Twenty-five years in financial services technology risk — eleven in Big 4 advisory at PwC and EY, and nearly a decade reporting technology risk to the executive and board committees of one of Canada’s five largest banks. Hosmak Solutions brings that standard to firms that need it without the institutional price tag.
Credentials
Why firms call us
All of these are manageable. Most are considerably cheaper to handle before the finding lands than after.
Services
Control frameworks, risk appetite and key risk indicators, issue management, and third-party risk processes that hold up when someone asks for the evidence. Built on COBIT and COSO, sized for your organization — not a bank’s program handed to a firm of twelve.
Learn more about technology governance, risk and complianceYour organization is adopting AI faster than anyone has written rules for it. We build the governance layer that lets you keep moving: AI usage policies, model risk management frameworks, AI vendor due diligence, and the oversight routines your board and your regulator will eventually ask to see.
Learn more about AI governance, risk and compliance advisoryIndependent review of your IT general controls, application controls, access management, change management, and SDLC processes — delivered as support to your internal audit function or as a standalone review for management. You get findings ranked by what actually matters and a remediation plan your team can work through.
Learn more about internal controls and IT audit reviewWhy Hosmak
Eleven years at PwC and EY leading technology governance assessments, IT risk assessments, SOX 404 and ICFR engagements, and controls design and operating-effectiveness reviews across a portfolio of financial services clients — more than fifty engagements in total.
Nearly a decade inside one of Canada’s five largest banks building enterprise technology risk governance from the ground up: the Technology Process, Risk and Control framework, the risk appetite statement and KRI suite, the issue management dashboard, and the independent challenge of remediation owners across all three lines of defense.
Designing and presenting the technology risk packages that went to executive and board-level risk committees — which means knowing not just what good governance looks like, but what it has to look like when a director is reading it.
Working together
Thirty minutes, no cost, no obligation. You describe the pressure you’re under. We tell you plainly whether we’re the right fit and what a sensible scope looks like.
Written scope, deliverables, timeline and fee before any work starts. No open-ended hourly arrangements that drift.
You get working documents you own and can maintain, not a locked PDF. We walk your team through everything before we close the file.
Free resource
The AI & model governance readiness checklist turns the six things a regulated client’s reviewer is trying to establish into a self-assessment you can complete in under an hour — twenty-six items, a scoring guide, and a short plan for the gaps it finds. Free, and yours to circulate internally.
Insights
Most small-firm risk appetite statements have never stopped anyone doing anything. What makes one operable — position, boundary, consequence — with a worked one-page example.
Read the article: Risk appetite statements for organizations too small to have a risk functionOSFI’s revised Guideline E-23 takes effect in May 2027, and it makes institutions accountable for models they didn’t build. The evidentiary burden lands on the vendors who did.
Read the article: Your client's model risk rules are about to become your problem: E-23 for vendorsA spreadsheet arrives with two hundred questions and a fourteen-day deadline, and someone tells you it’s a formality. It isn’t — but it also isn’t the test most vendors think it is.
Read the article: What a bank actually looks for when it sends you a technology due diligence questionnaireThe firm
FCA (Nigeria) — see designation note · CISA · CRISC · AAIR · CFSA
Bunmi has spent twenty-five years in financial services technology risk — first auditing and advising financial institutions at Coopers & Lybrand, PwC and EY across Lagos, Vancouver and Toronto, then building and managing technology risk governance functions at one of Canada’s five largest banks. He founded Hosmak Solutions to bring institutional-grade governance to the firms that need it most and can least easily buy it.
I started this firm to help small and medium-sized financial institutions strengthen their Technology Governance and Risk Management practices. By leveraging Artificial Intelligence and industry experience, I help organizations build, enhance, and sustain effective governance and risk management programs that support growth, resilience, and regulatory compliance.
More about the firmMost engagements begin with a conversation about what’s actually being asked of you. Bring the questionnaire, the audit finding, or the board question — we’ll tell you what it would take to answer it properly.
Book a 30-minute consultationOr email hello@hosmaksolutions.ca
