The process
How it works
Most engagements are one of the fixed-fee services on our pricing page, and they all run the same way: a 45 minute scoping call that costs nothing, a proposal at the fee we already publish, fieldwork sized to the service, and deliverables produced in two registers, practitioner depth underneath a board pack.
Six steps
From scoping call to board pack
Steps three and four are the two kinds of fieldwork: regulatory readiness services take one, testing and SWIFT services take the other, and some engagements take both.
Step 1
The scoping call
It costs nothing and takes 45 minutes. We ask four things: who regulates you and under which permissions, how many important business services you have mapped, what the regulators have said or asked for recently, and which of the fixed-fee services would close the gap. You leave knowing what we would propose and what it costs.
Step 2
Proposal at the published fee
The proposal carries the same fixed fee you can already see on the pricing page, so nothing in it is a surprise. Accept it and we agree the practicalities: which documents you share, who we interview or workshop with, and the dates the fieldwork runs.
Step 3
Regulatory readiness fieldwork
For the gap analysis: a desk review of your self-assessment, impact tolerance statements and supporting evidence, with interviews or facilitated workshops where the service includes them, so findings rest on how the firm actually operates rather than what the documents claim.
Step 4
Testing and SWIFT fieldwork
For the testing and assessment services: a facilitated severe but plausible tabletop with the people who would handle the real event, or a structured evidence assessment of your SWIFT environment against the mandatory controls, all inside windows agreed in advance.
Step 5
Deliverables, written twice
Every engagement ends in two layers: the practitioner layer (gap registers, documented tolerances, evidence packs, a remediation order) and a board pack that says what matters, what it costs to fix and what to decide. We walk both through with you rather than emailing a PDF and vanishing.
Step 6
Afterwards, your call
Most engagements stand alone. An annual refresh revisits the same ground before your next self-assessment cycle, and a retainer keeps a consultant across your resilience programme year round. Full programme builds are quoted with the workings shown, banded by scope, never dressed up as a fixed-fee service.
One process, two lanes
Regulatory readiness and testing readiness share the path
The regulatory readiness lane covers the services that answer a supervisor: the self-assessment review, the impact tolerance workshop and the DORA gap analysis. Fieldwork here is desk review, interviews and facilitated workshops, and the deliverables are the documents the regime expects to see, gap registers, tolerance statements and remediation plans among them.
The testing readiness lane covers the scenario testing exercise and the SWIFT CSP assessment: work that produces evidence rather than paperwork. Fieldwork is a facilitated exercise or a structured controls assessment, and the deliverable is an evidence pack a supervisor or an attestation can rest on. Same scoping call, same published fees, same two-layer reporting; only the middle differs.
The exchange
What the engagement asks of you, and what it hands back
What it asks of you
- A sponsor who owns the engagement and can receive findings without a committee forming first.
- A few hours from the people who run your important business services, for interviews, workshops or the exercise itself.
- The artefacts you already have: self-assessment, tolerance statements, outsourcing register, test records. Gaps in that list are findings, not problems.
- Diary commitment for any workshop or exercise dates, agreed at proposal stage so fieldwork never drifts.
What it hands back
- A gap register or gap letter with a remediation order, so effort goes where supervisors will look first.
- The documents the regime actually asks for: tolerance statements, self-assessment feedback, exercise evidence packs, attestation-ready reports.
- A board pack written for directors, separate from the practitioner detail, covering what matters and what to decide.
- A walkthrough of every finding, where each one can be challenged before it costs anybody a budget line.
Common questions
What firms ask before they book
Is every engagement one of the fixed-fee services?
Almost always. The services on the pricing page, from the resilience gap analysis to the SWIFT CSP assessment, cover what most firms need, each at a published fee. Where a firm needs a full programme built, we scope it in the open and quote it banded by size and regulatory footprint, using the same logic as the fixed-fee services, one level up.
Who needs to be involved from our side?
The sponsor, plus short sessions with whoever owns the important business services in scope. The heavier fieldwork, reading, mapping and writing, is ours. Workshops and exercises need the right people in the room for a morning or a day, and we agree those names at proposal stage.
Will you need access to our systems or data?
For most services, no: the work runs on documents, interviews, workshops and facilitated exercises. The SWIFT CSP assessment is the exception, needing architecture evidence and configuration extracts for the environment in scope, agreed in writing before fieldwork starts. We never operate your systems ourselves.
What happens once the deliverables land?
The remediation order is yours to run, with or without us. Firms that want the ground revisited take the annual refresh before their next self-assessment cycle; firms that want continuity take the retainer. Both are priced openly with everything else.
Step one costs nothing
Book the scoping call
Bring your regulated status, your IBS count and whatever supervisors have said lately. We will bring the service that fits, its published fee, and a straight view on whether you need us at all.