Services that turn technology risk into a plan.

From IT audit advisory to AI governance and team training, each engagement is scoped to your systems, your regulators, and your timeline.

Our work is advisory. We don't perform financial statement audits or provide attest services.

Introduction

Boards, executives, and risk leaders face a steady stream of new technology and new expectations. Our seven practice areas are built to work together.

A weak­ness found in IT, cy­ber­se­cu­ri­ty, or AI test­ing feeds your risk as­sess­ment. Your risk as­sess­ment shapes your GRC pro­gram. Vendor re­views, pri­va­cy as­sess­ments, and AI gov­er­nance sharp­en both. Training keeps all of it run­ning after we've gone. Start with one ser­vice or com­bine sev­er­al.

  1. Control testing
  2. Risk assessment
  3. GRC program
  4. Vendor and AI oversight
  5. Training

IT & Cybersecurity Audit Advisory

Know which controls work before an auditor, an examiner, or an attacker finds out.

The challenge

Financial re­port­ing, cus­tomer trans­ac­tions, and daily op­er­a­tions all de­pend on sys­tems doing what man­age­ment be­lieves they do. Most con­trol fail­ures are quiet. An ac­cess re­view gets rub­ber-stamped. A change reach­es pro­duc­tion with­out ap­proval. A cloud set­ting drifts from its base­line. Often the first per­son to no­tice is an ex­ter­nal au­di­tor, an ex­am­in­er, or an at­tack­er, and by then the fix is ur­gent and ex­pen­sive.

How we help

We plan and carry out IT audit and cy­ber­se­cu­ri­ty work the way an ex­pe­ri­enced in­ter­nal audit team would. Before we test any­thing, we learn the busi­ness process, the sys­tems that carry it, and what a fail­ure would cost. That shapes the scope, so the hours go to real ex­po­sure rather than to what­ev­er is eas­i­est to test.

Services

Good fit if your in­ter­nal audit team needs IT audit ca­pac­i­ty or spe­cial­ist depth, man­age­ment wants an ob­jec­tive read on IT con­trols be­fore year-end test­ing, or your board wants to know whether se­cu­ri­ty spend­ing is work­ing.

Explore IT & Cybersecurity Audit Advisory

Governance, Risk & Compliance

Risks with owners. Policies people follow. Issues that close.

The challenge

Most or­ga­ni­za­tions have the poli­cies, the frame­works, and the risk reg­is­ter. The trou­ble is fol­low-through. Registers go stale. Policies no longer match how the busi­ness runs. Vendors hold sen­si­tive data under re­views no­body has re­vis­it­ed. Then a cus­tomer asks for a SOC 2 re­port or an ex­am­in­er asks a sim­ple ques­tion, and no­body can an­swer it with ev­i­dence.

How we help

We con­nect what your gov­er­nance doc­u­ments promise to what your teams ac­tu­al­ly do. That starts with risk. We as­sess IT, cy­ber­se­cu­ri­ty, and cloud risk sep­a­rate­ly, be­cause each has dif­fer­ent own­ers and dif­fer­ent ev­i­dence, then rate every risk against an ap­petite your lead­ers have agreed and record who owns it.

Services

Good fit if your risk, com­pli­ance, and audit teams keep sep­a­rate lists, your ven­dors haven't been re­viewed since on­board­ing, or a cus­tomer has asked for a SOC 2 re­port you don't have yet.

Explore Governance, Risk & Compliance

AI Governance

Adopt AI at the pace your business needs, with oversight you can defend.

The challenge

AI is al­ready in­side your or­ga­ni­za­tion. Some came through ap­proved projects. Some ar­rived in a ven­dor's lat­est re­lease. Some is run­ning in an em­ploy­ee's brows­er right now. Each use rais­es ques­tions about data, se­cu­ri­ty, ac­count­abil­i­ty, and human judg­ment, and reg­u­la­tors, cus­tomers, and boards have start­ed ask­ing them.

How we help

Governance starts with three an­swers: where AI is in use, what risk each use cre­ates, and who is ac­count­able for the out­come. We build the in­ven­to­ry and in­take process that pro­duces those an­swers, then de­sign over­sight sized to the stakes. A tool that sum­ma­rizes meet­ing notes doesn't need the scruti­ny of a model that in­flu­ences cred­it, claims, or hir­ing de­ci­sions.

Services

Good fit if AI tools are al­ready in use and no­body can say ex­act­ly where, who ap­proved them, or what data they touch.

Explore AI Governance

AI Risk, Security, and Audit

Know how your AI can fail before someone else finds out.

The challenge

Many or­ga­ni­za­tions now have an AI pol­i­cy and an AI com­mit­tee. Far fewer can show that each use case was as­sessed for risk, that sen­si­tive data stays where it be­longs, or that some­one acted when a model's be­hav­ior changed. AI also opens new ways in. A craft­ed prompt can pull data out of a chat­bot. An AI agent can end up with more ac­cess than any em­ploy­ee. Internal audit teams are being asked to cover all of this with meth­ods built for tra­di­tion­al sys­tems, and audit com­mit­tees want an­swers they can rely on.

How we help

Policies de­scribe what should hap­pen. We test what ac­tu­al­ly does. We as­sess AI risk use case by use case, re­view the se­cu­ri­ty con­trols around your AI, and audit whether your gov­er­nance works in prac­tice. You can start with any one of the three.

