External Audit Services
Some questions can't be answered credibly from inside an organization. When something has gone wrong — an outage, a breach, a program that's drawn public or regulatory scrutiny — or when a board, a regulator, or a customer simply needs assurance that isn't self-reported, an external audit is what provides it. The value of bringing someone from outside isn't just a fresh set of eyes; it's that the findings carry weight a self-review can't, precisely because the auditor has no stake in the outcome looking a particular way.
This covers a range of work: investigating the root cause of a specific incident so leadership actually understands what happened and why, rather than the sanitized internal version; independently assessing whether a program or system is operating the way its policy or its public commitments say it should; and providing the kind of documented, defensible findings that hold up in front of a board, a city council, a regulator, or in litigation.
How I'd approach an engagement
Every audit starts with agreeing exactly what question it's answering — a vague mandate produces a vague, unhelpful audit, and the scoping conversation is where I earn my fee before I've even started looking at anything. From there, it's a real investigation: reviewing systems, documentation, and logs where relevant, and talking directly to the people who were actually involved, internally and with any external vendors or partners connected to the incident or program, rather than relying solely on the official account. I write findings that are specific and evidence-based, say plainly what went wrong and why, and give recommendations that are genuinely actionable — not generic "improve your processes" language that nobody can act on.
I report findings honestly, including the parts that are uncomfortable for the people who hired me. An audit that only tells you what you wanted to hear isn't worth having, and it won't hold up to the scrutiny it was commissioned to survive.
If you need an independent, credible outside review — of an incident, a program, or a system — get in touch and tell me what happened and what you need to know.