01 / BASIS
What was examined
Selected controls, applicable criteria, system state, evidence references and observation window.
BOUNDED CONTROL ASSESSMENT
What does the evidence establish about selected controls?
Examine defined control questions against agreed criteria for a specified system, configuration and period. Trace each finding to the records examined and preserve the gaps.
A control described in a policy or mapped to a framework is not, by that fact alone, evidence that it operated effectively.
Explore the assessment scope →Who it serves
For teams examining whether selected controls work as intended.
Security, AI governance, risk and leadership teams seeking evidence about selected controls in a specific system and operating context.
Agreed before work
Define the examination boundary.
| Scope element | What we agree |
|---|---|
| Subject | System, version, configuration, environment and accountable owner. |
| Question | Claim, control or decision to be examined; applicable criteria. |
| Evidence | Available records, permissions, provenance, exclusions and observation period. |
| Delivery | Named responsibilities, duration, client effort, fees, report recipients and permitted reliance. |
Deliverable
What you receive.
A scoped assessment report linking the selected control questions to evidence, verification, findings and material limitations.
02 / FINDINGS
What the record supports
Verification performed, findings against the criteria, exceptions and conflicting or missing evidence.
03 / RELIANCE
Where the conclusion stops
Unresolved questions, exclusions, material limitations, report recipients and permitted reliance.
After the report
Proceed, refine or stop.
The report informs your next decision. Any further examination or remediation support requires a separately agreed scope; there is no obligation to continue.
Where records cannot support a finding, the report states that limitation. Additional evidence or a changed system state may require a new examination.
Notably Absent
Keep the conclusion inside the evidence.
No conclusion about controls, versions, environments or periods outside the agreed scope.
- No general claim of system safety, security or regulatory compliance.
- No certification, accreditation or external recognition implied by the report.
- No assumption that a framework mapping or policy proves operating effectiveness.
Common questions
Before you enquire.
How much does it cost and how long does it take?
Fees, duration and client effort are quoted after commercial qualification. They depend on scope, access and the condition of the records.
Who performs the work?
The proposal identifies responsibility and the competence needed. Relevant conflicts are screened before acceptance; unmanageable conflicts exclude the work.
Can we send records now?
No confidential records or credentials should accompany an initial enquiry. Evidence exchange follows agreed permissions and secure handling arrangements.
Initial discussions establish fit and commercial scope. Technical analysis, study design, validation and advisory work begin only under an agreed paid scope, after independence and data-handling checks and payment. Please do not send confidential records, personal datasets or credentials with your first enquiry.
Start with a non-confidential description of the system, control question and record types available.