After an incident, investigators and insurers ask you to prove your security was reasonable. I audit the documents behind your controls, score them from 0 to 100 and give you a prioritised list of fixes, before anyone else looks.
Book a free 20-minute callScore a procedure free
No obligation. I reply within one business day.
Most organisations have the gate, the guard and the alarm. Far fewer have the written procedure that shows who decided what, why, and when it was last checked.
After an incident, investigators and insurers do not ask whether you had security. They ask you to prove it was reasonable. If the paperwork is missing, out of date or generic, the control counts for little, and the people who signed it off are exposed.
I measure that gap before someone else does.
Thirty seconds on why a control you cannot evidence counts for so little after an incident, and how to score one of yours for free.
Ten questions. Your answers stay in your browser.
Test the procedures behind your physical security before commissioning, not after the incident, and give your board, investors and insurers a score they can rely on. How the data centre audit works
In New Zealand and Australia, officers carry a personal duty of due diligence on health and safety. An independent score shows the board asked the question.
Martyn's Law is expected to apply in the UK from spring 2027. Venues for 200 or more people will need public protection procedures; those for 800 or more must document them for the regulator. Martyn's Law explained
Security plans are only as strong as the procedures behind them. Have yours tested independently, against the threats they are meant to stop.
Show that the decision was documented before the money moved. Start with the five-question Documentation Test.
Share the procedures, policies or plans you want tested. Everything is handled in confidence, under a non-disclosure agreement if you want one.
Each document is assessed against the threats it is meant to address, using the Prouse Forensic Index: 0 to 39 fragile, 40 to 75 marginal, 76 to 100 robust.
A scorecard, a prioritised list of fixes and a briefing call. You know where you stand and what to do first.
Book a free 20-minute callNo hourly billing. You know the cost before you send a single document.
One critical procedure tested end to end, with an initial score and a gap summary. The fee is credited in full against a gap analysis booked within 30 days.
Start with one procedureUp to ten core policies and procedures: a scorecard for each, a ten-page prioritised roadmap and a 30-minute briefing for you or your board.
Discuss a gap analysisYour documents re-tested every quarter, an updated scorecard each quarter, and a reply within one business day after an incident.
Ask about the retainerAlso available: associate work for consultancies at US$400 a day. All services and terms
AnalysisAn analysis of the documentation gaps facing investors in the most anticipated technology listing of 2026. Read the article
ResearchThe working paper behind the method, published on SSRN in January 2026. Read the summary
Free handbookScore any procedure in ten minutes, with a procedure template, a document register and a 30-day plan. 23 pages, free. Get the handbook
No. It is an independent risk assessment of your documentation, designed to sit alongside the advice of your lawyers and insurers.
Documents arrive by encrypted link or email, are stored in an encrypted folder, are used only for your engagement and are deleted 90 days after the final report unless you ask otherwise. An NDA is available before you send anything.
Yes. The audit is a document review, so it is done remotely for clients anywhere. Travel is possible when a site visit is needed.
Then you have an independent score that says so, which is worth having in front of a board, an insurer or a regulator.
Five working days for a single procedure and fifteen for a full gap analysis, counted from the day your documents arrive.
Twenty minutes, no cost. Tell me what you are responsible for and I will tell you whether an audit would help, and what it would involve.
Or email richard@confidentialriskconsulting.com
Confidential Risk Consulting