Subscribe to a bundle.
A subscription here is a commitment to a scheduled block of work with the schedule printed before you buy it — not a retainer against unspecified hours. Each one is a named bundle of engagements, bought together at the sum of their published prices. All eight publish what arrives and when, and all eight print what they cost us the right to do.
A bundle of engagements, at the sum of their prices.
No separate subscription rate and no arithmetic of our own — a bundle costs exactly what its engagements cost. Every engagement inside one is also buyable on its own at the same published price, so the price is the same either way — what a bundle buys you is the sequencing. How buying works here →
Scoped and sequenced before it starts.
Every engagement in the block is scoped and confirmed in writing, the sequence agreed, and each one assigned to a delivery quarter before any fieldwork begins. You know what arrives and when, and the schedule is printed on the page rather than negotiated later.
The trade: the block is a commitment. Where a subscription contains a build, it forecloses assurance over what it builds — every card says which.
Pay by the value outcome.
All forty engagements are individually priced and individually buyable. Pick what you need from the plan builder and pay against what each one produces, rather than against coverage you have not asked for.
The trade: you sequence it yourself.
Eight blocks, one list.
Every card prints what you end up with and what it costs; flip a card for the delivery schedule in milestones and the scope boundaries it sets.
A named bundle of engagements.
Between two and eight of the forty, chosen because they answer one question together. The membership is printed on every card — nothing is bundled that you cannot see.
The sum of its parts.
Exactly what the engagements cost individually — no uplift for grouping them and no discount for it either. Same published prices either way, so nothing is hidden in the bundle.
The Annual Internal Audit Plan
Eight engagements — a committee-ready audit year, in one purchase
What you end up with. A committee that asked what the coverage actually is gets a year of it — the universe rebuilt and true, then seven engagements delivered against it, each leaving a rated report and a remediation plan you own.
The bundle, in milestones
Every engagement in the bundle scoped and confirmed in writing, the sequence agreed, and each one assigned to a delivery quarter before any fieldwork starts.You hold: a scoped, sequenced and committee-presentable bundle
C1 runs alone and gates everything after it — the audit universe rebuilt, risk-assessed, cut to real capacity, and the methodology stood up in Clarus. A plan built on a universe nobody re-justified is a shopping trip.You hold: the rebuilt universe, the risk assessment and the approved plan
The rest of the bundle delivered two at a time, opening on Audit Universe Setup and Refreshment and Records of Processing Audit. Each leaves a report with findings rated and evidence attached.You hold: 7 reports and 7 remediation plans, all traceable in Clarus
A year of coverage your committee approved in advance and can trace afterwards — every conclusion tied to a test, every finding tied to an owner and an effort estimate.You hold: 8 engagements delivered, 8 remediation plans, one defensible program
What it forecloses
One foreclosure. The records-of-processing audit means we cannot hold your outsourced DPO role under B8 — a DPO monitoring compliance cannot also audit it. The choice between them is yours, and it is made before you buy either.
Book a call Back to the front ↺Stand Up the Audit Function
The universe and the strategy — for a function being built or rebuilt
What you end up with. A function that can defend how it chose its plan: a universe rebuilt and risk-assessed, a plan cut to real capacity, a methodology standing in Clarus, and a three-year strategy the committee has signed.
The bundle, in milestones
Every engagement in the bundle scoped and confirmed in writing, the sequence agreed, and each one assigned to a delivery quarter before any fieldwork starts.You hold: a scoped, sequenced bundle
Delivery opens on Internal Audit Strategy Development and Audit Universe Setup and Refreshment. Two engagements run at a time — a pace set by how fast findings can actually be absorbed, not by how fast they can be written.You hold: the first reports, findings rated and evidence attached
The balance of the bundle at the same two-in-flight pace — about 1 quarter end to end for all 2.You hold: all 2 reports, each with a prioritized remediation plan
One block of coverage bought at one price, delivered on a schedule agreed before it started, with every conclusion traceable to a test.You hold: 2 engagements delivered, 2 remediation plans you own
What it forecloses
Where we later deliver audits under a strategy we wrote, that is disclosed in every committee pack. Permitted, never silent.
Book a call Back to the front ↺SAP Landscape Assurance
Four engagements across one SAP estate — SoD, cyber, GRC and order-to-cash
What you end up with. The landscape your last four audits stopped at the edge of, opened from four angles in one plan year — security, process configuration, architecture and the conflict ruleset that ties them together.
