Our five-phase delivery.
Every engagement follows the same five-phase shape: diagnostic, design, build, harden, hand-off. The phases are sized to the program scope, but the shape is consistent. Below is the canonical engagement at a mid-tier-enterprise scope — typically 36 weeks from kickoff to audit-cycle hand-off.
Evidence over decks.
Audit evidence is a release artifact — not a quarterly project. Every phase below ends with control-mapped artifacts in your repository under your license, runnable on day one. Decks are an output, not the deliverable.
Diagnostic to hand-off, sequenced.
01
Weeks 1-4
Diagnostic
A fitness assessment against the audit framework that matters most for your program. The output is a written diagnostic with the dominant maturity level, the top three gaps, and a sequenced backlog with named owners.
Deliverables
- Maturity diagnostic against the IAM model
- Control mapping artifact set (FFIEC / NIST / HIPAA / FedRAMP / etc.)
- Sequenced 12-week backlog with named owners
- Risk-adjusted scope decision for the build phase
02
Weeks 5-8
Design
Reference architecture for the build phase. The design is opinionated — we recommend the platform, the integration shape, and the operating-model decisions. We do not produce option-comparison documents in lieu of recommendations.
Deliverables
- Reference architecture diagrams + written narrative
- Platform selection recommendation (with the trade-off modeled)
- Integration registry — every downstream system mapped
- Operating-model runbook (draft)
03
Weeks 9-20
Build
The first audit-scope workflow shipped end-to-end. Pair-programmed in your tenant with named owners on every workflow. Configuration-as-code in your Git repository; deployment via CI; tests for every policy.
Deliverables
- Production deployment of the first audit-scope workflow
- Configuration-as-code in customer Git repository
- CI pipeline for policy + workflow deployment
- Initial control-test suite running continuously
04
Weeks 21-32
Harden
The 90-day hardening period after the first workflow ships. The long tail of integrations, the exception backlog, and the operating-model muscle memory all get built during this phase. Audit-evidence pipeline runs end-to-end.
Deliverables
- Full integration coverage across the in-scope program
- Exception policy documented and signed off
- Evidence-as-code pipeline operational
- Internal audit dry-run completed
05
Weeks 33-36
Hand-off
Clean handoff to your platform team. Written runbook, exception policy, on-call shadow during the first audit cycle, and a written escalation policy. We do not create dependency — we stay available, but we do not stay needed.
Deliverables
- Written operating runbook — signed off by the customer
- On-call shadow during the first audit cycle
- Quarterly review cadence agreement (optional)
- Escalation policy with named contacts
The four rules every phase follows.
Opinionated, not exhaustive
We make recommendations. We do not produce option matrices in lieu of decisions. If you want a deck with three platforms compared on 47 attributes, we are the wrong firm.
Configuration is code
Production policy lives in your Git repository, not in console screenshots. The audit trail is the commit history. The dashboards are for diagnosis, not for change.
Evidence is a byproduct
Every control test produces an audit artifact as a byproduct of operations. The auditor question is answered in minutes, not weeks.
Hand-off is the deliverable
The engagement is not done when the platform works. It is done when your platform team can run it without us. The runbook is the artifact that signals completion.