Advisory and assurance
Organisations now build, buy and prompt their way into new systems faster than anyone can check them. We are the independent engineers who check: we review, test and advise on systems, AI and technology decisions we did not build, and say plainly what we find.
Why now
Effective from 1 January 2026, it expands the board's duty to govern data, information and technology, including AI. Directors need a view that does not come only from the people who built the systems.
AI tools let small teams ship in days. A 2025 scan of one AI app builder's public showcase found 170 of 1,645 apps exposing database tables to anyone holding the public key (CVE-2025-48757).
POPIA already requires reasonable security measures. South Africa's AI policy is expected in 2027; until then ISO/IEC 42001 and the NIST AI Risk Management Framework are the benchmarks serious buyers ask about.
Named engagements
Each engagement is agreed in writing before it starts: what is examined, by when, what you receive and what it costs. Nothing grows by the hour.
Areas of practice
Sign-in, data access rules, exposed keys, APIs and personal data, tested before launch. Ranked findings, a fix list, one re-test and a signed letter.
R18,500 fixed → Before you invest or acquireWhether the product is built the way the pitch says: architecture, security, scalability, key-person risk and the cost of what has to be fixed.
R23,500 fixed → AI you already use or plan toWhere AI touches your data and decisions, measured against ISO/IEC 42001 and the NIST AI Risk Management Framework, with a register of systems and the controls each needs.
Fixed fee after scoping → For directors and risk committeesA clear view of data, information, technology and AI risk in board language, aligned to King V, with an independent periodic report your committee can rely on.
Quoted → Before you build or signA second opinion on a proposed architecture, a vendor's proposal or a build quote: what it will cost to run, where it will fail, and what to ask before signing.
Quoted → When you are choosingRequirements, a shortlist and a scored recommendation. Any partner or reseller relationship we hold is disclosed in writing before we recommend.
Quoted → POPIA, security and ISO/IEC 27001Gap assessments, security scans, readiness for ISO/IEC 27001 certification, and penetration tests run by an independent firm.
From R4,500 → The next 12 to 36 monthsA technology and AI roadmap with costs, risks and decision points, so spending follows a plan rather than the next sales call.
Quoted →How we stay independent
A system we built is reviewed by someone who did not build it. Penetration tests are carried out by an independent firm.
Any partner, reseller or referral relationship that touches a recommendation is disclosed to you in writing before we make it. It is a standing commitment, not a case-by-case choice.
Each finding carries the test or document that proves it, ranked by consequence. Nothing is softened for the person who commissioned the review.
Every report is reviewed and signed by a second engineer before it reaches you.
What we do not do: opinions on financial statements and formal assurance reports under auditing standards belong to registered auditors. We give an independent technical review, prepare you for audit or certification, and work alongside your auditor where one is needed.
How an engagement runs
Who asks us
An engineer who did not design or build a system examines it against a stated standard, tests what can be tested, and reports what was found with the evidence for each finding. The report is signed by two people and says plainly where something is sound and where it is not.
No. Opinions on financial statements and formal assurance reports under auditing standards are the work of auditors registered with the Independent Regulatory Board for Auditors. We give an independent technical review, prepare you for a formal audit or certification, and work alongside your auditor or certification body where one is needed.
No. A system we built is reviewed by someone who did not build it, and penetration tests are carried out by an independent firm. We never mark our own work.
King V, published on 31 October 2025 and effective from 1 January 2026, expands the board's responsibility for governing data, information and technology, including artificial intelligence. Boards increasingly want an independent view of those systems rather than relying only on management's report.
Tell us what you need a straight answer on. If we are not the right firm for it, we will say so and, where we can, tell you who is.