Privacy, risk and assurance. Everything we do, on one method.
Expert-led privacy, security and risk work for Canadian public- and private-sector organizations. Every engagement starts with a written scope and ends in a standardized report your reviewer can sign.
What we do
Every service, in one list.
Privacy first, then the security and risk work around it. Each service ends in the same standardized report.
Privacy
01 · PIA
Privacy Impact Assessments
Typical timeline: 1–2 weeks
Full privacy impact assessments for programs and systems, led and signed by a named senior privacy practitioner.
- Aligned with the TBS Directive on Privacy Practices, FIPPA, PHIPA and PIPEDA
- One risk register, harmonized across your portfolio
- Standardized report shape, ready for sign-off
02 · TPP
Third-Party Privacy
Typical timeline: 1–2 weeks per vendor review
Vendor privacy assessments across your vendor portfolio, plus the renewal gate that keeps them defensible. Vendor risk surfaced at intake, not after the incident.
- Vendor intake gate and tier classification
- Standardized vendor assessment shape
- Renewal gate so each vendor stays defensible
03 · BR
Breach Response
Senior privacy support inside your incident command: containment, evidence preservation, regulator notification and the post-mortem, within the regulator's clock.
- Containment and evidence-preservation support
- Regulator report and notices, as soon as feasible
- Post-incident program remediation
04 · OPO
Outsourced Privacy Office
Run your privacy program with a fractional team: policy stewardship, incident handling and access-request triage, on a standardized monthly cadence.
- Policy stewardship and annual refresh
- Incident and access-request inbox, managed
- Monthly program report for leadership
05 · VQA
Privacy Training (VQA)
Privacy training built for your department: a video module for each required topic, watched at each person's own pace, then a facilitated group Q&A that confirms understanding.
- Custom curriculum per department
- Self-paced video modules
- Group Q&A session and completion record
Security & risk
06 · Cyber
Cybersecurity assurance
Independent, framework-anchored assurance, from risk assessment through formal control review, so your security posture is demonstrable to auditors, regulators and your board.
- Control reviews against ISO/IEC 27001, NIST CSF 2.0 and CIS Controls v8
- Security risk assessments (NIST SP 800-30, ISO/IEC 27005)
- Threat and risk assessments to ITSG-33 and the CCCS Harmonized TRA, supporting an Authority to Operate
- Penetration tests coordinated by us and performed by an independent subcontractor
07 · Fraud
Fraud & identity assurance
Programs that stop bad actors before the transaction: fraud-risk governance, and identity proofing to recognized assurance levels.
- Fraud risk management (COSO / ACFE Fraud Risk Management Guide)
- Identity assurance and verification (NIST SP 800-63, TBS standard, Pan-Canadian Trust Framework)
- Authentication and authorization review (NIST SP 800-63B)
08 · ERM
Enterprise risk management
Controls testing, risk registers and treatment planning that turn scattered findings into one view of risk someone can govern.
- Enterprise risk programs (ISO 31000, COSO ERM)
- Controls testing (COSO Internal Control, IIA Three Lines)
- Risk registers: one row per risk, with an owner and a High, Moderate or Low rating
- Risk assessment and a treatment plan someone can sign
Four moves, in order, every engagement.
The same four steps under every engagement. The deliverable changes; the discipline does not.
Four moves · One spine
- 01
Map the data, not the policy.
We start with what's collected, where it goes, who sees it and how long it's kept.
- 02
Calibrated against precedent.
Every risk is scored on the same severity scale, every time.
- 03
One standardized report.
One report shape, so review boards always know where to look.
- 04
Regulator-readiness review.
Quality check, client review and a final readiness check before anything ships.
Mapped to the standards your auditors already work to.
- PIPEDA
- Quebec Law 25
- Alberta and BC PIPA
- Privacy Act
- TBS Directive on Privacy Practices
- ISO/IEC 27001
- ISO/IEC 27005
- NIST CSF 2.0
- NIST SP 800-30
- NIST SP 800-63
- ITSG-33
- CCCS Harmonized TRA
- CIS Controls v8
- ISO 31000
- COSO ERM
- Pan-Canadian Trust Framework
Governing AI, or shipping an AI agent?AI Governance →
Start a conversation.
Tell us about the agent or the system. A senior practitioner replies with a scoping call.