Five areas, each ending in something you can show

Governance and controls

The questionCan you show that your controls work?

• A Baseline against the Standard: which controls exist, and whether they operate.
• A named owner for every system, data set and control.
• Evidence a regulator, auditor or board can check.
• Quarterly re-measurement, so the trend is visible.

Not: internal audit or external certification.

AI and automation

The questionWho decides what AI may do here?

• Where AI can create value, ranked on value, cost, risk and capacity to deliver.
• Which AI tools are in use today, and what data they touch.
• Decision rights: who approves a use case, how it is tested, what is documented.
• AI solutions built and put into use within an approved scope.

Not: building our own AI models.

Data and architecture

The questionCan you trust what your systems say?

• One register of systems, equipment and services, and how they connect.
• A clear model of what you provide, to whom, and on what terms.
• A review of your platform: what is customised, what blocks upgrades, what it costs to keep.
• Integrations that remove double entry between systems.

Not: data warehouses, BI, or data work outside service and operations platforms.

Risk and compliance

The questionWould your controls hold up in an audit or an incident?

• An ISO 27001 management system run on evidence: owners, controls, audit trail.
• Incident, problem and change management run as controls that support resilience and reporting duties, including DORA for banks and insurers.
• Third-party oversight: a supplier register, risk assessment and follow-up.

Not: legal advice, certification audits, penetration testing, or running a security operations centre.

Delivery and quality

The questionWill this project land on time, and keep working after we leave?

• Implementation on a fixed scope, price and date.
• Testing, documentation and training that stay with you, not with us.
• A second opinion on a plan or design before you commit to it.
• Portfolio oversight: what is running, why, and in what order.

Not: anonymous resource pools, or open-ended hourly consulting without a defined scope.