We agree which legal entity is being assessed, in which jurisdiction, and over what period. The period is then locked.
Without a recorded period, no reader can tell which obligations applied or whether the evidence was current.
You receive the full list of what will be asked for, ahead of the session. No surprises — the exercise is not a trap, it is a rehearsal.
Working through each control with the people who operate it, recording what exists, how mature it is, and whether the evidence was actually produced.
Assessed against what an institution your size is expected to hold, not against a tier one bank's budget.
Supervisory information requests issued in writing and answered by your team without our help. We record what came back, from where, and how long it took.
This is the part that costs real time. It is also the only part that tells you what an examination would actually find.
Controls rated well whose evidence could not be produced are named, with the obligations they put at risk. Strengths are recorded too.
The assessment becomes a baseline. Next year measures against it, so progress is a number rather than an assertion.
This measures readiness, not compliance. A strong result is not evidence of compliance with any obligation. It records what you could produce; it does not verify that what you produced was correct. Where a control was not assessed, nothing is recorded — absence of a finding is not evidence of capability.
And where our reading of a local rule has not been through a lawyer in that country, the report says so on the front page.
Tell us where you operate and what you sell, and we will show you the platform configured the way it would actually run for you.
One of us reads it, not a queue. We come back inside two working days with a time — or a straight answer about whether we are the right fit.