About Provenance Risk Advisory

Provenance Risk Advisory LLC was founded by Trevor Kavanaugh, a 14-year veteran of regulated financial services who spent his career building risk programs from the inside out. This is not a firm that learned risk management from a textbook. It is a firm built by someone who has operated under regulatory scrutiny, managed vendor relationships at scale, and understands the difference between a control that looks good on paper and one that actually reduces risk.

Our governance-first philosophy means we design the framework before recommending tools. We build programs that identify their own issues before auditors do. At First Foundation Bank, the TPRM program Trevor built maintained an 80%+ self-identified finding rate, meaning the substantial majority of control gaps were found internally before examiners discovered them. That ratio is the clearest indicator of program maturity, and it is the standard we bring to every engagement.

We work with federal agencies navigating C-SCRM mandates and regulated institutions building or maturing third-party risk programs. Our approach is practical, operationally grounded, and built to survive the scrutiny that matters: not just the audit, but the incident.