Dr Christopher Whittle
Senior Advisor
Enterprise Risk, Governance & ESG
Home/About
The firm
About FalconryTrust
FalconryTrust is the cyber, privacy and digital trust proposition of Falconry — delivered on Falconry360, our connected governance platform, by practitioners who held these roles inside regulated Gulf institutions before they advised on them.
- THE PROPOSITION
- FalconryTrust — cyber, privacy and digital trust
- THE PLATFORM
- Falconry360 — one connected system of record
- THE FIRM
- Falconry — a Gulf firm across five registered markets
- THE PROMISE
- Create value. Protect trust. Transform with confidence.
Why a firm in this region is named after falconry
A trained falcon is built, not caged. Then it is flown.
Falconry is the oldest form of partnership between people and something powerful enough to be dangerous. It is a craft of patient construction — the bird is developed, conditioned and eventually trusted with complete independence, and the relationship holds because the groundwork was done properly. Nothing about it is restraint for its own sake.
That is the argument we make about governance. A control environment built only to prevent loss is treated as a cost and eventually cut. One built so the organisation can move faster becomes something the business defends. Creation and protection are the same act performed over time, which is why our promise across the firm is to create value, protect trust and transform with confidence.
WHERE THE WORK LANDS
Every engagement ends in a room like this.
A board or a risk committee, a set of decisions that need taking, and a question about whether the organisation can move without losing something it cannot afford to lose.
Strategy, resilience and growth are not three separate agendas. They are the same conversation, and digital trust is the part of it most boards are least equipped to interrogate. Our job is to put the exposure, the options and the cost in terms the room can actually act on — in dollars, with the assumptions visible and open to challenge.
What the platform puts in front of a board · Exposure expressed in financial terms
Where this comes from
Built by people who have been the client, in this region, under these regulators.
Falconry was founded by practitioners who held senior risk and resilience roles inside sovereign investment institutions and regulated groups across the Gulf, after careers in the international professional services firms. The platform exists because the tools available were built for other regulatory environments and mapped to this one afterwards — which is why they handle ISO well and the national regimes badly.
The distinction that matters commercially: we are a Gulf firm, not a firm with a Gulf office. A Saudi institution contracting with a registered Saudi entity, advised by people who have sat on its side of the table, is a different proposition from a head office elsewhere with a regional sales function.
FalconryTrust is one of the propositions built on Falconry360. Clients running corporate governance and enterprise risk alongside cyber see one architecture, one control library and one evidence base — not two systems and an integration project.
The work, without the logos
We do not publish client names. These are real engagements, described at the level our clients are comfortable with — and we will make introductions under NDA where a prospect needs them.
BANKING · OMAN
A licensed Omani bank
Cyber and technology risk governance aligned to Central Bank of Oman expectations, with the control environment, evidence routines and board reporting held in one place rather than rebuilt for each examination cycle.
- ENGAGEMENT
- Advisory, then platform
- REGULATOR
- Central Bank of Oman
- STATUS
- Live
ENERGY · OMAN
An Omani fuel distribution and retail group
Technology and operational risk across a corporate estate and a distributed physical network, with third-party dependency and continuity treated as one picture rather than three registers.
- ENGAGEMENT
- Advisory and implementation
- SCOPE
- IT, OT and third-party
- STATUS
- Live
REAL ESTATE & HOSPITALITY · KSA
A Tadawul-listed Saudi group
Governance and delegation of authority work for a listed group, extending into the cyber and technology risk perimeter that CMA and NCA expectations place on Saudi market participants.
- ENGAGEMENT
- Advisory
- REGULATOR
- CMA and NCA scope
- STATUS
- Live
RETAINED LEADERSHIP
Five virtual CISO mandates
Retained security leadership across five organisations in the region — board reporting, regulator engagement, programme direction and incident leadership, with the work configured into the client's own tenant so it survives the retainer.
- MANDATES
- 5 active
- MARKETS
- GCC
- MODEL
- 2–8 days per month
PRIVACY OFFICE
Three virtual DPO mandates
A privacy office operated across several regimes at once — records of processing, rights handling against statutory clocks, transfer registers and breach workflow, with the independence of the role preserved in writing.
- MANDATES
- 3 active
- REGIMES
- GCC PDPL and UK GDPR
- MODEL
- Retained
PLATFORM DELIVERY
Ten-plus implementations across the region
Falconry360 implementations across banking, energy, government-linked, professional services and listed corporates — control libraries, regulatory packs, evidence automation and role-based reporting.
- IMPLEMENTATIONS
- 10+
- MARKETS
- Oman, UAE, KSA
- STATUS
- Live and in delivery
What we will not do. We do not publish invented percentages, unattributable benefit claims or case studies our clients have not read. Where a number appears on this site it is either ours to state or clearly labelled illustrative.
Board and leadership
Imran Sadiq
Founder and Managing Director
Two decades advising boards, risk committees and shareholders across Gulf sovereign ecosystems. Previously Director, Risk and Resilience at a sovereign investment group and Head of Risk and Business Continuity at a sovereign wealth fund, after senior roles at two of the international professional services firms. CISM, MBCI, INSEAD Director's Leadership Programme.
Board composition
Governance of the firm
Falconry Ltd is governed by its board, with the Managing Director accountable for the practice. Further appointments are published as they are made.
How we are structured
Five registered markets
Registered entities in Saudi Arabia, the United Arab Emirates, Oman, Qatar and the United Kingdom. Bahrain and Kuwait are served from our registered Gulf entities. Commercials are quoted in USD and invoiced locally where the contracting entity requires it.
Leadership & Team
Advisors, engagement leaders and practice specialists in one view. The people shaping the proposition are also the people clients meet, challenge and work with.
Marwan AlKhouli
Senior Advisor GRC,
Digital Operations & Banking Transformation
Abdullah al Mukrami
Senior Advisor Assurance,
Financial Transformation & Governance
Imran Sadiq
Managing Director
Saad Bin Tariq
Director
GRC, Digital Solutions & Enterprise Resilience
Amine El Haimar
Principal
Risk Quantification & Scenario Modelling
Waqas Haseeb
Director
Cyber, IT GRC & Technology Assurance
Uzair Aman
Director
GRC Advisory & Controls Transformation
Muhammad Kakira
Manager
Advisory Delivery & Financial Analysis
Fatima Naseem
Manager
Strategy, Partnerships & Brand
Musawar Mustafa
Chief Technology Officer
Arvind Kumar Umedani
Director, Assurance & Financial Governance
Scott Whittlesea
Director
Investment Risk & Compliance Technology
Josh Deakin
Advisor
Hamad Khanzada
Chief Commercial Officer
Jireih James Williams
Platform Delivery Associate
How we work
Four positions we hold to, including when they cost us the engagement.
- Advisory first, platform second. If the engagement in front of you does not need Falconry360, we will say so. The consulting work has to be worth doing on its own terms.
- Stated scope. We do not provide offensive security, penetration testing or red teaming, and we do not operate a security operations centre. We work alongside the providers who do and govern the outcomes.
- Claims we can evidence. No framework counts we cannot substantiate, no certifications we do not hold, no benefit figures we cannot show you the working for, and no entity we have not registered.
- Accountability stays with you. Managed services run the routine. Risk acceptance, appetite and regulatory positions remain your officers' decisions, and where a regulator requires a named officer, that officer is yours.