Readiness, assurance and people for your IT controls

We map your controls to the Trust Services Criteria or your control objectives, test them the way your CPA firm will, and give you a prioritized list of what to fix.

When you're ready, we help you pick the right report type, period and scope so the first audit goes cleanly.

We help you build an information security management system that a certification body will accept, and that your people can actually run.

That covers the management clauses as well as the 93 Annex A controls, with a Statement of Applicability you can defend.

If you build or use AI systems, customers and regulators now want proof that you govern them. ISO 42001 is the first certifiable standard for an AI management system.

We help you set one up, often alongside an existing ISO 27001 program so the two share policies, audits and reviews.

Suppliers will need certification under the Canadian Program for Cyber Security Certification to win certain Government of Canada defence contracts.

We assess you against the ITSP.10.171 security requirements and prepare you for the certification level your contracts call for.

Passing the first audit is the start. Most SOC 2 reports are renewed every year, and ISO certificates face a surveillance audit each year.

On a retainer, we keep your controls running and your evidence in order between audits, so renewal is routine.

We test your controls for design and operating effectiveness, to the standard your external auditor expects to rely on.

That covers SOX and financial reporting controls, and any other control set you need tested, from regulatory attestations to your own internal framework.

We plan and carry out IT audits for your internal audit function or audit committee, either co-sourced with your staff or fully outsourced.

Our risk assessments rank your technology risks so the audit plan goes where the exposure is.

Your vendors' SOC reports only help if they cover the services you rely on. We read them for you and tell you what is covered, what is not, and what you must do yourself.

The review supports SOX reliance, vendor due diligence and third-party oversight under OSFI Guideline B-10.

New systems bring new risk. We review the controls in an ERP, cloud or finance system rollout before go-live, while fixes are still cheap.

We work alongside your project team, with hands-on experience in SAP, Oracle and the major cloud platforms.

Guideline B-13 sets OSFI's expectations for technology and cyber risk. Guideline B-10 covers third-party risk.

We assess where you stand against both and help you build the evidence your supervisor will look for.

We review how you collect, use, store and share personal information against the privacy laws that apply to you.

Our team holds the CDPSE certification in privacy engineering, so we look at the systems as well as the policies.

Auditors and regulators want to see that you can recover from an outage or a cyberattack, and that you have tested it.

We build plans your staff can follow under pressure, then rehearse them with you.

Most readiness projects need new or rewritten policies. We write them to fit how your organization works.

Each policy is mapped to the frameworks you report on, so one set serves SOC 2, ISO and your regulators.

Need an IT auditor or risk specialist for a busy season, a vacancy, or a regulatory deadline? We place experienced people inside your team.

They work under your direction, follow your methodology, and leave your staff better equipped when they go.