From your problem to a printed box.
Five steps, in order. Name what happened, test whether it actually repeats, match it to a box that already exists, agree the boundary in writing, then run it. None of it is bespoke — and that is the whole point.
Tell us what happened. We will point.
There are thirty-five engagements and fourteen subscriptions on this site, and nobody should have to read all of them to find the two that apply. Answer whichever of these three questions you can actually answer.
Three ways in, one menu.
However you arrive, you land on the same printed boxes. Pick the lens that matches how you are thinking about it today.
By what happened
A finding, a breach, a regulator letter, a board question you could not answer. Name the event and the catalogue narrows to the two or three engagements that address it.
Start small →By who is asking
An audit committee, a CISO, a DPO, a CFO holding the budget. Each one buys a different shape of the same work, and each has a page written for them.
The catalogue →By how you pay
One artefact kept alive on a rhythm, or a plan year of discrete engagements. That choice is Step 03 below, and the work decides it — not the sales conversation.
All fourteen subscriptions →See all ten triggers, five roles and four shapes+
By what happened.
The sentence that made you open this site. Find the closest one — the match does not have to be exact, and if none of them fit, that is worth a call rather than a catalogue.
“A regulator, insurer or client questionnaire asked for evidence we could not produce.”
The gap is almost never the control — it is that nothing shows the control ran. Start where the evidence is thinnest.
“A new head of function inherited a plan they did not write.”
Before executing someone else’s plan, establish what the plan should have covered. Both of these exist for exactly this quarter.
“Our risk register is a year old and nobody in the room believes it.”
The common case, and the reason Impact exists. A rebuild alone buys you nine months; the rhythm is what keeps it true.
“The board asked what our AI exposure actually is.”
A usage audit answers what is running, who approved it, and what data it touches — before a policy is written about it.
“We are mid-way through an SAP implementation and nobody is testing it.”
Three separate questions — the architecture, the access model, and the business processes riding on it.
“We need a Data Protection Officer and do not have one.”
Either we hold the role or we audit the framework. We cannot do both, and the choice is yours before you buy.
“Two decks in the same meeting showed different numbers.”
Fix the definitions and the feeds first; a dashboard built on data nobody trusts is a faster way to be wrong.
“Our policies exist but nobody has opened them since approval.”
A policy without a named owner and a review date is a document, not a control.
“We are about to offshore, or already have and it is not working.”
One diagnostic and one audit, depending on whether you are deciding or reviewing.
“We have never had our defences tested by anyone outside.”
Start with the maturity picture if you want a plan; start with the test if you want the truth.
How it works · The client journey
By who is asking.
Different chairs buy differently — not because we price them differently, but because what they are accountable for has a different shape.
Chief Audit Executive
You execute an approved plan of discrete engagements.
Typically buys: Credits, spent as the plan demands
The internal audit catalogue →Chief Information Security Officer
You hold a posture that has to stay true between board meetings.
Typically buys: A subscription, plus audits you commission
Cybersecurity →Chief Financial Officer
You fund broadly and commission narrowly.
Typically buys: Usually a plan subscription — a block worth buying at once
The seven plan years →Chief Compliance / Privacy Officer
You own obligations that move without asking your calendar.
Typically buys: A subscription, because obligations do not finish
Privacy & Data →Transformation Leader
You need a diagnostic before the program is judged.
Typically buys: Discrete assessments, then a referral
Assurance Consulting →How it works · The client journey
By how you want to pay.
Decided by the work, not by the sales conversation — but if you already know which shape your budget takes, start there.
A roadmap first
Not ready to commit a year to a firm you have not worked with. Leave with the requirements written and the year sequenced.
Priced as: a flat two-week fee, credited in full if you subscribe
Start small →A subscription
One permanent artefact, rebuilt once and then kept alive on a published rhythm.
Priced as: a year — a baseline, then a recurring number
Every subscription →A plan year
A named block of discrete engagements, bought at once because the block is what a committee approves.
Priced as: credits, at a published rate, committed as a year
The seven plan years →Your own plan
Tick the engagements your approved plan calls for and watch the credits, cost and quarters settle.
