ABDULLAH AL OWASIAI governance review sprint
Bound the AI inventory, accountability, evaluation evidence, release criteria, transparency duties and post-deployment drift/change review. Outputs: system register, prioritized gaps and decision memo.
Professional profile / GRC · controls assurance · AI & agent governance
Assurance systems.
Accountable decisions.
GRC · Security Compliance · TPRM · Controls Assurance · AI & Agent Governance
Profile
I build decision-grade governance and assurance workflows across controls, suppliers, AI systems and audit evidence. Automation handles preparation where appropriate; evidence validity, control-effectiveness conclusions, exceptions, residual-risk decisions and sign-off remain explicitly accountable. The public portfolio is designed for inspection: source records, scoring logic, evidence states, human review gates, tests and decision outputs are visible rather than hidden behind static screenshots.
AI-assisted GRC operating model
My approach is deliberately post-checklist: delegate collection, drafting and cross-checking to automation; retain human ownership for scope, materiality, control effectiveness, risk acceptance and approval. The model extends into agent identity, tool/data authorization, evidence provenance, change review and ongoing monitoring.
External benchmark: grcskills.com ↗ documents 60 open agent skills for common GRC preparation tasks. I use that automation boundary as a reference point for where accountable assurance must begin.
What hiring teams can verify
- AI inventory and lifecycle governance, NIST AI RMF / NIST AI 600-1 mapping, human oversight, evaluation evidence and post-deployment drift/change review.
- Third-party and AI/LLM vendor risk across data use, training/retention terms, subprocessors, assurance evidence and dependency risk.
- Technology-risk prioritization, risk treatment, exceptions, ownership, KRIs and management decision trails.
- Audit readiness and continuous assurance: evidence freshness, control-test states, remediation ownership and retest.
- Clear operating boundaries: automation assists review; legal judgments, audit opinions and material risk acceptance remain human-owned.
- Agentic assurance patterns spanning identity and least privilege, evidence integrity/provenance, agent/tool/data authorization, change review and ongoing monitoring.
Public proof
Connected specialist workflows and the GRC suite share a consistent decision model, supported by a continuous GRC suite spanning 29 governance domains, 16 shared record types and catalogue-driven register/reporting views. Repository tests cover scoring, validation, interoperability and export safety; recorded workflow results link to exact commits.
The public scenarios use synthetic data and public reference taxonomies. Source records and calculation assumptions remain available for review.
Ways to work together
AI vendor & supplier assurance
Review SaaS, LLM and external AI vendors across data use, subprocessors, assurance evidence, dependency risk and treatment ownership. Outputs: reviewed register, evidence requests and remediation plan.
Continuous assurance review
Review evidence expiry, exceptions, open issues and retest ownership on an agreed cadence. Outputs: refreshed register, exception agenda and management summary.
Professional resume
Download resume (Markdown) ↓ · Use Print / save as PDF above for this profile.
Petaling Jaya, Malaysia · abdullahalowasi369@gmail.com
Verify before you decide.
Inspect recorded workflow results, exact commits, live decision mechanics and source repositories before evaluating fit.