Compliance & Risk
Our Services
We identify where AI removes cost and where it quietly adds risk.
Every engagement begins with a scoping conversation. If a smaller package is the right starting point, we will say so.
AI adoption without governance is a finding waiting to happen. Most firms have a written policy. Far fewer can show who approved a given use, what data went into it, who reviewed the output before it reached an investor, and what happened the last time a model was wrong. Policy without implemented control is theatre, and an examiner can tell the difference. We help you write the policy, define the controls that make it real at the point of use, document the model inventory, and assemble the evidence pack your compliance team needs for SEC examination and LP operational due diligence. We advise on controls and evidence. Your counsel advises on the law.
Controls, Not Policy Documents
We build the AI control set a manager can evidence. That means a model inventory recording every approved use, the system it runs in, the data classification it may touch and the named owner accountable for it. It means logging that captures the prompt, the output, the reviewer and the timestamp, retrievable by compliance without an engineer. It means review gates at the point of use, not in a handbook, so output heading to an investor or a regulator cannot leave without a recorded human approval.
We also build the answer bank: the firm's positions on AI use, data handling, vendors and human oversight, written once, cited to the underlying control, and reused across DDQs, LP questionnaires and examination requests so two teams do not give two answers. Compliance keeps the judgement. We do not set your risk appetite, interpret a rule, or tell you what your obligations are. We document what the firm does, show where practice and policy have drifted, and give your compliance officer and your counsel something specific to rule on.
ai model inventory
usage logging and audit trail
data classification rules
examination evidence pack
ddq and odd answer bank
Building the Evidence Trail
The Diagnostic is paid and time-boxed, and starts with what is already happening. We inventory AI use as it actually is, including tools staff adopted without telling anyone, classify the data each touches, and map that against the policy on paper. It produces a written gap list: where control is absent, where it exists but leaves no record, and where the honest answer is to stop a use until a control exists.
The Pilot governs one use, end to end, with a named owner and a test: the firm must be able to produce, unprompted, a complete record of every instance of that use over the period. Build implements the controls in the systems people work in, because a control staff have to remember is not a control. Run covers monitoring, exception review, refreshing the inventory as tools change, and rehearsing the evidence pack before an examination, not during one.
Diagnostic: inventory AI use as it actually is, and list the control gaps
Pilot: govern one use end to end, and prove the record exists on request
Build: implement controls in the systems people actually work in
Run: exception review, inventory refresh, and rehearsing the evidence pack
