Services
Senior-level help on the work that decides how your audit goes. You work directly with the person doing the work.
SOC 1 and SOC 2 readiness
Scope the report, map controls to the criteria, find the gaps and fix them before your auditor starts testing.
HITRUST and ISO 27001 readiness
Assess where you stand against the framework, prioritize remediation and get evidence in order for certification.
IT general controls
Design and test ITGCs across access, change management and operations so they support financial and compliance audits.
GRC program build-out
Control libraries, risk assessments, policies and evidence workflows, including setup on platforms like OneTrust, Archer and Tugboat.
AI in compliance workflows
Practical use of AI and automation to cut the manual work in evidence collection, control mapping and reporting.
Audit support
A steady hand during fieldwork: request lists, walkthroughs, evidence review and response to findings.
How we work
Each engagement runs under one engagement letter, with a Statement of Work for each project so scope and fees are clear up front.
- 01
Scope
Agree on the framework, systems and timeline that matter for your audit.
- 02
Assess
Review controls and evidence against the requirements and rank the gaps.
- 03
Remediate
Fix what is missing, with your team, in an order that fits your audit date.
- 04
Support
Stay involved through fieldwork so nothing is lost in translation.
About
Bos Advisory is led by Troy Bos, who has spent more than 20 years in IT audit and GRC. He started as an external IT auditor, spent over a decade building internal assurance programs, and most recently led SOC 1, SOC 2, HITRUST and ITGC engagements as a consulting leader.
That mix means he has sat on both sides of the table. He knows what auditors look for, and what it takes inside a company to give it to them.
Clients have included companies in financial services, healthcare, technology and business process outsourcing.
Bos Advisory provides advisory and readiness services only. We do not perform attestation engagements or issue audit opinions, so we can work alongside your audit firm.
Let's talk about your audit
Tell me what framework you're working toward and when your audit is. I'll reply within one business day.
Email Troy [email protected]