Aethos Advisory

An advisor who has built
what you're trying to build.

Your control environment was designed for a world that no longer exists. Modern platforms (CI/CD pipelines, cloud-native infrastructure, SaaS identity layers) introduce risks that traditional ITGC frameworks were never designed to catch. Navigating that gap takes more than a framework. It takes someone who has been inside it.

Not a consulting engagement. An advisor at your side, to guide your thinking, challenge your assumptions, and help you make better decisions about how your program gets built.

Who This Is For

Four situations where an advisor
makes a material difference.

Advisory is for IT audit directors, GRC leaders, and CAEs who are responsible for a control environment that needs to evolve, and who want a technically credible counterpart who has done this before. Not someone to do the work for you. Someone to help you think it through correctly.

You've realized your environment runs on platforms you haven't been auditing correctly.

Your organization uses GitHub, AWS, Okta, Kubernetes, or similar platforms, and your current ITGC program tests controls that don't map to how these systems actually work. You know there's risk you're not capturing, but you don't have a clear view of what it is or how to close the gap without breaking your existing program.

You're building a control environment from scratch and don't know where to start.

A first-year SOX audit, a pre-IPO readiness program, or a complete control environment redesign. You have a mandate and a timeline but no playbook for how modern platform controls should be designed, sequenced, and evidenced. The standard guidance doesn't account for the stack you're actually running.

You need a technical counterpart for decisions your team doesn't have the context to make.

Scoping decisions, control design choices, methodology questions, second opinions on audit programs. Your team is doing the work, but some decisions require a perspective that only comes from having worked across both platform engineering and assurance. You don't need someone to do it. You need someone to think it through with you.

You're leading a GRC transformation and want someone who has navigated it before.

Modernizing a GRC program is harder than it looks. Stakeholder alignment, tooling decisions, control rationalization, team capability gaps, audit methodology redesign. Each one is a real project with real failure modes. An advisor who has run this process before, across multiple environments and organizational stages, can save you months of trial and error.

What Advisory Is and Isn't

Guidance, perspective, and a
technically credible sounding board.

The distinction matters. Advisory is a relationship built around your decision-making, not around producing outputs. You retain ownership of the work. I provide the perspective that helps you make better decisions about how that work gets done.

What advisory covers. Control environment design decisions. Platform-specific risk scoping. Audit program structure and methodology. Evidence strategy for modern platforms. GRC modernization sequencing. Organizational and stakeholder navigation. Second opinions on decisions your team is wrestling with.

What advisory doesn't include. Preparing audit deliverables. Performing fieldwork. Signing off on audit opinions or management assessments. Staffing engagement team capacity. If you need someone to do the work rather than advise on how to approach it, that's a different kind of engagement, and I'll tell you that directly.

Why this model works. The leaders who get the most from advisory are the ones who already know what they're trying to accomplish; they need a credible perspective from someone who has operated across every layer of this problem. The value comes from having someone in the room who has seen this go right and go wrong, and can tell you which way you're heading.

Confidentiality and NDAs

Advisory conversations often involve sensitive information about control gaps, audit findings, and internal program decisions. Mutual NDAs are standard and available for any engagement. If confidentiality is a prerequisite before we speak, mention it when you reach out; it's a normal part of how these engagements start.

Engagement Options

Three ways to engage,
built around how the need actually presents.

Most advisory relationships start with a specific question and grow from there. The options below are designed to match the structure of the engagement to the shape of the need, from a one-time diagnostic to an ongoing retained relationship.

Entry Point · Scope Second Opinion

Scope & Control Environment Assessment

An independent second opinion on your platform SOX scope, and the control environment around it. In one structured session, I review what's in and out of scope, where your platform footprint creates exposure your current program likely misses, and whether your scoping decisions would hold up to your external auditor. The right first step when you want a credible read before you commit to a direction.

Format Structured session, Virtual
Duration 90 minutes
Deliverable Written summary + priority areas
Price $750
  • A focused review of your SOX scope: what's in, what's out, and whether the exclusions are defensible
  • Where your platform footprint (cloud, identity, pipelines, data platforms) creates exposure your program likely misses
  • An honest read on whether your scoping holds up to an external auditor
  • Written summary of findings and prioritized next steps
  • Practical sequencing: what to tackle first and why
  • 30 minutes of follow-up questions within two weeks
Best for

Audit leaders who want an independent read on whether their platform SOX scope is right, before sign-off, before an audit, or before committing to a modernization direction. Also the natural first step before engaging on an ongoing basis.

Request a Scope Review
On-Call Advisory

Advisory Sessions

Focused working sessions for leaders who have specific decisions to work through, methodology questions to pressure-test, or audit programs to refine. Available as individual sessions or a three-session package for leaders navigating a defined decision or transition.

Format Working session, Virtual
Duration 60 minutes
Single Session $450
3-Session Package $1,200
  • Pre-session brief reviewed in advance, so no time is wasted on context-setting
  • Direct, candid perspective on the specific question or decision at hand
  • Control design, scoping, methodology, or program structure guidance
  • Written notes summarizing the session and key recommendations
  • Email follow-up within 48 hours for any immediate follow-on questions
  • 3-session package includes one additional async review (audit program, scope doc, or similar)
Best for

Leaders with a specific, bounded question or decision: a second opinion on scope, a methodology call, a control design choice. Also useful for teams at a defined inflection point, whether starting a SOX readiness program, inheriting a program that needs assessment, or navigating a first-time audit of a modern platform environment.

