Verolara › Engagements
Engagements
Every engagement follows the same four stages: a written scope, a clear assessment, senior-led delivery, and a defined finish.
Scope
We reply by email, usually within two business days, and may offer a short call if it looks like a fit. Timeline, fee and what we need from you are agreed in writing before work begins.
You receive: A written scope
Assess
Context and scoping, stakeholder interviews, and a control gap analysis against ISO/IEC 42001 and the NIST AI RMF.
You receive: AIMS Scope and Context Summary; Control Traceability and Gap Matrix
Deliver
A risk register, a prioritized roadmap and a 60-minute executive briefing. Senior-led, with a named owner on your side and regular check-ins.
You receive: Qualitative AI Risk Register; AI Readiness Report
Hand off
A stated end state and end date, with skills transfer for your people written into the scope.
You receive: A defined finish and a team that can run it
A typical AI governance readiness review takes four to eight weeks for a mid-sized organization, and smaller organizations are usually faster. The written scope sets the actual timeline. A review is an advisory assessment, not a certification or attestation.
How we work
Senior-led
Engagements are led by the founder. Where a scope calls for specialist depth, such as privacy or cloud security, we may bring in specialists we have vetted, under the same written scope and confidentiality terms. We remain accountable for the deliverable.
Inside your environment
We work in your environment, with access you issue, wherever that is practical. We do not work from your data on our own systems.
Independent
We do not resell software, and we do not accept referral fees from software vendors, auditors, or CPA firms. A licensed CPA firm performs SOC 2 examinations and issues the report. We do not perform or resell penetration testing.
How engagements end
Every engagement has a stated end state, a hand-off date, and skills transfer for your people written into the scope. The result is a working program, a named owner on your side, and a leader who can run it, not a report that stops at findings.
Ongoing leadership
When you need leadership without the full-time hire, retainers are scoped in writing, from a few hours a month to a fuller commitment, and always with an end date.
vCISO and governance lead
Security advising, board alignment, and ongoing risk posture.
BISO and embedded partner
Connecting security strategy with business-unit execution.
Transformation delivery
Delivery governance, vendor oversight, and program office build-out.
Risk and vendor advisor
Operational risk, executive risk reporting, and third-party control.
Six questions to answer before someone else asks
- Can you list every AI system in use, including tools staff adopted on their own?
- Does each one have a named, accountable owner?
- Do written rules say what data may go into AI tools?
- Do you know how your vendors use AI with your data?
- Is there human review wherever AI informs a decision about a person?
- Could you produce proof within a week if asked?
Any question that takes more than a day to answer is where a review usually starts. Not an assessment or a certification. Talk through your answers.
Confidential by default: a mutual NDA is available before you share anything sensitive.
Samples of our work
An excerpt of what a review produces, shown on a fictional organization, Northwind Health, so you can judge the depth before you commit to anything. Illustrative only: nothing here comes from a client engagement, and no results are implied.
| ID | Scenario | Rating | Recommended treatment | Owner role |
|---|---|---|---|---|
| R‑01 | A clinical note summarizer sends patient information to a third-party model with no data-use restrictions in the contract | High | Add data-use, retention, and training restrictions to the contract; confirm the vendor attestations; restrict inputs to approved fields | Privacy lead |
| R‑02 | Staff paste confidential documents into a public chatbot | High | Publish an AI acceptable-use policy; run a short staff briefing; offer an approved alternative | Security lead |
See the full sample: risk register and control gap matrix →
Published analysis, drawn from public and independent sources