Assurance Consulting
Internal audit, enterprise risk and GRC — the disciplines that tell the board whether the rest of it works.
Three disciplines, one shared failure.
Internal audit, enterprise risk and GRC fail the same way and for the same reason: each produces an artefact that is accurate on the day it is signed and decays from the next morning, and none of them is funded for the tending. A register, a plan, a policy set — all built with real care, all quietly wrong within a year.
The work that keeps them true has no budget line, because it does not look like a project. It has no start, no end and no deliverable to point at — which is exactly why it is the work that never gets bought.
Bought as a project. Delivered as a product.
Neither column is a caricature. The left is how this work is bought almost everywhere, including by people who dislike it.
Five weeks, then a rhythm.
The shape every discipline in this area shares: a rebuild with an end date, then a quarterly loop that does not end.
The artefact reconstructed to a working standard and stood up in the tool.
Partner gateWhat changed, what lapsed, what is now unevidenced.
One pack, one meeting, findings and movement.
Partner gateThe rhythm continues at the recurring price alone.
One method, three disciplines.
These sit on one shelf because they share a bench and a standard — not because one person buys them all. Who commissions what is printed on each page.
Methodology 2026.2 — bumps when a box, a gate or a testing standard changes — never for a copy edit. Read it at working depth, including what we hold back and why, on the method page.
Three disciplines, three different buyers.
Internal audit is assurance your Audit Committee commissions. Enterprise risk and GRC are management services your business commissions. They sit on one shelf because they share a bench and a method — not because one person buys them all, and the difference decides who may commission what.
Sixteen assurance engagements, two function builds, and a published formula you can check.
The register rebuilt in about five weeks, then kept alive on a published rhythm in Risk Radar. $19,500 then $7,500 a quarter.
Policy framework, compliance obligations and the controls framework — rationalized once, then kept true. Three subscriptions, from $24,000 a year.
14 engagements, every box printed.
Tap any one to read its scope box — what we analyze, how scope gets chosen, what is tested, what the report contains, and what the remediation plan does and doesn’t include. Prices come from one published formula.
One engagement below is at home in another area and shown here because the two are bought together as often as not. Its price is the same wherever you find it.
Family A · Assurance
Assurance — an opinion your Audit Committee can rely on. Bought by the Chief Audit Executive.
D1 AI Usage Audit — 35 control points · 840 credits · $42,000 +
- 01Use inventory — every AI system in use, including the tools bought on expense and the ones embedded in software you already own
- 02Governance testing — approval, human oversight, disclosure and acceptable-use, tested against actual deployments
- 0335 control points tested — data flows into models, retention by vendors, output review, access, third-party terms
- 04Final report — with shadow usage named and quantified
- 05Remediation plan — separating what to stop from what to govern, since most programs need both
D2 Digital Transformation Program Audit — 40 control points · 500 credits · $25,000 +
- 01Program baseline review — scope, benefits case, milestones and governance as approved versus as currently reported
- 02Control testing across the delivery lifecycle — stage gates, change control, benefits tracking, dependency and risk management
- 0340 control points tested — including the reporting line from delivery to steering committee, tested for what gets softened
- 04Final report — an independent view of whether the program will deliver what was approved
- 05Remediation plan — recommendations the steering committee can act on before the next gate
Hard stop: we cannot audit a programme Signify Solution is delivering. See independence.
D3 Offshore Operating Audit — 30 control points · 680 credits · $34,000 +
- 01Delivery footprint mapped — what is actually performed offshore, against what the contract and the org chart claim
- 0230 control points tested — access and supervision, segregation from the provider’s other clients, data handling, change control, key-person dependency
- 03Service evidence tested, not accepted — SLAs checked against the records rather than the dashboard
- 04Final report — with the continuity and concentration risks the service metrics never surface
- 05Remediation plan — retain, restructure or repatriate, sequenced, with the reasoning shown
The assurance version of B3. Same ground, different product: when internal audit commissions it, it is an audit — which is exactly what this page has always said.
