How we work
When policies, system settings and day-to-day practice do not line up, you need to understand the gap. We help implement controls or independently review them, using records and testing to explain findings and practical next steps.
Two kinds of work
Four stages
Assess, test, report, recommend. Select a stage in the diagram to see what happens in it; the inputs and who decides at each stage are in the optional detail below.
Example
Understand the workflow and risks, identify relevant systems and records, and plan the period and depth of testing.
You receive: A scope memo, assessment plan and evidence request list.
See the sample deliverableInspect records, test selected samples and investigate exceptions. Separate what the policy requires, how the control is configured and how it operated.
You receive: Procedure records, evidence references, sample results, exceptions and explicit evidence gaps.
See the sample deliverableDevelop findings, discuss factual accuracy with evidence owners and document the basis and limits of each conclusion.
You receive: A scoped report with classified findings, evidence references and limitations.
See the sample deliverableDevelop practical recommendations, distinguish immediate evidence needs from control changes and discuss next steps in a closing readout.
You receive: Prioritized recommendations and suggested owners for management consideration.
See the sample deliverableA written policy, a configured control and a record of successful operation answer different questions. We do not turn self-report or a completed checklist into a tested control conclusion. Evidence gaps and observed failures are also distinguished: missing records may limit a conclusion without establishing what happened.
Whether the stated control could address the identified risk if performed as intended.
Fictional example — A release policy requires an independent reviewer before production deployment; we evaluate the rule and its coverage, not assume it was followed.
Whether the control has been put in place in the environment reviewed.
Fictional example — Inspection shows a required review gate configured for the selected repository; configuration alone does not demonstrate its operation throughout the period.
Whether the control worked as intended for the period and sample actually tested.
Fictional example — Sampled releases show the required approval before deployment; the conclusion is limited to those procedures, records and samples.
The necessary evidence is missing, inaccessible or insufficient to answer the control question.
Fictional example — Approval history is unavailable for a selected release; we cannot conclude that approval occurred, even if the policy requires it.
Preparation and review
Our team uses its own tools to organize evidence and draft analysis; a qualified professional reviews every file before it reaches you.
Technology we useFictional example excerpts only
Short fictional excerpts that show the structure of a scope statement, an evidence request and a finding. Nothing here is client evidence.
Company names and figures are invented.
Excerpt · Scope statement
Review approval and release controls for one AI-assisted routing application during a fictional one-month period. Inspect the release policy and repository gate configuration, then compare selected approval timestamps with deployment timestamps. Model accuracy, other applications and third-party infrastructure are outside this review.
Excerpt · Evidence request list
Sample finding
Excerpt · Finding
Classification: operating-effectiveness exception in the fictional sample.
Require independent approval on the manual release path, define emergency changes and retain the approval record. Management assigns an owner and completion date; a later review checks the change.
We disclose potential conflicts, including earlier implementation work on the policies or controls being reviewed. We accept the audit only when the necessary independence can be maintained.
The report explains what the review can support and where records are missing. Findings are not legal advice or a guarantee of external acceptance.
Conclusions describe the systems, period, criteria and samples tested. If records are insufficient, we explain what remains unknown and what further information would be needed.
The next step
Tell us the situation and the systems involved. We reply by email with how we would help and who would do the work.