Three pieces of work that only hold up together.
Technology is the foundation for everything your firm does. Compliance is meeting your regulatory and ethical obligations, consistently, through a clear framework rather than ad hoc effort. Automation means less repetition and more time for the work that matters. We do all three, and we govern AI across every one of them.
What each part does.
The foundation for everything your firm does.
We configure and govern your Microsoft 365 tenant's security and compliance settings: licensing, identity and access, device registration and policy, data protection, retention and backup. Every device that touches firm data, firm-owned or personal, is registered and covered by policy before it gets access. Changes to those settings are scoped and change-controlled, so the controls your obligations depend on don't quietly drift.
Cybersecurity baseline →Your regulatory and ethical obligations, met consistently.
AML/CTF, privacy and data breaches, cybersecurity and staff AI use. We map the obligations that typically apply to a firm like yours, put the program and controls in place, and set up how each one is evidenced, so when an insurer, auditor or regulator asks, the record is there.
Compliance →Less repetition. More time for the work that matters.
Customer due diligence, risk assessments, registers and reminders run as part of the matter, not as a separate job. Once that foundation is in place, the same automation goes to work on fee-earning matters.
AI and automation →Take one away and the other two stop working.
A policy without configured systems is a document. Configured systems without evidence capture can't prove anything. Automation without compliance underneath it just moves risk faster. That's why we deliver all three under one team. The gaps between separate providers are where most firms' risk sits.
AI governance isn't a fourth pillar.
It's how we check every engagement: which AI tools are in use, what data they can reach, what your policy says, and whether supervision is recorded. In technology, it means controlling what AI tools can reach inside your tenant. In compliance, it means a staff AI use policy and the records that show it's followed. In automation, it means AI-assisted steps run within defined limits, with a person reviewing the result.
We govern the tenant. Your IT provider keeps the hands-on work.
Your Microsoft 365 tenant belongs to your firm. We provision your Microsoft licences and are responsible for its security and compliance configuration: identity, security policy, data protection, and any change that affects them. Your local IT provider keeps administrator access for day-to-day system administration, user support, on-site help and equipment, working to a scope we agree with them. Ongoing security monitoring is a condition of our engagement, and it can sit with the same provider. If you don't have an IT provider, we'll introduce you to one we work with.
We prefer to supply the devices your team works on, so they arrive registered, configured and covered by policy. Your firm owns them. If you already have devices, we'll work with them, provided they can be enrolled and brought up to the same standard.
Most firms already pay for Microsoft 365 features they haven't switched on. Depending on what we find, some firms need a higher Microsoft 365 plan to turn on the security and compliance features their obligations require. We tell you before any work starts.
One obligation at a time, fixed scope, fixed fee.
- Start with what concerns you most. Where you start depends on the obligation you're most concerned about: the AML Health Check for AML/CTF, the free AI Risk Snapshot for staff AI use, or a cybersecurity baseline review.
- Scope and fee, before anything starts. You get a written scope and a fixed fee. Nothing proceeds until you've confirmed it.
- We build in your systems. The work is done in your own Microsoft 365 tenant and connected to the practice management system you already use.
- Handover to your process owner. Each piece of work is handed to the person in your firm who owns it, with documentation. You also get an exit pack on day one, with what you need to keep running if we're not there.
- Security changes are change-controlled. After go-live, changes to security and compliance settings are scoped, agreed and recorded, so the configuration your evidence depends on doesn't drift. Everyday adds and moves stay with your IT provider.
For firms that want the whole picture.
Practice Resilience® is our structured program for firms that want to work through technology, compliance and AI governance in order, rather than one problem at a time. It runs in four stages: Diagnostic, Foundation, Transformation and AI Implementation. Most firms don't start at stage one, and you don't have to complete all four.
Frequently asked questions
-
No. Most firms start with one obligation. Technology and automation come into it only as far as that obligation needs them, and we tell you where that is before any work starts.
-
No. We govern your Microsoft 365 tenant's security and compliance configuration. Your IT provider keeps the hands-on, day-to-day support. If you don't have one, we'll introduce you to one we work with.
-
In your own Microsoft 365 tenant, with your core Microsoft 365 data stored in Australia. The workflows and records we build sit there too.
-
Yes. We work with every practice management system, so your team keeps working where it works now.
-
As part of every engagement. We find out which AI tools are in use, set what they can reach, put a staff AI use policy in place and keep the record that shows AI-assisted work is reviewed.
Start with the obligation that's pressing.
Fixed scope, fixed fee, and a clear view of where you stand.