FAQ
Questions we hear before an engagement.
If yours isn't here, ask it on the call — we'd rather disqualify early than mid-project.
- What does it actually mean that you sign the assessment?
- The report closes with an attestation page: the named assessor, their credentials, the exact scope and boundaries examined, the framework versions applied, the evidence reviewed, the conclusion reached, and the date. It is a professional conclusion, not a certification, and it is written so a regulator or an enterprise reviewer can evaluate the basis for it.
- How is this different from a Big Four AI advisory engagement?
- Big Four engagements typically run $50K–$150K per month and end with a framework deck that nobody has yet implemented, delivered by a team whose names appear nowhere. Firemark is a single senior practitioner delivering a fixed-fee assessment in four weeks with a signature on it.
- You're one person. What happens if you're unavailable?
- Every engagement is documented against a versioned methodology, with the evidence set indexed, so the work is reproducible rather than locked in one head. Scope and timelines are fixed and small enough to complete reliably, and we cap concurrent engagements rather than overbook. Technology E&O coverage is in placement and the certificate is available once bound.
- Do you assess AI that you built?
- No. Enablement is a separate track for a different, earlier-stage client. No company receives both a build engagement and a signed assessment of that build. Independence is the product.
- We're not in the EU. Does the EU AI Act matter to us?
- Often, yes — through customers, subprocessors, or market placement. Part of the Teardown is determining applicability and your role (provider or deployer) rather than assuming it. Where it doesn't apply, we say so in writing, which is itself useful to have.
- What if regulatory guidance changes during the engagement?
- Framework versions are recorded, so change is tracked rather than silently absorbed. Material changes during the four weeks are incorporated and noted; changes after delivery are what the Monitoring Retainer exists for.
- Can you work with our existing GRC platform?
- Yes. Findings, controls, and evidence indexes are delivered in a format that maps into LogicGate, ServiceNow GRC, Archer, Vanta, or a spreadsheet if that's what you actually use.
- We already have a Chief Risk Officer. Does this duplicate her work?
- It supports it. An internal CRO is first- or second-line inside the organization; an independent assessor provides the outside conclusion that boards, examiners and enterprise buyers weight differently. Most CROs are the ones who bring us in.
- How do you handle confidentiality and conflicts?
- Mutual NDA before any material is shared, evidence retained only as long as the engagement and attestation record require, and conflict screening against competitors in the same segment before an engagement is accepted.
Next step
Find out what your AI exposure actually looks like.
A Governance Teardown is a fixed-fee, four-week assessment ending in a signed, audit-ready report. Start with a 30-minute call and we'll tell you honestly whether it fits.