Schedule a Session Includes a free 30-minute alignment call before the first session.
Retained Advisory

Monthly Retained Advisory

For leaders who are in the middle of building or transforming a program who need consistent access over months rather than one-off conversations. A retained relationship means priority access, continuity across decisions, and an advisor who understands the full context of your environment as it evolves.

Format Ongoing, Virtual + Async
Commitment Month-to-month
5 hrs / month $1,800 / mo
10 hrs / month $3,200 / mo
  • Contracted advisory hours each month, live sessions and async support
  • Priority scheduling and response, access when decisions need to move fast
  • Continuity across your program: context builds month over month
  • Attendance at planning sessions, strategy reviews, or team working sessions
  • Async review of audit programs, control designs, scope documents, and methodology
  • A monthly brief summarizing the work covered and open items
  • 10-hr tier includes quarterly program review and written advisory memo
Best for

Leaders actively building or transforming a program: SOX readiness projects, control environment redesigns, GRC platform implementations, or any multi-month initiative where the decisions compound and context matters. The retainer is the right structure when the work is continuous rather than episodic.

Start a Conversation All retained engagements start with a 30-minute alignment call at no charge.

Hours are contracted monthly and don't roll over. Month-to-month with 30 days notice to close. For team or multi-function advisory, reach out to discuss a custom structure at [email protected].

Before Any Engagement
30-Minute Alignment Call, No Charge

Every engagement starts with a free 30-minute call. The goal is simple: understand your situation, confirm I can actually help, and determine which structure fits. If it's not the right fit, I'll tell you honestly, and point you toward something that is.

Request an Alignment Call
Choosing the Right Structure

The structure should match
the shape of the need.

If you're not sure which option fits, the alignment call will sort it out. But here's the simple way to think about it.

Assessment
You need a clear picture before you know what you need.
Choose this when
  • You suspect your current program has gaps but aren't sure where
  • You're about to start a modernization effort and want a baseline
  • You need to brief leadership on where the program stands
  • You want a written summary you can act on immediately
Advisory Sessions
You have a specific question or decision that needs a credible perspective.
Choose this when
  • You need a second opinion on scope, methodology, or control design
  • Your team is navigating a defined transition or first-time challenge
  • The need is episodic: real questions when they arise, not ongoing
  • You want to test the advisory relationship before committing to a retainer
Retained Advisory
Your program is actively being built or transformed and needs consistent support.
Choose this when
  • You're in the middle of a multi-month initiative with compounding decisions
  • You need access when things come up, not scheduled in advance
  • The work requires someone who understands your full context over time
  • Your team would benefit from a senior perspective in working sessions
The Advisor

The perspective behind this advisory
comes from having done the work at every layer.

Advisory is only as useful as the perspective behind it. Here's what informs the thinking you'd be working with.

Nearly two decades across every vantage point this field offers. Big 4 advisory, Fortune 50 internal audit, control-owning technology teams, and GRC leadership. Having operated on all three sides of the control environment (design, implementation, and assessment) is what makes the perspective useful across every type of engagement.

Platform assurance as a specialty, not a topic. Modern platform engineering is not a background subject in this advisory. GitHub, AWS, Kubernetes, Okta, CI/CD pipelines, cloud-native infrastructure: these are the environments the Aethos frameworks were built to govern, and the ones I have designed and assessed controls for directly.

From greenfield to highly complex, across organizational stages. A first-year SOX program looks and feels different from a mature enterprise audit function undergoing transformation. Having navigated both, and every stage between, means the advisory is calibrated to where your organization actually is, not where a generic framework assumes it is.

These conversations directly shape what Aethos builds next. Every advisory engagement adds to a body of real-world pattern recognition that feeds back into the Aethos frameworks, research, and platform intelligence work. What you share stays confidential; the field-level insight it generates makes the broader work sharper. When you engage, you also help shape how the field evolves.

Advisory vs. Mentorship

Not sure which fits?
Here's the distinction.

Both are offered through Aethos. The difference is who the engagement is for and what it's trying to accomplish.

Advisory is for leaders responsible for an audit or assurance function. The buyer is someone accountable for a program (an IT audit director, a GRC leader, a CAE) who needs a technically credible counterpart to help them make better decisions about how that program gets designed, structured, and run. The conversation is about control environments, platform risk, methodology, and organizational strategy. You're in the right place.

Mentorship is for individuals investing in their own career and leadership. The buyer is a professional who wants to become a better leader, navigate organizational dynamics more effectively, or build a stronger foundation in the early stages of their career. The conversation is about people, career strategy, and personal development, not about audit programs or control environments. See the Mentorship page.

Get Started

Tell me about your environment.
We'll figure out the right next step.

Send an email with a brief description of your situation: where your program stands, what you're trying to solve, and what kind of help would be most useful. I'll respond within two business days to set up a 30-minute alignment call. No intake form. No auto-responder. No obligation after the call.

[email protected]

If confidentiality is a prerequisite before we speak, mention it in your first message. NDAs are standard and will be in place before any substantive conversation about your environment.