Compliance & Auditing

Compliance and audit support for public agencies.

Start a conversation Or call (718) 540-8268

Close-up of two hands lifting the lid from an archive box to reveal rows of file tabs inside.

We help public agencies meet state, city, and program requirements, and prepare for internal and external audits, without slowing day-to-day work. Our team conducts compliance assessments, sets up monitoring routines, and provides audit readiness and response support so obligations are met and risks are managed.

Our work covers the obligations public programs in New York commonly carry, including records and privacy rules, HIPAA where health information is involved, accessibility requirements, procurement and contract terms, and program-specific policies. Engagements draw on the documentation practices we use every week in our own publicly funded programs.

What compliance protects

Compliance is how agencies protect sensitive information, provide equitable access to services, and maintain credibility with the public. A documented approach keeps teams current with rule changes and ready for audits while operations continue.

Printed tax forms and publications with a calculator and a pen laid out on a white table

Compliance, auditing, and risk management

Rules and standards overlap across levels of government. We provide clear guidance and structured processes so agencies can meet applicable requirements while maintaining service delivery, and be ready for audits and reviews at any time.

Agency-wide compliance assessments and gap analyses: An on-site review compares current practice with the state, city, and program rules that apply, and ends in a list of gaps ranked by risk.
Compliance program design, documentation, and roll-out: Policies, controls, and testing templates are written down and placed inside existing workflows, so staff are not handed a second, parallel process.
Audit services: readiness reviews, internal audit planning and testing, audit liaison support, and remediation tracking: Before a review we check the evidence, during it we coordinate with the auditors, and afterward each finding gets a corrective action with an owner and a date.
Data security support: documenting access controls, logging, and data-handling practices: We record who can reach which records, what activity is logged, and how data is stored and shared, so the agency can show a reviewer how it is protected.
Data protection and accessibility support: privacy requirements, data governance, and ADA and Section 508 implementation: Records and privacy rules are turned into working procedures, and public-facing services and documents are checked and corrected against accessibility requirements.
Procurement support on contract terms and purchasing rules: Contract terms and purchasing rules are compared with the agency's current purchasing practice, with plain guidance for staff on what each obligation requires of them.
Staff training, awareness initiatives, ongoing monitoring, and regulatory update briefings: Training sessions and remote monitoring keep practices consistent, and briefings explain rule changes from the oversight bodies that govern the agency's programs.

Who it’s for

Agencies in complex regulatory environments
Agencies facing upcoming audits
Agencies with identified deficiencies
Teams strengthening compliance posture
Teams building audit capabilities

How an engagement works

Pick any part of the sentence to see the detail.

First, assess and prioritize. Then build it into the work. Next, prepare for and respond to audits. Finally, sustain the capacity.

On-site compliance assessments produce a clear set of prioritized gaps, ranked by risk so the most important obligations are addressed first.

Common questions

How do you stay current with changing requirements?

We track updates from the regulators and oversight bodies that govern each agency's programs and incorporate relevant guidance into client policies and control sets. Agencies receive briefings on changes that affect their obligations.

What happens if an audit finds deficiencies?

We help analyze findings, develop corrective action plans with owners and timelines, support implementation, and document evidence for follow-up testing, closing gaps and reducing repeat findings.

How do you balance compliance and auditing with operational efficiency?

We embed controls into existing workflows, prioritize by risk, and streamline documentation so teams meet requirements without creating parallel, burdensome processes.

Still have a question? Call (718) 540-8268, or see the government overview.

If an audit is scheduled, or you have just received findings

We have the final report. Now I owe a corrective action plan and nobody owns the items.: A State Comptroller audit does not close with the final report. The agency is expected to report back on what it did with each recommendation, and auditors may return to check. We help turn findings into a plan with a named owner, a date and the evidence that will show each item is done.
We do the work correctly. We just cannot show it on paper when someone asks.: This is a common gap. Auditors test what is written down and whether practice matches it. Our assessments start with the procedures staff already follow, document them plainly, and build the evidence trail into the existing workflow instead of a parallel one.
Accessibility complaints about our site and forms keep coming and nobody here owns them.: City agencies are expected to post an accessibility statement and give the public a way to report problems, so complaints arrive whether or not anyone is assigned to them. A short call can sort out who should own the issue, what to fix first, and what to ask of the vendors who built the pages.

Have this ready when you call