What does our audit committee answer on digital risk ?
Past fifty people, the question is no longer whether somebody is taking care of it, but what the organisation is able to produce. The central tier keeps a register that can be exported as it stands, holds a monthly committee, runs the impact assessments, and answers within twenty-four hours.
- Price25 000 € excluding VAT a year
- Lead time12-month term, billed quarterly
- Who it is fora mid-cap, a biotech, a firm of 50 to 250 people
11committees a year
Held by the cabinet, not by youThe agenda, the chairing, the minutes and the follow-up of decisions are the cabinet's responsibility. A committee the client has to prepare does not get held.
Your audit committee asks what the organisation can produce on digital risk, and your own large clients audit their vendors. The central tier starts with a forty-hour initial audit, including the mapping of data flows and vendors, with a session for your executive team. It then keeps a live register of your sites, flows, vendors and artificial intelligence systems, updated at every change rather than once a year, and exportable as it stands for an inspection. The cabinet holds eleven committees a year, agenda, chairing, minutes and follow-up included, runs the impact assessments and the annual vendor review, delivers two training sessions and a board module, and answers an incident within 24 working hours with ten incident hours included. One hundred and twenty engineer hours a year are in the allowance. 25 000 € excluding VAT a year, billed quarterly.
What an audit committee can demand, produced.
- A forty-hour initial audit, with the mapping of flows and vendors, and a session for your executive team.
- A live register of sites, flows, vendors and AI systems, exportable as it stands for an inspection.
- A monthly committee, eleven a year, held by the cabinet with its agenda and its minutes.
- The impact assessments, the evaluation of AI systems where they are used, and the annual vendor review.
- Two training sessions, a board module, and a standby answering within 24 working hours with ten hours included.
Audit and mapping
Forty hours, flows and vendors mapped, a session for your executive team.
Committee
Ninety minutes, agenda sent in advance, decisions recorded, hours account presented.
Register
Updated at every change, not at every committee.
Standby
An answer within 24 working hours, ten incident hours included.
The limits, in writing.
An engagement that does not state its limits lets the client discover them at the worst possible moment.
- One hundred and twenty hours a year: beyond that the published hourly grid applies, with written agreement.
- The cabinet is an engineering practice, not a law firm: it produces the technical evidence, your counsel states the law.
- Multi-entity or international perimeters belong to the bespoke tier, costed on the real perimeter.
The central tier, the one regulated organisations take.
VERA OS is offered at cabinet rate on this tier: Cabinet 15 at 690 € excluding VAT a month instead of 790 €.
A first conversation of 30 minutes
No obligation, no access to your systems. We look at whether the step you are considering is the right tool for your situation, and the cabinet says no when it is not.
A signed scoping letter
The perimeter, the read-only access, the people, the delivery date and the firm price. Nothing starts before your signature.
The report, then the decision
A dated report that holds up in front of a third party, a session with your executive team, and the list of gaps ranked. You then decide what follows, or you stop there.
5 questions, 5 answers.
The cabinet's answers, in plain terms. If your question is not here, ask it: the answer comes back to you in writing.
What does the Governance tier cost, and how is it billed?
25 000 € excluding VAT a year on a twelve-month term, billed quarterly in advance, which is 6 250 € excluding VAT a quarter. The 2 900 € sovereignty diagnostic is deducted in full from the first quarter.
What makes the register exportable for an inspection?
It is kept by the cabinet, updated at every change rather than at every committee, and structured around what an inspector actually asks: sites and subdomains, form flows and their recipients, hosting providers and their country, vendors and the access each holds, artificial intelligence systems and their risk level. It leaves in an open format, with its history of decisions and their dates.
Who prepares and chairs the eleven committees?
The cabinet, entirely: agenda, chairing, minutes and follow-up of decisions. A committee the client has to prepare is a committee that stops being held after the third quarter, and that is why the work sits on this side of the contract.
Is VERA OS included?
No, it is a separate product, but it is offered at cabinet rate on this tier: Cabinet 15 at 690 € excluding VAT a month instead of 790 €. The governance contract stands on its own and does not require any product of the cabinet.
What if our perimeter covers several legal entities?
Then this tier does not describe it, and the bespoke tier does: the price follows the real perimeter, with the same method, the same contractual clauses and the same hourly grid. The scoping takes two sessions before any quote.