Services
Services across the GRC program lifecycle.
Four service lines, one delivery method. Engage where you are (assessing, building, operating, or deciding) and know how each step connects to the next.
Two views of the same program.
The service lines describe what you can engage us for; the lifecycle describes the method we use to deliver any of them. You don’t buy the lifecycle. You buy a service line, delivered through it.
Two views of the same program. What you buy is one of four service lines: Assess and Plan, Build and Implement, Managed GRC, or Advisory. How we deliver is always the same five-stage method: Assess, Design, Implement, Operate, Improve. Any service line is delivered through that method.
What you buy: four service lines
- Assess and Plan
- Build and Implement
- Managed GRC (core engagement)
- Advisory
How we deliver: one method
- Assess
- Design
- Implement
- Operate
- Improve
Choose where to engage.
Each line owns a distinct stage of the program, so the four never overlap.
Assess and Plan
Stage: understand. A one-time engagement.
Starts with a defensible view of risk, readiness, and maturity; stops at a prioritized roadmap you can fund.
Build and Implement
Stage: stand up. A project engagement.
Starts where a plan exists; stops once governance, controls, and workflows operate in practice.
Managed GRC
Stage: run and mature. An ongoing engagement.
Starts when the program has to run between audits; keeps operating it as a capability with decision-ready reporting.
Advisory
Stage: decide. On demand.
Starts and stops with a specific decision: senior judgment when leadership needs it, without a standing engagement.
How we deliver: Assess → Design → Implement → Operate → Improve.
The same method applies whether you engage one service line or combine several.
A single delivery method runs in five connected stages, each feeding the next: Assess, then Design, then Implement, then Operate, then Improve. Improve feeds back into Assess, so Operate and Improve continue as an ongoing loop rather than ending the program.
- AssessEvidence-based current state and risk.
- DesignOperating model, controls, and reporting.
- ImplementPolicies, workflows, and adoption.
- OperateThe program run with executive visibility.
- ImproveMaturity advancement as things change.
Improve feeds back into Assess: the program keeps running and maturing between audits, not just before them.
What the service lines produce together.
Together the lines deliver program outcomes leadership can act on.
Decision-ready reporting.
A common control framework that reduces duplication.
Clear ownership and decision rights.
Credible assurance for customers and auditors.
A program that scales with the business.
Find your program’s stage.
Most programs start at one of four decision points. Where you are usually points to where to begin, and each engagement is delivered through the same method. No form required to read this.
You need a defensible current state
Start with Assess and Plan, a one-time engagement that produces a roadmap you can fund and follow.
You have a plan but execution stalls
Start with Build and Implement, a project engagement that stands up the operating model, controls, and adoption.
The program needs to run, not restart
Start with Managed GRC, an ongoing engagement that operates and matures the program. Our core engagement.
You face a specific decision
Start with Advisory, senior judgment on demand, as much or as little as you need.
Start with the program, not the framework.
Talk with a senior advisor about the decisions, ownership, and operating capability your organization needs next.
A conversation with a senior practitioner, not a sales gatekeeper.