D4 Business Process Cycle Audit — P2P — 50 control points, 5 SoD · 800 credits · $40,000 +
- 01Process analytics — procure-to-pay mapped from your own transaction data. Volumes, exceptions, duplicate payments, vendor-master anomalies, payment-term drift
- 02Scoping from what the analytics found — control points chosen because the data pointed at them
- 0350 control points tested — 20 business process, 15 automated and configurable, 10 IT general, 5 segregation of duties
- 04Final report — findings rated, evidence attached, every conclusion traceable to a test in Clarus
- 05Remediation plan — prioritized, owners proposed, effort estimated. The plan is yours to run
This scope and this price are final. The three cycles below run the same box at their own counts.
D5 Business Process Cycle Audit — O2C — 45 control points, 5 SoD · 900 credits · $45,000 +
- 01Process analytics — order-to-cash from your own data. Credit limits breached, pricing overrides, manual invoices, credit notes, unapplied cash, DSO drift
- 02Scoping from what the analytics found — not from a standard’s list of order-to-cash controls
- 0345 control points tested — 18 business process, 14 automated and configurable, 8 IT general, 5 segregation of duties
- 04Final report — findings rated, evidence attached, traceable to a test in Clarus
- 05Remediation plan — prioritized, with the revenue-recognition consequences of each finding stated plainly
D6 Business Process Cycle Audit — R2R — 45 control points, 10 SoD · 770 credits · $38,500 +
- 01Process analytics — record-to-report from your own ledger. Manual journals by preparer, late and post-close postings, top-side adjustments, reconciliation ageing, close-calendar slippage
- 02Scoping from what the analytics found — the entries that move the numbers, not a sample of the ones that don’t
- 0345 control points tested — 15 business process, 12 automated and configurable, 8 IT general, and 10 segregation of duties, because journal preparation and approval is where this cycle actually fails
- 04Final report — findings rated, every conclusion traceable to an entry
- 05Remediation plan — sequenced around your close calendar, so fixes land between closes rather than during one
D7 Business Process Cycle Audit — Payroll — 35 control points, 5 SoD · 620 credits · $31,000 +
- 01Process analytics — payroll from your own runs. Joiner and leaver timing, off-cycle payments, master-data changes against payment runs, overtime outliers, duplicate bank details
- 02Scoping from what the analytics found — including the tests most payroll audits skip
- 0335 control points tested — 14 business process, 10 automated and configurable, 6 IT general, 5 segregation of duties
- 04Final report — findings rated, with any employee-data exposure flagged for your privacy lead
- 05Remediation plan — prioritized, separating what payroll owns from what HR owns, since they are rarely the same person
A1 SoD by Business Process Detailed Assessment — 40 control points, 40 SoD · 780 credits · $39,000 +
- 01Role and authorization mining — every role, profile and composite in scope mapped to the business processes it actually touches
- 02Ruleset build or validation — your conflict ruleset tested against the process, not accepted as delivered
- 0340 conflict rules tested — each traced to real assignments and real transactions, not theoretical exposure
- 04Mitigating control assessment — every accepted conflict checked for a control that genuinely operates
- 05Remediation plan — conflicts ranked by transactional exposure, not by count
Lives on the SAP technology page — shown here because it is bought together with these as often as not.
Family C · Function build
Function build — your own function’s infrastructure.
D9 Audit Universe Setup and Refreshment — ~60 entities · 780 credits · $39,000 +
- 01Auditable entity identification — the universe rebuilt from the organization as it is now, not as the last reorganization left it
- 02Risk assessment across the universe — scored against criteria the committee has agreed, with the criteria printed
- 03Annual plan cut to capacity — yours plus ours, so the plan is deliverable rather than aspirational
- 04Methodology stood up in Clarus — templates, workflow and QA gates, ready to execute against
- 05First audit-committee pack and readout — the universe presented, challenged and adopted
D10 Internal Audit Strategy Development — fixed scope · 700 credits · $35,000 +
- 01Current-state review — mandate, charter, resourcing, methodology and standing with the committee
- 02Stakeholder expectations — what the board, the committee and the executive each actually want from assurance, which is rarely the same thing
- 03Target operating model — co-source ratio, bench composition, technology, and what the function should stop doing
- 04Three-year strategy — with the QAR path built in, since that is what the standards will eventually ask for
- 05Board-ready presentation — the strategy in the committee’s language, not ours
Fixed · where we then deliver audits under a strategy we wrote, that is disclosed in every committee pack
D11 The Risk Register, kept alive — fixed scope · 800 credits · $40,000 +
- 01Risk universe review — what belongs on this register, and what has been sitting on it because nobody ever retired it
- 02Up to 40 risks rebuilt — described in plain language, scored on one basis, and owned by a named person rather than by a department
- 03Owner interviews and a calibration workshop — leadership challenges and settles the scoring, so the register survives its first real disagreement
- 04Deployed in Risk Radar, running in your environment — the register lives in software you keep using, not in a spreadsheet somebody owns
- 05First board pack and readout, and the rhythm handed over — the register presented, challenged and adopted, with the quarterly evidence sweep documented so your team can run the next one
A build, not assurance. While we maintain your register we cannot audit it — assurance over a register we keep is not assurance. Fixed scope at up to 40 risks; beyond that it is scoped before you buy.