Priced as: credits, nothing leaves your browser
Build a plan →Still not sure? The honest answer is that the first call is faster than this page. We will tell you which shape fits, and if neither does, we will say that too — thirty minutes, no deck.
Does the work actually repeat?
This is the gate, and it is worth failing. Impact is built for work that recurs; if yours does not, a published box is the wrong instrument and we will say so before you buy one.
Does it come round again?
A register that decays, a control set that drifts, a framework that needs re-walking. Work that finishes once does not need a rhythm.
If no — buy the single engagement instead.Can it be time-boxed?
We have to be able to say how long it takes before we start. Where that honestly depends on what we find, we say so rather than printing a number we cannot hold.
If no — it is consulting, not a product.Can the scope be written first?
Everything in the catalogue has a boundary you can read before you buy. If yours cannot be written down in advance, a published box is the wrong instrument.
If no — the honest route is Signify Solution.A subscription, or engagements.
Which one applies is decided by the work, not by the sales conversation. Each shape states its full terms here — who it suits, what you give up, what it cannot do, and how you leave — including the part most vendors leave for the renewal call.
A subscription
Every number is published on the destination page — and it is the same whether you ask in January or September.
Suits you when
- 01The artefact is permanent — a risk register, a privacy operation, a policy set. It does not finish, so neither does the work
- 02Decay is the enemy. What you own is accurate today and will not be in nine months unless somebody tends it
- 03You want one number in the budget and one readout a quarter, not a procurement cycle each time
What you give up
You pay in quarters where nothing dramatic happens. That is the deal — you are buying the absence of decay, and the quarters where it feels quiet are the quarters it is working.
What it cannot do. It cannot deliver a one-off piece of work. If you need a single audit of a single process, a subscription is the wrong instrument and we will say so.
How you leave
Cancel at the end of any paid term. The artefact and its history stay yours, exported in full — we do not hold your register hostage to a renewal.
Back to the front ↺Engagements
Every number is published on the destination page — and it is the same whether you ask in January or September.
Suits you when
- 01You have an approved plan of separate pieces of work — four audits this year, not one continuous obligation
- 02Each piece has a beginning and an end, a printed box, and a report that lands
- 03You want to redirect mid-year without renegotiating — buy the balance, decide the mix as the plan changes
What you give up
Every engagement is scoped and priced before it starts, so nothing is open-ended — but nothing is continuous either. Between engagements, nobody is tending anything. Prepay a balance and a published discount applies; that is the only discount here.
What it cannot do. It cannot give you continuous monitoring. Credits buy work that happens, not work that watches — if the thing you need is somebody noticing between quarters, you want the other shape.
How you leave
Unspent credits do not expire while you are subscribed, stay redeemable for twelve months after, and are refundable at what you paid. We do not earn on credits you never spend.
Back to the front ↺Everything below this point governs the second shape. It is the only place on this site where the credit mechanics are explained — every other page links here rather than repeating it.
The journey in full, first click to first pack+
How it works · The client journey
From first click to first pack.
The price is visible at every step. Nothing below asks you a question we don’t use.
- 01Pick a subscription — scope and price are already on the page
- 02Configure — 8 questions, about 3 minutes. Firmographics and readiness only; we never collect risk content at intake
- 03Scope Confirmation — your tier, your price, and an indicative scope sheet, in writing
- 04Book the call — straight into a live calendar. Fallback: request assignment, answered within one business day
- 05Conflicts & independence screen — completed before any consultant is assigned. For a governance firm this is non-negotiable
- 06Discovery → proposal → signature — MSA and SOW, signed electronically after the human conversation, not inside a funnel
- 07Kickoff — normalization begins; your portal is provisioned
Why the call opens at “which tier and when.”
Nobody signs a five-figure annual subscription from a web form, and we don’t pretend otherwise. Procurement, security review, insurance certificates and a W-9 all sit behind a real buyer — so the site’s job is to get the anonymous work done in public: scope understood, tier identified, price anchored.
Your configurator answers reach the consultant as a briefing before the call. You will not be asked to “tell us about your organization” after you already typed it in.
And if we’re not the right fit — too small, wrong sector, a conflict — we say so directly and, where we can, point you somewhere better. A decline is an answer, not a dead end.