The bundle, in milestones
Every engagement in the bundle scoped and confirmed in writing, the sequence agreed, and each one assigned to a delivery quarter before any fieldwork starts.You hold: a scoped, sequenced bundle
Delivery opens on SoD by Business Process Detailed Assessment and SAP Cyber Detailed Assessment. Two engagements run at a time — a pace set by how fast findings can actually be absorbed, not by how fast they can be written.You hold: the first reports, findings rated and evidence attached
The balance of the bundle at the same two-in-flight pace — about 2 quarters end to end for all 4.You hold: all 4 reports, each with a prioritized remediation plan
One block of coverage bought at one price, delivered on a schedule agreed before it started, with every conclusion traceable to a test.You hold: 4 engagements delivered, 4 remediation plans you own
What it forecloses
One foreclosure, and it runs the other way. Where Signify has configured your GRC platform under A12, the GRC audit in this block cannot run — assurance over a platform we built is not assurance. Buy this before you buy the build, not after.
Book a call Back to the front ↺Infrastructure & Access Audits
Systems, Active Directory and remote access — the estate, covered
What you end up with. Infrastructure risk your committee was told is covered, actually tested — the application, the directory and every path into the estate, including the ones that are not on the diagram.
The bundle, in milestones
Every engagement in the bundle scoped and confirmed in writing, the sequence agreed, and each one assigned to a delivery quarter before any fieldwork starts.You hold: a scoped, sequenced bundle
Delivery opens on Active Directory Audit and Remote and VPN Audit. Two engagements run at a time — a pace set by how fast findings can actually be absorbed, not by how fast they can be written.You hold: the first reports, findings rated and evidence attached
The balance of the bundle at the same two-in-flight pace — about 2 quarters end to end for all 3.You hold: all 3 reports, each with a prioritized remediation plan
One block of coverage bought at one price, delivered on a schedule agreed before it started, with every conclusion traceable to a test.You hold: 3 engagements delivered, 3 remediation plans you own
What it forecloses
None. If we have run your penetration test under C6, the lead specialists differ and it is disclosed — findings are evidence, not controls we designed.
Book a call Back to the front ↺AI & Transformation Audits
The two questions committees are asking now — AI usage and the program
What you end up with. Answers rather than frameworks on the two questions your committee is asking now: what AI is actually in use here, and whether the transformation will deliver what was approved.
The bundle, in milestones
Every engagement in the bundle scoped and confirmed in writing, the sequence agreed, and each one assigned to a delivery quarter before any fieldwork starts.You hold: a scoped, sequenced bundle
Delivery opens on AI Usage Audit and Digital Transformation Program Audit. Two engagements run at a time — a pace set by how fast findings can actually be absorbed, not by how fast they can be written.You hold: the first reports, findings rated and evidence attached
The balance of the bundle at the same two-in-flight pace — about 1 quarter end to end for all 2.You hold: all 2 reports, each with a prioritized remediation plan
One block of coverage bought at one price, delivered on a schedule agreed before it started, with every conclusion traceable to a test.You hold: 2 engagements delivered, 2 remediation plans you own
What it forecloses
Hard stop: we cannot audit a program Signify Solution is delivering. If we are building it, we do not assure it — and we would rather lose this block than blur that.
Book a call Back to the front ↺Cyber & Privacy Framework Audits
The framework tested, and the system underneath it
What you end up with. Evidence for the regulator or insurer who has stopped accepting assertions — the cybersecurity and privacy frameworks both tested for operating effectiveness, design and operation reported separately.
The bundle, in milestones
Every engagement in the bundle scoped and confirmed in writing, the sequence agreed, and each one assigned to a delivery quarter before any fieldwork starts.You hold: a scoped, sequenced bundle
Delivery opens on Cybersecurity Framework Audit and Technology System Audit. Two engagements run at a time — a pace set by how fast findings can actually be absorbed, not by how fast they can be written.You hold: the first reports, findings rated and evidence attached
The balance of the bundle at the same two-in-flight pace — about 1 quarter end to end for all 2.You hold: all 2 reports, each with a prioritized remediation plan
One block of coverage bought at one price, delivered on a schedule agreed before it started, with every conclusion traceable to a test.You hold: 2 engagements delivered, 2 remediation plans you own
What it forecloses
No foreclosures beyond the standing rules.