Services

Good fit if your audit com­mit­tee wants AI in the audit plan, your se­cu­ri­ty team has ques­tions about AI tools it didn't choose, or your AI gov­er­nance pro­gram has been run­ning for a year and no­body has checked whether it works.

Explore AI Risk, Security, and Audit

Data Privacy

Know what you collect. Keep the promises you make.

The challenge

Ask most or­ga­ni­za­tions what per­son­al data they hold, where it lives, and which ven­dors re­ceive it, and the hon­est an­swer is a par­tial one. The pri­va­cy no­tice on the web­site makes promis­es the sys­tems were never built to keep. State pri­va­cy laws keep mul­ti­ply­ing, cus­tomer ques­tion­naires get sharp­er every year, and new AI tools pull per­son­al data into places no­body mapped.

How we help

We start with the data. Working with your busi­ness, IT, and legal teams, we map what per­son­al in­for­ma­tion you col­lect, why you col­lect it, where it's stored, who can reach it, which ven­dors re­ceive it, and how long you keep it. That map be­comes the base for every pri­va­cy de­ci­sion that fol­lows.

Services

Good fit if you can't say for cer­tain where your cus­tomers' per­son­al data goes, or a new law, con­tract, or AI project has raised pri­va­cy ques­tions you can't yet an­swer.

Explore Data Privacy

Forensic Accounting & Fraud Risk

Careful analysis. Traceable evidence. Defensible conclusions.

The challenge

A dis­crep­an­cy rais­es ques­tions, and guess­ing at the an­swers is ex­pen­sive. Modern fraud al­most al­ways runs through sys­tems: ac­cess some­one shouldn't have, an ap­proval limit no­body en­forces, a con­trol that looks sound on paper and never fires.

How we help

We ex­am­ine the trans­ac­tions, records, ap­provals, and sys­tem ac­cess around an ir­reg­u­lar­i­ty, and we keep doc­u­ment­ed fact, as­sump­tion, and open ques­tion apart at every step. For each trans­ac­tion, we ask whether it served a le­git­i­mate busi­ness pur­pose, whether the sup­port­ing records hold up, and whether ev­i­dence from an­oth­er source con­firms the ex­pla­na­tion.

Services

Good fit if some­thing in the num­bers doesn't add up, or your audit com­mit­tee wants an out­side view of fraud risk.

Explore Forensic Accounting & Fraud Risk

Professional Training

Build the skills inside your team.

The challenge

Frameworks and stan­dards only work when your peo­ple can apply them. Hiring for every skill gap isn't re­al­is­tic, and gener­ic cours­es rarely match the sys­tems your team ac­tu­al­ly runs.

How we help

Our pro­grams give your peo­ple the skills to test con­trols, in­ter­pret stan­dards, and make risk-based de­ci­sions long after we've gone. Sessions are built around your sys­tems and frame­works, with ex­er­cis­es drawn from real sit­u­a­tions and tem­plates your team can reuse the next day.

Services

Good fit if you want your own peo­ple, not out­side con­sul­tants, to carry the work for­ward.

Explore Professional Training

Ways to work with us

Project engagements

A defined scope, timeline, and deliverable, such as an IT review, an AI governance build, or a remediation plan.

Advisory support

Ongoing access to senior guidance as your program, systems, and regulators change.

Audit capacity support

Added hands and specialist skill for your internal audit or risk team, working under your direction.

Training programs

Workshops and cohorts for your team, delivered on a schedule that suits you.

How we engage

  1. Discovery

    A short call to understand your situation.

  2. Scoping

    A written scope with deliverables, timing, and fees.

  3. Delivery

    Regular check-ins and findings you can read in one sitting.

  4. Follow-up

    A review of progress, plus support for what comes next.

Common questions

Are you a CPA firm?

No. We're a risk and tech­nol­o­gy ad­vi­so­ry firm. We don't per­form fi­nan­cial state­ment au­dits or issue audit opin­ions.

Can you help us prepare for SOC 2 or a similar report?

Yes, on the readi­ness side: gap as­sess­ment, con­trol de­sign, and ev­i­dence prepa­ra­tion. The re­port it­self must come from a li­censed CPA firm.

Do you work with our internal and external auditors?

Yes. We co­or­di­nate with in­ter­nal audit, your ex­ter­nal au­di­tors, and your com­pli­ance team so work isn't du­pli­cat­ed.

How long does an engagement take?

It de­pends on scope. After a scop­ing call, you'll get a time­line in writ­ing.

What size organizations do you work with?

Mid-mar­ket and en­ter­prise or­ga­ni­za­tions across in­dus­tries.

Will you keep our information confidential?

Yes. We'll sign an NDA be­fore you share sen­si­tive de­tails.

Can you assess an AI program you helped design?

No. We don't audit or as­sess an AI pro­gram, sys­tem, or use case we de­signed for the same client. If an en­gage­ment would cross that line, we'll tell you dur­ing scop­ing.

Is this legal advice?

No. We sup­port reg­u­la­to­ry align­ment from a risk and con­trols per­spec­tive. For legal ques­tions, work with coun­sel.

Not sure which service fits?

Describe the problem. We'll tell you where to start.

Talk to an Advisor