Governance, Risk & Compliance

Risk assessments, security policies, vendor oversight, and SOC 2 and ISO 27001 readiness, run as one connected program.

Our work is advisory. We don't perform financial statement audits or provide attest services.

Risks with owners. Policies people follow. Issues that close.

The challenge

Most or­ga­ni­za­tions have the poli­cies, the frame­works, and the risk reg­is­ter. The trou­ble is fol­low-through. Registers go stale. Policies no longer match how the busi­ness runs. Vendors hold sen­si­tive data under re­views no­body has re­vis­it­ed. Then a cus­tomer asks for a SOC 2 re­port or an ex­am­in­er asks a sim­ple ques­tion, and no­body can an­swer it with ev­i­dence.

How we help

We con­nect what your gov­er­nance doc­u­ments promise to what your teams ac­tu­al­ly do. That starts with risk. We as­sess IT, cy­ber­se­cu­ri­ty, and cloud risk sep­a­rate­ly, be­cause each has dif­fer­ent own­ers and dif­fer­ent ev­i­dence, then rate every risk against an ap­petite your lead­ers have agreed and record who owns it.

From there, we build the struc­ture around it: poli­cies short enough to read and spe­cif­ic enough to fol­low, one con­trol li­brary mapped to your oblig­a­tions, and a third-party risk pro­gram that puts ef­fort into the ven­dors that mat­ter. When a cus­tomer or part­ner asks for SOC 2 or ISO/IEC 27001, your ev­i­dence is al­ready or­ga­nized.

Finally, we fix the fol­low-through. We set up re­me­di­a­tion with own­ers, dates, and es­ca­la­tion, and we con­firm that each fix ad­dress­es the orig­i­nal risk be­fore the issue clos­es.

Standards we work with: NIST CSF 2.0, NIST SP 800-53, ISO/IEC 27001 and 27002, ISO 31000, COSO ERM, COBIT 2019, the 2023 Interagency Guidance on Third-Party Relationships, the AICPA Trust Services Criteria, the HIPAA Security Rule, and PCI DSS v4.0.

Only a li­censed CPA firm can issue a SOC 2 re­port, and only an ac­cred­it­ed cer­ti­fi­ca­tion body can cer­ti­fy you to ISO/IEC 27001. We pre­pare you for both. We don't do ei­ther.

Good fit if your risk, com­pli­ance, and audit teams keep sep­a­rate lists, your ven­dors haven't been re­viewed since on­board­ing, or a cus­tomer has asked for a SOC 2 re­port you don't have yet.

Related topics

  • GRC consulting
  • IT risk assessment
  • Cybersecurity risk assessment
  • Cloud risk assessment
  • Information security policy writing
  • Third-party risk management
  • SOC 2 readiness
  • ISO/IEC 27001 readiness

Services in Governance, Risk & Compliance

Select a service to see what it covers.

IT Risk Assessment

Identification and rating of the risks across your IT environment and critical business systems, measured against your risk appetite.

We identify the risks across your systems, applications, and IT operations, then rate each one against the appetite your leaders have agreed. Every risk ends up with an owner and a decision: treat it, accept it, or transfer it.

What's included

  • Risk identification across systems, processes, and IT operations
  • Likelihood and impact ratings tied to your risk appetite
  • A risk register with owners and treatment decisions

Ask about this service

Cybersecurity Risk Assessment

A threat-informed assessment of the cyber risks to your most important data and systems, rated in business terms.

We start with the data and systems the business can't run without, weigh the threats they realistically face, and rate what remains after your current controls. The result shows what to treat first and who owns each decision.

What's included

  • Critical asset and data identification
  • Threat scenarios rated in business terms
  • A prioritized treatment plan for leadership

Explore Cybersecurity Risk Assessment Ask about this service

Cloud Risk Assessment

An assessment of the risks in how you use the cloud, including provider dependence, data location, shared responsibility, and exit options.

Moving to the cloud changes who controls what, where your data lives, and how hard it is to leave a provider. We assess those risks across your cloud services and record them in your register with owners and treatment plans.

What's included

  • Cloud service inventory and data classification
  • Provider, concentration, and exit risk
  • Shared responsibility gaps rated against your risk appetite

Ask about this service

GRC Program and Control Framework Design

One control library that links your risks, policies, controls, and obligations, so risk, compliance, and audit work from the same list.

When risk, compliance, and audit each keep their own spreadsheet, nobody sees the whole picture. We design one library that links each risk to its controls, policies, and obligations, so everyone works from the same list.

What's included

  • An integrated risk and control library
  • A compliance obligations register linked to tested controls
  • Risk appetite statements and board reporting

Ask about this service

Information Security Policy Writing

Information security policies and standards, written or rewritten to fit how you operate and mapped to the frameworks your customers expect.

Policies copied from a template rarely match how the business runs, so nobody follows them. We write policies short enough to read and specific enough to follow, and map each one to the frameworks your customers and regulators expect.

What's included

  • A policy and standard set sized to your organization
  • Mapping to NIST, ISO/IEC 27001, and SOC 2 criteria
  • An owner and review cycle for each document

Ask about this service

Remediation Management

Issue and remediation tracking with owners, dates, and escalation, plus validation that each fix addresses the original risk.

Findings that sit open for quarters usually signal missing ownership, not missing effort. We set up tracking with owners, deadlines, and escalation, and we confirm each fix addresses the original risk before the issue closes.

What's included

  • Issue intake and prioritization
  • Owners, deadlines, and escalation paths
  • Closure validation before issues are closed

Ask about this service

Third-Party Risk Management

A vendor risk program that tiers vendors by criticality and data access, so due diligence goes where the risk is.

