

Risk assessment

Connect business and compliance objectives with customer, product, geographic and operational risks; reassess as conditions change.

Control activities

Translate requirements into policies, procedures and technology-enabled controls, including approvals, screening, exception handling and escalation.

Information and communication

Connect document processing, data quality, risk outputs and reporting so the right people have reliable information for decisions.

Monitoring activities

Use program assessments, audit, validation and ongoing review to identify weaknesses, track remediation and improve effectiveness.

The connection is practical: regulatory alignment and product design inform the controls; implementation puts them to work; monitoring and feedback keep the program and its technology responsive to change.

About COSO’s Internal Control—Integrated Framework

OUR EXPERTISE

From strategy
to working solutions.

Focused advice. Hands-on support.
Built around your priorities.

Compliance program development & implementation

Build effectiveness into the way you operate.

Develop and implement AML/CFT and sanctions compliance programs grounded in your actual risks. Connect risk assessment, policies, controls, customer due diligence, screening, monitoring, training and governance—and help teams put the program into daily operation.

Data quality & governance

Give decisions a dependable foundation.

Connect data ownership, quality and controls from initial collection through screening, monitoring and case decisions. Identify where data breaks down and establish practical remediation priorities.

Technology sales & implementation advisory

Connect the solution, the buyer and the operating model.

Help technology companies align product outcomes with regulatory requirements and client challenges. Use client collaboration maps to connect current practices, desired outcomes and specific needs—then support product development, consultative sales and focused implementation within the compliance program.

Document automation, risk & workflow

Move information from documents into decisions and action.

Start with a specific client challenge and implement a focused AI or automation use case. Connect document intake, classification or extraction with the risk decisions and workflow steps that need support. Define success, exception handling, human review and decision records before expanding the scope.

Model & system oversight

Apply rigor to the systems you rely on.

Support model risk frameworks, validation planning and effective challenge for financial crime systems. Evaluate the relationship between system design, data, configuration and ongoing performance.

Assessment & remediation

Find the gaps. Make the next steps clear.

Assess compliance programs and controls, investigate weaknesses and develop achievable remediation plans. Help teams prepare for independent review and respond to findings with clear ownership and evidence.

PA/CE IN DELIVERY

Assess the fit.
Connect the capability.

Two ways ICRM connects advice
with effective implementation.

01 / FEASIBILITY & READINESS

Build confidence before
committing to implementation.

Establish what works today, what needs to change and whether a proposed solution fits your operating model. Connect the assessment to a business case, an achievable plan and a clear management decision.

Your decision: proceed with a defined scope, address prerequisites or reconsider the solution.

Explore feasibility & readiness

PA / PRACTICAL ADVICE

Assess fitDefine changeDecide

Proceed · Resolve gaps · Reconsider

CE / CAPABILITIES THAT ENDURE

ImplementTest & launchMonitor
Learn · Adapt

02 / CUSTOMER RISK GOVERNANCE

Local execution.
Connected group oversight.

Connect customer risk methodology, ownership information, monitoring and review across the customer lifecycle. Help local teams operate within group standards while addressing jurisdictional requirements.

Your capability: a coherent view of customer risk, supported by explainable decisions and ongoing reassessment.

Explore customer risk architecture

ONE CONNECTED CONTROL ARCHITECTURE

Group governanceMethodology · Standards · Challenge

Local executionJurisdictional requirements · Controls · Decisions

Data & risk eventsCustomer information · Ownership · Monitoring

Explainable risk decisions. Shared oversight. Ongoing reassessment.

WHO WE HELP

Who this helps.
How we work together.

Bridging the people who manage risk
and the people who build the technology.

Develop the program.
Make it work in practice.

For banks, insurers and financial services organizations navigating financial crime risk, changing operations and technology decisions.

Develop and implement risk-based compliance programs
Turn policies into customer risk, screening and monitoring processes
Establish data controls, ownership, training and governance
Implement technology and assess ongoing program effectiveness

WHAT’S INVOLVED

Define the need.
Put the response to work.

Start with the challenge, your current practices and the outcome you need. ICRM helps establish priorities, agree a practical scope and support the work from design through implementation and ongoing improvement.

Depending on the engagement, deliverables may include a program or control design, a client collaboration map, an implementation roadmap, process and data requirements, training or an effectiveness review.

Find the right expertise

HOW TO START

Bring your challenge.
Start a conversation.

Whether you are developing a program, addressing a control weakness, evaluating technology or improving a document-heavy process, an initial conversation helps establish where ICRM can help.

Book 30 minutes with Steve or send a brief description of your needs. Together, we agree the scope, deliverables, responsibilities and commercial terms before work begins.

Book 30 minutes Contact Steve

Engagements are scoped to preserve appropriate independence across the first, second and third lines of defense.

HOW WE ENGAGE / FRACTIONAL LEADERSHIP

Fractional AML, compliance
& technology leadership.

Senior expertise. Ongoing involvement. Flexible capacity.

For organizations that need more than a project recommendation but do not need—or are not ready for—a full-time executive. Steve works as part of the leadership rhythm, helping carry priorities from decision through implementation, assurance and improvement.

Explore fractional AML and compliance leadership

01Fractional Head of Financial Crime CompliancePrioritized program roadmap 02Interim or Contract Compliance OfficerOfficer mandate and responsibility map 03Fractional Compliance Technology & Product LeaderRegulatory-to-product requirements matrix 04Independent Board AdvisorFinding, commitment and action map 05Fractional Compliance Audit ExecutiveRisk-based audit plan and scoping

EXPERIENCE THAT CONNECTS
THE BIG PICTURE TO THE DETAIL.

MEET STEVE MARSHALL

Deep experience.
Direct involvement.

Stephen D. Marshall
President, ICRM Services Inc.

Steve brings four decades of compliance and internal audit experience spanning financial institutions and consulting. His work connects financial crime risk management with the data, systems and processes needed to put a program into practice.

Earlier in his career, Steve served in an embedded contract compliance officer capacity for a new and rapidly growing bank, providing continuing compliance leadership during a period of significant expansion.

He later led an embedded advisory-services function for a financial-crime technology provider, connecting regulatory interpretation, product development, consultative sales, client delivery and industry education.

His experience includes developing and implementing compliance programs and innovative technical solutions, large-scale sanctions investigations, AML/CFT audits, model risk management and validation, customer due diligence, transaction monitoring and screening, and compliance training.

Through ICRM, Steve helps financial institutions develop and implement effective compliance programs. He also helps technology companies develop, sell and implement solutions whose intended outcomes align with regulatory requirements—integrating document automation, screening, risk engines and workflow orchestration into clients’ compliance programs.

Connect with Steve on LinkedIn

CASE STUDY / EMBEDDED ADVISORY LEADERSHIP

Connecting product capability
to client outcomes.

How an embedded advisory-services leader connected regulatory interpretation, product direction, consultative sales, client delivery and industry education for a financial-crime technology provider.

Explore the anonymized case study

TECHNOLOGY PROVIDERProduct & marketProduct direction
Consultative sales

Advisory leadershipCompliance + technology

CLIENT ORGANIZATIONProgram outcomesImplementation & controls
Evidence & oversight

PERSPECTIVES

Thinking beyond
the checklist.

Browse all articles & posts

Article · October 30, 2026

AI Should Mean Assisted Intelligence

Why AI should extend human capability while remaining subject to meaningful human control—and what that requires of governance, authority and accountability.

Read article 3 min ↗