How we work

The loop

• Discover — what is actually here. Not the diagram, not the license list. What people do, what it runs on, what it costs, who owns it.
• Attribute — connect the spend to the thing it was supposed to produce. This is the step almost nobody has done, and the step everything else depends on.
• Prove — establish the measure before anything changes, so the result can be demonstrated rather than claimed.
• Govern — give each risk an owner, a rule, and evidence that the rule is followed. Governance without evidence is a document.
• Optimize — change the thing, then measure it again. The second measurement is the whole point and it is the one that gets skipped.

We call it the Assurance Loop. The name matters less than the fact that it closes: a recommendation with no second measurement is an opinion with a deliverable attached.

What we inspect

Five connected dimensions. We call them the Value Assurance Stack, and they are the same five whether we are looking at an AI portfolio or a dental practice.

• Capacity — is what you have matched to what you need, reliably, at a cost you can defend?
• Access — who can reach which systems, models and data, and under what controls?
• Provenance — can a number, a document or a decision be traced back to something reliable?
• Compliance — are the obligations that apply to you built into how the work happens, and can you show it?
• Attribution — can what you spent be connected to what it produced?

And underneath them, the operating layer — ownership, decision rights, review cadence, and enough visibility that somebody notices when it stops. We call that Operating Assurance. It is what decides whether any of the other five stay true after we leave.

Two of the five can be inspected. Three often cannot

Capacity and access can be examined directly. There are systems, there are settings, there are invoices.

Provenance, compliance and attribution usually cannot be inspected, because the evidence they would depend on was never built. Nobody recorded where the number came from. Nobody wrote down which obligation maps to which step. Nobody connected the spend to the outcome.

When that is the case, the finding is not "we could not assess this." The finding is that the organization cannot answer a question it is about to be asked — and the first piece of work is building the thing that can answer it.

Every finding comes back with a decision on it

At a small business, in the words an owner uses:

• KEEP — it works, leave it alone.
• IMPROVE — right idea, wrong execution.
• RETIRE — you are paying for it, working around it, or doing it twice.
• GOVERN — it works, and it is a risk.
• SPREAD — one of your people solved it; everyone should have it.

At a large organization, in the words a board uses:

• STOP — it is not returning, and the evidence says so.
• SCALE — it is returning, and it is underfunded.
• FIX — the value is real and the execution is not.
• GOVERN — it is running, and nobody owns the risk.
• FUND — it is worth building, and here is what it should produce.

Same five decisions. Same evidence standard. Different rooms.

Where we stop

We measure, specify, run the project, and hand it over. We do not run your systems afterwards and we do not sell you the thing we recommended.

On anything regulatory we drive to readiness and write the evidence trail. Your attorney, carrier, privacy officer or compliance lead verifies and signs. We have never been the signer and we would not want to be.

We do not issue audit opinions, assurance opinions or certifications.