Compliance · SHEQ · Information Security
I’m Christopher Young — a compliance professional with over 25 years across ICT, information security, SHEQ and facilities. I hold the disciplines that usually take a team of specialists, joined by one consistent method and grounded in the technical detail — so what I build is proportionate, practical, and made to work in practice, not just to pass an audit.
Twenty-five years at the point where technical detail meets regulatory obligation — each discipline building on the last.
I started in software engineering and database administration inside a regulated financial-services organisation, moved into leading its IT and information-security function, and then into SHEQ. That path is unusual, and it’s the point.
Most compliance professionals audit from a checklist. I secure systems I actually understand, protect data flows I can see, and stay grounded in the operational reality I’m asking people to work within. The result is compliance built to work rather than built to pass — proportionate to the real risk, and sustainable once I’ve gone.
Since 2014 I’ve progressed from Quality & Compliance Manager to Head of SHEQ, building multi-framework management systems across three very different business units — while concurrently holding named statutory accountability as GDP Responsible Person, Data Protection Officer, designated Food Safety Manager and fire safety duty-holder.
One method, every discipline
Policy, risk assessment, audit, review, corrective action — applied consistently across every discipline, whether or not it carries a certificate.
Appointed competent person under the Management of Health & Safety at Work Regulations 1999. Risk-assessment programmes across manufacturing, refurbishment and warehousing — manual handling, work at height, DSE, and contractor control through permit-to-work and induction — with incident investigation, RIDDOR reporting and a chaired safety committee.
Fire safety duty-holder in a high-hazard environment where soldering and chemical ignition risks meet high-density stock. Fire risk assessments to PAS 79-1:2020 and the Regulatory Reform (Fire Safety) Order 2005, warden training and drills, detection and suppression oversight, hot-works permits, and liaison with insurers and the fire authority.
A certified quality system maintained across three very different operations — contract electronics manufacturing, rework & refurbishment, and eCommerce logistics. IPC-standard build quality and component traceability, fault rectification to manufacturer spec, functional test and cosmetic grading, and returns handling — with CAPA, document control and management review throughout.
Designated Food Safety Manager discharging Food Business Operator obligations under the Food Safety Act 1990 and retained EU Regulation 852/2004. A documented HACCP system with food-defence controls — VACCP and TACCP — against fraud and deliberate contamination, backed by regular audit and staff-competency checks.
Statutory Responsible Person under MHRA GDP guidelines for the compliant storage and distribution of human medicines across every sales channel. GDP quality system, controlled storage conditions and deviation reporting, maintained to the Cogent Gold Standard.
Improvement embedded through built-in review cycles rather than one-off exercises — Lean, Six Sigma and 5S applied to process and product quality, with root-cause analysis used to fix causes rather than symptoms.
Aspects, impacts and legal registers maintained in line with ISO 14001, with consumption monitoring, incident reporting and sustainability embedded into the supply chain — delivered through process modernisation and behavioural change rather than headline initiatives.
A structured multi-stream segregation system covering WEEE, chemical and process waste, and commercial streams, with all waste-transfer activity and documentation held to the Environmental Protection Act 1990 and the Hazardous Waste Regulations 2005.
All facilities across a single multi-operation site — a planned-preventative-maintenance programme covering building fabric and M&E, plus statutory duties including legionella, the asbestos register and fixed-wire testing. Contractor procurement through structured tender and review, utilities, security and space planning, and capital fit-out projects led end to end.
Continuity and resilience planning aligned to ISO 22301 and ISO 31000 risk management — identifying what the business depends on, what threatens it, and the proportionate controls that keep it running.
Data Protection Officer maintaining the Records of Processing Activities and running DPIAs for new systems and processing. Subject Access Requests, breach identification and ICO reporting, retention schedules, privacy notices and processor agreements — kept compliant with UK GDPR, the Data Protection Act 2018 and PECR.
Ownership of the information-security policy and cyber framework — network security, access control, endpoint protection, patch and vulnerability management, and awareness training. Cyber Essentials certification led in-house, alongside client-facing security assessments meeting contractual and regulatory obligations.
Risk assessment, audit and inspection used as diagnostic tools — data and root-cause analysis to find where systems genuinely work and where they need strengthening, then fix the cause rather than the symptom.
Clear policies, SOPs and work instructions sized to the actual risk. One consistent management-system method across every discipline, so each meets a defined standard whether or not it carries formal certification.
Equally at home in the boardroom and on the shop floor. Compliance embedded in how people already work, with review cycles built in — so it holds up after the consultant has left, not just on audit day.
Built and embedded one consistent policy–risk–audit–review–CAPA method across three distinct business units — contract electronics manufacturing, rework & refurbishment, and eCommerce logistics — so quality, safety, environmental, food, GDP, waste, data protection and IT security each meet a defined standard under a single, coherent system.
Held concurrent statutory accountability for two demanding regulated regimes — human medicines as MHRA GDP Responsible Person, and human foodstuffs as designated Food Safety Manager — each with its own quality system, storage and traceability controls, deviation reporting and audit programme, run side by side without either slipping.
Designed and built a multi-site web platform from the ground up — the site you’re reading now runs on it. Evidence that the technical half of my background is current and hands-on: I build, secure and maintain the systems I’m accountable for, rather than reviewing them from a distance.
Get in touch
Whether it’s a management system that needs to hold up, a framework to certify against, or a second opinion from someone who understands the technical detail — I’d be glad to talk it through.