We tier your vendors by how critical they are and what data they touch, then match due diligence and monitoring to that risk. Your team's time goes to the vendors that could actually hurt you.

What's included

  • Vendor tiering and due diligence
  • Third-party AI and fourth-party risk review
  • Event-driven reassessment and monitoring

Explore Third-Party Risk Management Ask about this service

Vendor SOC Report Review

A close reading of your vendors' SOC reports: scope, exceptions, carved-out subservice organizations, and the user entity controls you must run.

A SOC report is only useful if it covers the services you actually use. We check its scope, exceptions, and carved-out subservice organizations, and we list the user entity controls the report expects your team to run.

What's included

  • Scope and coverage check against the services you use
  • Exception and carve-out analysis
  • Complementary user entity controls mapped to owners

Ask about this service

SOC 2 Readiness

Scoping, gap assessment, control design, and evidence preparation before your CPA firm begins the SOC 2 examination.

We help you choose the right scope and report type, close the gaps against the trust services criteria, and organize the evidence before your CPA firm arrives. Only a licensed CPA firm can perform the examination and issue the report.

What's included

  • Type 1 or Type 2 scoping and criteria selection
  • Gap assessment and control design
  • Evidence planning and practice walkthroughs

Explore SOC 2 Readiness Ask about this service

ISO/IEC 27001 Readiness

Scoping, gap assessment, and ISMS build-out to prepare you for an ISO/IEC 27001:2022 certification audit.

ISO/IEC 27001 asks for a working management system, not just a set of controls. We help you scope the ISMS, assess the gaps, and build the risk treatment plan and Statement of Applicability that certification auditors expect.

What's included

  • ISMS scope and Statement of Applicability
  • Risk assessment and treatment plan
  • Internal audit and management review planning

Explore ISO/IEC 27001 Readiness Ask about this service

HIPAA and PCI DSS Readiness

Gap assessments and control design for the HIPAA Security Rule and PCI DSS v4.0, ahead of your assessor or regulator.

We assess your controls against the HIPAA Security Rule or PCI DSS v4.0, design what's missing, and organize the evidence your assessor or regulator will ask for. You go into the review knowing where you stand.

What's included

  • HIPAA Security Rule risk analysis support
  • PCI DSS v4.0 scoping and gap assessment
  • Control design and evidence preparation

Ask about this service

Explore our other practice areas

IT & Cybersecurity Audit Advisory

Risk-based IT audits, ITGC and application control testing, and cybersecurity and cloud assessments, with findings owners can act on.

Learn more about IT & Cybersecurity Audit Advisory

AI Governance

AI readiness, inventory, policy, and oversight, so every use of AI is visible, valuable, and accounted for.

Learn more about AI Governance

AI Risk, Security, and Audit

Risk assessments, security control reviews, and audits that show whether your AI holds up in daily use, and not only in policy.

Learn more about AI Risk, Security, and Audit

Data Privacy

Know what personal data you hold, where it goes, and whether your controls keep the promises in your privacy notice.

Learn more about Data Privacy

Forensic Accounting & Fraud Risk

Evidence-first analysis of financial irregularities, and of the control gaps that let them happen.

Learn more about Forensic Accounting & Fraud Risk

Professional Training

Workshops and cohorts that build audit, AI governance, and GRC skills inside your team.

Learn more about Professional Training

View All Services

Ways to work with us

Project engagements

A defined scope, timeline, and deliverable, such as an IT review, an AI governance build, or a remediation plan.

Advisory support

Ongoing access to senior guidance as your program, systems, and regulators change.

Audit capacity support

Added hands and specialist skill for your internal audit or risk team, working under your direction.

Training programs

Workshops and cohorts for your team, delivered on a schedule that suits you.

How we engage

  1. Discovery

    A short call to understand your situation.

  2. Scoping

    A written scope with deliverables, timing, and fees.

  3. Delivery

    Regular check-ins and findings you can read in one sitting.

  4. Follow-up

    A review of progress, plus support for what comes next.

Common questions

Are you a CPA firm?

No. We're a risk and tech­nol­o­gy ad­vi­so­ry firm. We don't per­form fi­nan­cial state­ment au­dits or issue audit opin­ions.

Can you help us prepare for SOC 2 or a similar report?

Yes, on the readi­ness side: gap as­sess­ment, con­trol de­sign, and ev­i­dence prepa­ra­tion. The re­port it­self must come from a li­censed CPA firm.

Do you work with our internal and external auditors?

Yes. We co­or­di­nate with in­ter­nal audit, your ex­ter­nal au­di­tors, and your com­pli­ance team so work isn't du­pli­cat­ed.

How long does an engagement take?

It de­pends on scope. After a scop­ing call, you'll get a time­line in writ­ing.

What size organizations do you work with?

Mid-mar­ket and en­ter­prise or­ga­ni­za­tions across in­dus­tries.

Will you keep our information confidential?

Yes. We'll sign an NDA be­fore you share sen­si­tive de­tails.

Can you assess an AI program you helped design?

No. We don't audit or as­sess an AI pro­gram, sys­tem, or use case we de­signed for the same client. If an en­gage­ment would cross that line, we'll tell you dur­ing scop­ing.

Is this legal advice?

No. We sup­port reg­u­la­to­ry align­ment from a risk and con­trols per­spec­tive. For legal ques­tions, work with coun­sel.

Not sure which service fits?

Describe the problem. We'll tell you where to start.

Talk to an Advisor