Overview/How an engagement runs
Five stages, in this order, every time.
The stages are not a proprietary method. They follow the register: each stage produces the artefact the next one depends on, which is why the order does not change between clients. What changes is how far along the chain a programme needs to be carried.
A board that needs the exposure named stops at the finding and holds a register it can act on. A board that needs the exposure closed continues through controls and assurance. Both start in the same place.
-
01
Briefing
The board states the problem. We frame the decision.
A short session with the accountable executives. We establish where AI has already entered the organisation, which decision the board is actually being asked to take, and what would have to be true for that decision to be safe. You leave with the exposure named and the next step written down. There is no obligation and no cost.
At the end of the stage: Briefing notes, the named decision, and an agreed scope.
-
02
Finding
The assessment that produces the register.
Depending on scope, this is the readiness and maturity assessment, the AI risk assessment, the shadow AI discovery, or a combination. Risks are found and scored, owners are named, and the evidence each entry rests on is recorded. Where agents are in play, their access is inventoried.
At the end of the stage: A scored AI risk register with owners, plus an inventory of AI in use.
-
03
Roadmap
What gets fixed first, and inside what window.
The register is sequenced into a plan a board can approve: what is treated, what is accepted, what is transferred, and what is deferred with a stated reason. The roadmap covers roles, not only controls, because an unowned control is not a control.
At the end of the stage: A prioritised roadmap with owners, windows and acceptance decisions.
-
04
Controls
The roadmap becomes enforceable.
Policies, governance frameworks, control matrices, secure architecture, guardrails, agent identity and least-privilege access, data controls, and the engineering work behind them. Then the controls are attacked: penetration testing, red teaming, jailbreak testing and model validation, with retesting after repair.
At the end of the stage: The control set in force, plus test reports and retest letters.
-
05
Assurance
The register stays current.
Managed monitoring and AI detection and response, incident response planning and tabletop exercises, continuous governance reporting, and executive briefings on what changed. AI risk is not a point-in-time exercise, and the reporting cadence reflects that.
At the end of the stage: Monitoring in force, board reporting, and a register that keeps its shape.
Principle The same hands throughout.
The firm does not split into an advisory team that recommends and a delivery team that implements. The people who brief the audit committee are the people who perform the penetration tests and configure the guardrails. This is the reason the register holds its shape after the engagement ends: the recommendations were written by the people who had to make them true.
It also means the firm will decline work it cannot carry. A recommendation we cannot implement would be a promise, and the register does not carry promises.
We are not accepting new clients at present. The register of services stays published, and it is written to be acted on without us.
Read the availability note