D12 Policy Framework, kept alive — fixed scope · 500 credits · $25,000 +
- 01Policy inventory and rationalization — every policy in force, including the ones nobody has opened since approval and the two that contradict each other
- 02An owner and a review date on each — a policy without a named owner is a document, not a control
- 03Gap and overlap analysis — what you are required to have and don’t, what you have twice, and what no longer applies to a business you have since changed
- 04Stood up in Clarus — the register lives in software you keep using, not in a folder somebody owns
- 05First refresh cycle run with your team — what changed, what lapsed its review date, what was approved and never communicated — handed over as a pack they can repeat without us
A build, not assurance. While we keep your policy framework alive we cannot audit it. Fixed scope, shown at around 60 policies in force.
E2 Audit Analytics Enablement — 8 routines · 780 credits · $39,000 +
- 01Test library built — the recurring analytics your plan needs, written as routines your own team can re-run without us
- 02Data access documented — where each extract comes from, who authorizes it, how it refreshes, and what breaks when a source system upgrades
- 03Routines validated against known results — an analytic nobody has proven is an opinion with a chart attached
- 04Handover and training — your team runs these next quarter. If they cannot, we have not finished
- 05Stood up in Clarus beside the methodology, so the routines survive the person who learned them
Family C because it builds your function's own capability — the same precedent that lets us rebuild your universe and write your methodology without crossing the guardrail.
Lives on the analytics page — shown here because it is bought together with these as often as not.
Family B · Assessment
Assessment — a diagnostic, no assurance opinion. Bought by the function’s own head, except where the item is a procedure.
D8 Offshore Talent and Operating Assessment — 2 sites · 440 credits · $22,000 +
- 01Operating model review — what is actually performed offshore versus what the contract and org chart say
- 02Capability and key-person assessment — skills held, skills assumed, and where a single resignation stops a process
- 03Control environment at the delivery site — access, supervision, data handling and segregation from other clients
- 04Findings report — including the cost and continuity risks the service metrics do not surface
- 05Recommendations — retain, restructure or repatriate, with the reasoning shown. Assessment, not assurance
Anything here can join a plan built in any other area — a penetration test can sit inside an internal audit year. Build a plan →
The Annual Internal Audit Plan
Eight engagements — a committee-ready audit year, in one purchase. The whole first year: the strategy set, the universe rebuilt, two business-process cycles, the technology and cyber framework audits, AI usage, and the record of processing.
Same engagements, same menu prices — buying the block as a year changes nothing except that it is worth buying at once. Read the full card, including what it forecloses →
What we do · Assurance Consulting
One thing worth knowing before you buy.
Every recurring service we run forecloses the assurance over it. If we keep your framework alive we cannot audit it, and if we audit it we cannot keep it alive. You choose which, we print the consequence before you buy rather than after, and where an Audit Committee relationship already exists we protect it.
Part of the Signify family
Solve · Build · Teach · Sustain. Four properties, one design language — consulting, software, interactive learning and sustained advisory, built in Philadelphia since 2019.
Premium management consulting across strategy, cybersecurity, audit, GRC and regulatory readiness. Every engagement partner-led.
signifysolution.comConsulting, new age. Seven practitioner-built products — the tools that stay behind at clients as running value.
signifyhive.comPlay, test, think. Games, assessments, simulations and Points of View — learn the work by doing it.
signifyinsights.com You are hereConsulting, sustained. Time-boxed, and scope-boxed engagements at transparent rates. Clear pricing. Explicit scope.
signifyimpact.com