Need help with IT risk, an audit or due diligence?

How we can help

Six kinds of work. Pick the one that matches your situation, or ask us and we will suggest where to start.

1. IT audit support for financial statement audits

   Your external auditors have sent IT requests, want IT general controls tested, or found IT issues last year that need fixing before this year's audit.

   See what’s included

   Scope

   Access, change, operations and backup controls for the systems behind the financial statements, for the audit period.

   Records

   User lists and access reviews, records of people joining, changing role and leaving, change tickets and approvals, job monitoring, backup logs and restore tests.

   Result

   Controls documented and tested in the form auditors expect, the gaps we identified with recommended actions, and support in responding to the external auditor's IT questions.

2. IT and cyber risk assessment

   You have a risk register or a list of worries and need to know which risks are real, which controls behind them work and what to do first.

   See what’s included

   Scope

   Selected systems, data and business dependencies: identity and access, cloud configuration, change, backup and recovery, incident readiness.

   Records

   Risk registers, architecture and data-flow diagrams, asset lists, security settings and the records that show each control operating.

   Result

   A ranked list of risks with the control gaps behind them and practical actions, plus a risk register you can keep using.

3. Technology due diligence for private equity, acquisitions and investments

   You are buying or investing in a business and need to understand its technology and security gaps, its dependencies and what will need fixing, before the deal.

   See what’s included

   Scope

   The target's core systems, cloud and infrastructure, security controls, data and privacy obligations, key technology vendors and contracts, and the team that runs them.

   Records

   Management interviews, architecture and asset records, security settings and reports, incident history, vendor agreements and any prior audits or certifications.

   Result

   A plain-language report of the technology and security gaps, the dependencies and remediation needs we identified, priorities for the first months of ownership and questions to settle before closing.

4. Vendor and customer risk reviews

   A critical vendor holds your data or runs your service and you cannot see how well it is protected, or a customer is asking you detailed security questions.

   See what’s included

   Scope

   Critical vendors and technology dependencies, their data flows, access and shared responsibilities; or your own answers to a customer's security questionnaire.

   Records

   Vendor inventories, due-diligence files, SOC 2 or ISO reports, agreements, access records and your own policies and control records.

   Result

   A review of each vendor's risk and open questions, or complete and defensible answers to the customer's questionnaire with the records behind them.

5. Cloud, access and backup reviews

   Cloud accounts grew faster than the rules for them, too many people have access, old accounts linger, and nobody has tested a restore.

   See what’s included

   Scope

   Selected cloud accounts and systems: ownership, configuration, logging, human and service identities, privileged access, backup schedules and recovery.

   Records

   Configuration and identity exports, role grants, privileged-account records, authentication settings, change approvals, backup logs and restore tests.

   Result

   Findings with the affected resources and accounts, the fix for each and, where you want it, help carrying the fixes out.

6. DMV data privacy and MOU compliance reviews

   Your organization receives driver or vehicle record data from a state motor vehicle agency under an agreement (an MOU or similar) and must show the data is only used, stored and shared as that agreement allows.

   See what’s included

   Scope

   How the data is requested, accessed, used, stored, shared, retained and deleted, and the policies, training and audit trails your agreement requires. Requirements differ by state and agreement, so we confirm them with you first.

   Records

   The agreement and the agency's requirements, access and query logs, user lists and training records, data handling policies, retention and deletion evidence, and any prior audit or self-certification.

   Result

   A gap list against your agreement's requirements, help closing the gaps, and documentation ready for an agency audit or self-certification. We do not speak for the agency and cannot guarantee its approval.