WolfmarkBook a call

SERVICES

Start small. Each step is useful on its own.

Every engagement starts by establishing what is actually there. What follows depends on what we find.

START HERE

01

AI Control Diagnostic

A read on where AI has entered your reporting path, whether any control relies on its output, and what your auditor will find.

THE CLOSE

Scope: the close, consolidation, estimation, reconciliation and disclosure. Everything else explicitly out.

Typically three weeks.

THE ENTERPRISE

Scope: every process, every business unit, every vendor-embedded system.

Typically six to eight weeks.

The close scope is a complete component of the enterprise scope, not a preview of it. If you start at the close and later widen, the work already done is not repeated.

WHAT YOU RECEIVE

  • Financial-process AI map, keyed to the processes and assertions each system touches
  • Reliance determination per system: does a control depend on the AI output, or does a human re-perform
  • Risk tiering against material misstatement
  • Gap assessment against the control instrument
  • Remediation plan sequenced against your audit calendar
  • A management position on each material gap, written to be taken into an audit committee meeting without translation

Assessed against Wolfmark's gap-assessment instrument: 54 controls mapped to ISO/IEC 42001, the NIST AI RMF, the EU AI Act and COSO's Achieving Effective Internal Control Over Generative AI (February 2026).

Book an initial conversation

02

AI Controls Transformation

The governance designed, built and embedded.

WHAT YOU RECEIVE

  • Governance charter and operating model, with the three-lines mapping made explicit
  • RACI across roles and lifecycle stages
  • Policy hierarchy: apex AI policy, gen-AI acceptable use beneath it, integrated by reference with what already exists
  • Lifecycle gates from intake through retirement, with the decision criteria and the decision owner at each
  • Controls integrated into the framework you already run, not built parallel to it
  • Evidence standards per control, set by the reliance determination
  • First cycle operated together, so design effectiveness and operating effectiveness are not the same claim

03

AI Control Office

The function run on a cadence, after the project ends.

ON A CADENCE

  • Inventory maintenance and new use-case intake
  • Control testing with retained evidence
  • Quarterly governance reporting, written for the audit committee
  • Vendor and third-party AI reviews
  • Training refresh
  • Regulatory and framework change monitoring, with an impact read rather than a newsletter

A fractional function, not a support contract. Designed to be handed over when you hire for it.

Not sure where you fit? That is what the initial conversation is for.

Book an initial conversation