Scope confirmed, in writing.
Nothing starts on a conversation. Before any work runs you get a Scope Confirmation you can take to a committee — what is in, what is out, who signs it, and when it lands.
What is in
Every deliverable named, with the quarter it lands in. If it is not on that page, it is not in the engagement.
What is out
The boundary stated explicitly, so scope growth is a new conversation with a new number rather than a quiet drawdown.
Who signs
A named partner on the scope lock and on the report. Extra work is quoted before it starts, never discovered afterwards.
Every price on this site is published on the page that sells the work — the same number in January and in September, whoever is asking.
How it works · The client journey
The box is the product.
Scope discipline is not small print here — it is the mechanism that keeps the recurring price — and the credit menu — honest. Three rules, applied without exception:
1. Work outside the box is Signify Solution scope. It is named, quoted separately at day rates, and never silently absorbed into your subscription.
2. Scope changes travel through a visible request flow in your portal — a product feature, not an awkward conversation.
3. Partner involvement is concentrated at kickoff, the calibration workshop, and your readouts — the moments where partner judgment changes the outcome.
How Impact and Solution fit together →Normalize → Refresh → Renew.
Sequential by nature — which is why these three get numbers.
Normalize — the rebuild
The artefact is rebuilt to the published methodology: described, scored, owned by name, and running in the platform. This is the only part that happens once.
You now hold a true artefactRefresh — the loop
Owner interviews, the artefact re-tested against what actually changed, one pack and one readout for leadership. The same shape every quarter, so the cost of the quarter is knowable in advance.
Value sustained, not rediscoveredThe compounding part
Because the baseline never goes stale, each quarter starts from the last one rather than from scratch. The work gets cheaper to keep true than it was to build — that is the whole economic argument for a subscription.
Decay never re-accruesRenew — or leave
Renew for another year, or stop. The artefact and its full history export with you. Nothing is held hostage to a renewal conversation.
You keep the work either way- 01You approve the go-live date — nothing mobilises before that date is agreed in writing, so the start is yours to set rather than ours to announce
- 02Phased scoping and capacity planning — a short, partner-led pass with your team that sizes the work against the people who will actually do it, phase by phase
- 03Mobilisation inside one to two weeks — the plan is stood up quickly once scoping lands, because the scope was settled before the clock started
- 04Two engagements in flight at a time — a published rule, not a capacity excuse: a partner signs every report, and a gate that queues is honest where a gate that is skipped is not
How credits work, mechanically.
The rules that govern the balance, and the four things it deliberately cannot buy. Both printed here rather than discovered later.
- 01They don’t expire while your subscription is live, and stay redeemable for twelve months after it ends
- 02Unused credits are refundable at the rate you paid, less any volume bonus you received and didn’t use
- 03Balances are protected if the published rate ever changes — what you bought is what you hold
- 04The balance lives in the Impact Platform, beside the engagement files it buys — this website has no accounts and isn’t getting any
- 01Solution work — investigations, remediation, control redesign, transformation. Named and quoted separately, never absorbed
- 02Automatic assignment — every redemption passes the independence screen. If serving you would compromise the work we decline, and the credits stay yours, unspent
- 03Our own quality review — we cannot co-source your function and then assess it. QAR stays off the menu while we hold the bench
- 04A shortcut past the rebuild — the universe and plan come first, or the menu is guesswork with a price on it
Ready to see a box you can hold us to?
Three disciplines, scope printed, prices attached. Start with the risk register or bring us the discipline that hurts most.
Part of the Signify family
Solve · Build · Teach · Sustain. Four properties, one design language — consulting, software, interactive learning and sustained advisory, built in Philadelphia since 2019.
Premium management consulting across strategy, cybersecurity, audit, GRC and regulatory readiness. Every engagement partner-led.
signifysolution.comConsulting, new age. Seven practitioner-built products — the tools that stay behind at clients as running value.
signifyhive.comPlay, test, think. Games, assessments, simulations and Points of View — learn the work by doing it.
signifyinsights.com You are hereConsulting, sustained. Time-boxed, and scope-boxed engagements at transparent rates. Clear pricing. Explicit scope.
signifyimpact.com