Senior-led, start to finish
The advisor who scopes the engagement delivers it. We do not hand the analysis to a junior bench once the contract is signed.
Approach
A method, not a methodology
We keep the method to three movements and the deliverables to what a decision-maker can use. Frameworks are borrowed only where they earn their place — and named rather than blurred.
Principles
Working principles
Assumptions written down
Every assessment separates what is known, what is inferred and what is guessed. That distinction is the most useful thing a risk analysis can carry.
Decision-grade output
The deliverable answers a question someone has to decide, and names the owner. If no decision follows, the work was the wrong work.
Rehearsed, not just documented
Plans that have never been exercised are hypotheses. We test them with the people who will execute them.
Frameworks named, claims restrained
We work against recognised standards and regulations and say which — and we never present a voluntary framework as legally required or claim a certification we do not hold.
Independence kept intact
No reselling of vendor platforms, no referral fees. We define testing requirements and interpret results; testing itself is delivered by specialist providers.
Method
The three movements
-
Anticipate
Define the decision, the horizon and the warning indicators. Establish what can affect the organisation, and what evidence would show it approaching.
- Exposure and dependency mapping
- Horizon and scenario framing
- Indicator design
-
Understand
Interrogate the assumptions and stress the system: what breaks first, who is accountable, what the organisation can actually absorb.
- Assumption testing
- Governance and control review
- Scenario and stress analysis
-
Act
Convert the analysis into decisions, owners and rehearsals — then review what the exercise revealed and change the plan accordingly.
- Decision and control design
- Exercises and simulation
- Review and institutional learning
Engagement
Ways to engage
- Obligation diagnostic
- A fixed-scope assessment that tells you which obligations apply, where the gaps are and what to fix first.
- Governance & resilience build
- A scoped mandate that builds the governance, controls and evidence you can operate and defend.
- Advisory retainer
- A standing senior relationship: a watched obligation calendar, a horizon-scanning note and a monthly call.
- Exercise
- Tabletop simulation, crisis or cyber scenario, designed and facilitated for your leadership team.
Where are you today?
The AZMA maturity model
One ladder, from unmanaged to optimised, anchors both AI governance and cyber GRC. Read the tier that sounds like your organisation, and the natural next step is the work it implies.
-
1 · Unmanaged
We are not sure what we have, and nothing formal governs it.
Natural next step
Establish the register — an AI Inventory & Classification Sprint, or a Cyber GRC Applicability & Gap Review. -
2 · Emerging
We know the basics and act case by case; governance depends on individuals.
Natural next step
Formalise — an AI Governance Operating Model & Policy Suite, or an ISMS & Control Framework Blueprint. -
3 · Defined
We have documented rules, owners and a repeatable way of working.
Natural next step
Turn the system into evidence — an AI Assurance & Audit-Readiness Pack, then build-and-remediate and audit readiness. -
4 · Governed
We measure, report to the board, and can evidence our position.
Natural next step
Independent review — external assurance or ISO/IEC 42001 readiness, and audit-readiness / pre-assessment support for certification by an accredited body. -
5 · Optimised
We improve continuously, anticipate change, and our posture is a commercial asset.
Natural next step
Standing advisory — horizon-scanning and periodic re-assessment to keep pace with regulation and model supply-chain change.
This is our own diagnostic model, informed by NIST CSF 2.0 and the NIST AI RMF. It is not a published standard, not a certification, and nothing on this page scores you automatically. We apply the same ladder in the first workshop of an engagement to give "where we are" a shared vocabulary.
The observable characteristics behind each tier are set out on the services page.
Under pressure
The method has to hold on the worst day
Preparedness is judged during an incident, not in the plan. That is why governance, analysis and rehearsed response sit inside one consultancy rather than three separate suppliers.
Tell us which decision is in front of you
We will say whether it is a question we are equipped to answer, and what an engagement would involve.