Book a call Back to the front ↺Privacy Framework & Data Quality
The privacy program scored, and the record it rests on audited
What you end up with. A privacy answer that holds up under a due-diligence questionnaire: the framework tested on real requests, real breaches and real transfers, and the quality of the data those procedures depend on, in the same plan year.
The bundle, in milestones
Every engagement in the bundle scoped and confirmed in writing, the sequence agreed, and each one assigned to a delivery quarter before any fieldwork starts.You hold: a scoped, sequenced bundle
Delivery opens on Privacy Programme Maturity Assessment and Records of Processing Audit. Two engagements run at a time — a pace set by how fast findings can actually be absorbed, not by how fast they can be written.You hold: the first reports, findings rated and evidence attached
The balance of the bundle at the same two-in-flight pace — about 1 quarter end to end for all 2.You hold: all 2 reports, each with a prioritized remediation plan
One block of coverage bought at one price, delivered on a schedule agreed before it started, with every conclusion traceable to a test.You hold: 2 engagements delivered, 2 remediation plans you own
What it forecloses
One foreclosure. The records-of-processing audit means we cannot hold your outsourced DPO role under B8. Audit and role are mutually exclusive by our published account policy, and the choice between them is yours.
Book a call Back to the front ↺SAP Control Design and Build
Seven control sets designed and integrated across the SAP estate
What you end up with. Seven cycles running on controls that were designed in rather than retro-fitted — each one demonstrated operating in your own system, with an owner and an evidence source named before we leave.
The bundle, in milestones
Every engagement in the bundle scoped and confirmed in writing, the sequence agreed, and each one assigned to a delivery quarter before any fieldwork starts.You hold: a scoped, sequenced bundle
Delivery opens on Controls Design Integration and Controls Design Integration. Two engagements run at a time — a pace set by how fast findings can actually be absorbed, not by how fast they can be written.You hold: the first reports, findings rated and evidence attached
The balance of the bundle at the same two-in-flight pace — about 4 quarters end to end for all 7.You hold: all 7 reports, each with a prioritized remediation plan
One block of coverage bought at one price, delivered on a schedule agreed before it started, with every conclusion traceable to a test.You hold: 7 engagements delivered, 7 remediation plans you own
What it forecloses
The largest foreclosure we sell. Because we design these controls we cannot later provide assurance over the cycles they cover or over their segregation of duties — that closes A1 through A5 for as long as the build stands. If you want assurance over this estate, buy it before you buy this.
Book a call Back to the front ↺Prefer to assemble your own year? Every engagement on this site can be ticked into a plan, with credits, cost and delivery quarters settling as you go. The plan builder →
How you buy · Bundles
How a subscription ends.
Cancel at the end of any paid term. The artefact and its full history stay yours, exported in whole — we do not hold your register hostage to a renewal conversation, and the exit terms are printed here rather than raised on the renewal call.
Credits bought for a plan year do not expire and are refundable against work not yet started. If what you actually need is one engagement rather than a year of them, say so and we will sell you the one.
Every engagement, priced individually →- 01A printed box before you buy — scope, price and schedule, on the page rather than in a proposal
- 02A quarterly pack and readout — what changed, what lapsed, what needs a decision. Thirty minutes, no filler
- 03The work lives in software you keep — not in a folder we own
- 04Partner judgment at kickoff, calibration and every readout — on the calendar, not on best efforts
- 05The foreclosure, stated before you buy — what we can no longer do for you once we do this
Part of the Signify family
Solve · Build · Teach · Sustain. Four properties, one design language — consulting, software, interactive learning and sustained advisory, built in Philadelphia since 2019.
Premium management consulting across strategy, cybersecurity, audit, GRC and regulatory readiness. Every engagement partner-led.
signifysolution.comConsulting, new age. Seven practitioner-built products — the tools that stay behind at clients as running value.
signifyhive.comPlay, test, think. Games, assessments, simulations and Points of View — learn the work by doing it.
signifyinsights.com You are hereConsulting, sustained. Time-boxed, and scope-boxed engagements at transparent rates. Clear pricing. Explicit scope.
signifyimpact.com