Security, fraud, and risk — one accountable practice.
Beyond privacy, Mosaic Effect delivers cybersecurity assurance, fraud and identity programs, and enterprise risk management — the same expert-led, standardized methodology, mapped to the frameworks your auditors and regulators already work to.
Cybersecurity assurance & assessment
Independent, framework-anchored assurance — from risk assessment through formal control review — so security posture is demonstrable to auditors, regulators, and your own board.
Cybersecurity Auditing
Independent assessment of whether your security controls are designed and operating effectively against a recognized framework — gap analysis through to a clean evidence trail.
- ISMS and control-framework gap analysis
- Design and operating-effectiveness review
- Findings with a clean evidence trail
Security Risk Assessments
Systematic identification and evaluation of the threats, vulnerabilities, and impacts to your information assets — producing a prioritized, defensible risk treatment plan.
- Asset, threat, and vulnerability mapping
- Likelihood and impact scoring
- Prioritized, signable risk treatment plan
Threat & Risk Assessments (TRA)
Government-grade TRAs conducted against the CCCS Harmonized methodology within the ITSG-33 lifecycle — documenting residual risk to support an Authority to Operate.
- CCCS Harmonized TRA methodology
- Residual-risk documentation for SA&A
- Authority to Operate (ATO) decision support
Fraud & identity assurance
Programs that stop bad actors before the transaction — fraud-risk governance and identity proofing to recognized assurance levels.
Fraud Risk Management
End-to-end fraud-risk programs — governance, prevention, detection, investigation, and response — assessed or designed against the COSO/ACFE standard of practice.
- Fraud-risk governance and ownership
- Prevention and detection control design
- Investigation and response playbooks
Identity Assurance & Verification
Identity proofing calibrated to the right level of confidence for each service — mapped to NIST assurance levels, the TBS standard, and the Pan-Canadian Trust Framework.
- Identity Assurance Level (IAL) calibration
- Proofing and verification design
- Pan-Canadian Trust Framework alignment
Authentication & Authorization
Authentication and access design evaluated against required assurance levels — including multi-factor and credential-lifecycle controls that hold up to misuse.
- Authenticator Assurance Level (AAL) review
- Multi-factor and credential lifecycle
- Access and authorization controls
Enterprise risk management
The connective tissue — controls testing, risk registers, and treatment planning that turn scattered findings into a single, governable view of risk.
Enterprise Risk Management
Organization-wide risk programs that integrate identification, analysis, and treatment into how decisions actually get made — not a binder that sits on a shelf.
- ISO 31000 / COSO ERM program design
- Risk appetite and tolerance framing
- Governance and reporting cadence
Controls Testing & Assurance
Design-adequacy and operating-effectiveness testing of the controls that matter — giving management and the board defensible assurance that they actually work.
- Design and operating-effectiveness testing
- Three-Lines assurance mapping
- Control gap and remediation tracking
Risk Registers & Inventory
A structured, filterable catalogue of risk — each entry with owner, likelihood, impact, current controls, and treatment status — built as the operational backbone of the program.
- One row per risk, with owner and rating
- Residual-rating calibration (High / Moderate / Low)
- Harmonized across the portfolio
Risk Assessment & Treatment
Facilitated assessment that identifies and evaluates risk against your criteria, then produces a treatment plan — accept, mitigate, transfer, or avoid — that someone can sign.
- Facilitated risk identification
- Evaluation against agreed criteria
- Signable risk treatment plan
Mapped to the standards your auditors already work to.
- ISO/IEC 27001
- ISO/IEC 27005
- NIST CSF 2.0
- NIST SP 800-30
- NIST SP 800-63
- ITSG-33
- CCCS Harmonized TRA
- CIS Controls v8
- ISO 31000
- COSO ERM
- COSO / ACFE Fraud Risk Management
- IIA Three Lines
- Pan-Canadian Trust Framework
Start a conversation.
Tell us about your program, the regulators in scope, and the deliverable you are trying to produce. We reply with a named practitioner, a proposed window, and a scoping call — not a marketing sequence.