Our independence, written down so you can hold us to it.

1. Ownership and connected firms

AuditTrax Labs Inc is a US entity registered in the State of Georgia. It shares ownership with firms that carry out technology delivery and infrastructure work. We do not treat that as something to manage quietly. It is a structural conflict, and this policy exists because of it.

A connected firm may be technically capable of executing remediation, a build, or an operating engagement arising from something we found. Nothing in our reports obliges a client to use them, and no commercial arrangement between AuditTrax and any connected firm is contingent on a client doing so.

2. What appears on page one

Every report we issue carries, on the cover page and before any finding:

• A named statement of any connected firm capable of executing work described in the report.
• The names of the assessors who performed the work and who will defend it.
• The peer set and date the AuditTrax Index scores were cut against.
• A plain list of anything we were unable to examine, and why.

None of this appears in a footnote, an appendix or a terms document. It appears where the first reader will see it.

3. Separation of assessment and repair

An assessor who signs a finding does not join any team engaged to remediate it. This holds for the engagement and for twelve months afterwards.

Where a client chooses to engage a connected firm for remediation, any subsequent verification of that work is performed by an assessor who did not take part in the original assessment, and the report states that fact.

4. Fees, pricing and the credit

Assessment fees are published on this site and fixed at scope, stated in writing before work begins. They do not vary with the findings, the score, or what the client decides to do afterwards. We publish them because a quote you have to ask for is a negotiation, and a negotiation over an audit fee is the first place independence starts to leak.

No part of assessor compensation is linked to remediation revenue, to referrals, or to client satisfaction with a score. Assessors are not set targets that could be met by writing a softer report.

We credit fifty per cent of the assessment fee against remediation or build work started within ninety days of the report. That credit applies to work carried out by any vendor the client chooses, including our competitors, and it is honoured on production of a signed contract with that vendor.

The credit is deliberately vendor neutral. A credit that only worked with a firm connected to us would give the assessor a financial reason to recommend a build, and would undermine everything else in this policy. Written this way it lowers the cost of acting on what we found without giving anyone a reason to slant the finding.

5. Portable findings

Designs, remediation plans and worklists are written so that any competent third party can execute them. We name alternates rather than single vendors, and we avoid dependencies that only one supplier can satisfy.

This is a discipline as much as a courtesy. A recommendation that has to survive being executed by somebody else is a recommendation we have to be able to defend.

6. Challenge and correction

Any finding may be challenged in writing by the client or by the organisation assessed. We assess the counter evidence against the same rubric used originally.

Where a challenge succeeds, we correct the finding, reissue the report, and record the correction on page one. Where it does not, we set out in writing why the finding stands. Reports are never amended silently.

7. Benchmark contribution

Engagements contribute anonymised, structured rubric scores to the AuditTrax Index. No client name, code, document, configuration or identifying detail is contributed at any point.

Contribution is stated in the scope you sign. A client may decline contribution without any change to fee or scope.

8. Work we refuse

We decline engagements where the scope is written to produce a predetermined conclusion, where access is restricted such that we could not form a defensible view, or where a client requires findings to be removed rather than challenged.

We also decline where the timeline would make the report worse than no report. A compressed assessment that reads as a full one is more dangerous to the person relying on it than nothing at all.