Customer information and access
Identify the systems and parties that handle customer information. Review selected access controls, joiner and leaver processes, privileged access and available evidence.
EXTRIMPAFor independent RIAs
Know where your controls fall short. Know what to do next.
Technology risk and cybersecurity advisory for independent registered investment advisers (RIAs). We help your Chief Compliance Officer (CCO) and leadership team identify control gaps, strengthen incident readiness and prioritize improvements, including support for Regulation S-P readiness.
Built around your firm
Designed for firms that need senior review alongside existing providers
Our primary focus is independent SEC-registered investment advisers whose leadership or CCO coordinates technology responsibilities without a dedicated senior technology risk function.
A review may be useful when you are changing providers, growing your team, preparing information for a compliance review or working through unresolved control issues.
We also consider defined engagements with other investment firms where our experience and methods fit the work. We discuss your structure and requirements before proposing a scope.
What we examine
Follow the information and the responsibilities
Providers and cloud services
Clarify provider responsibilities, review relevant assurance materials and identify follow-up questions. A provider’s report is an input to your review, not a substitute for understanding your own responsibilities.
Incident readiness and continuity
Examine escalation paths, decision-makers and critical dependencies. Use a tabletop exercise to practice coordination and identify gaps before a real disruption.
Control evidence and remediation
Document the scope and results of selected tests. Assign actions to the appropriate owners and agree what evidence will support closure.
How we work with your firm
Independent review. Clear ownership.
We work alongside your leadership, CCO and existing technology providers. Before the review begins, we agree who will make decisions, provide evidence and carry out any approved changes.
- Your leadership and CCO
- Set priorities, make risk decisions and retain ownership of your policies and compliance program.
- EXTRIMPA
- Assess the agreed areas, test selected controls, explain evidence-based findings and help prioritize next steps.
- Your IT provider or internal team
- Operate your systems, provide relevant evidence and implement technical changes you approve.
- Your legal counsel
- Advise on legal obligations, notifications and other legal decisions.
The review scope, deliverables and responsibilities are agreed before work starts. Any technical remediation by EXTRIMPA is separately scoped and documented.
Before we begin
Frequently asked questions
Will you replace our MSP?
No. Our advisory work is designed to coordinate with your existing IT provider or internal team. It does not include a help desk or ongoing system administration.
Do you take over our compliance program?
No. We contribute technology risk analysis, control testing and supporting evidence. Your leadership and CCO retain responsibility for the program.
How will you work with our team?
We agree the scope, key contacts and working schedule at the start. Interviews, evidence reviews and workshops bring in your leadership, CCO and technology providers where their input is needed. We establish how information will be shared and how findings and next steps will be reviewed together.
Does a review guarantee regulatory compliance?
No. A review has a defined scope, evidence base and limitations. It supports decisions and follow-up; it is not a regulatory approval or legal opinion.
Start a conversation
Start with the question you need answered.
Tell us what has changed, what concerns you and who is involved. We will discuss whether a focused assessment or a recurring review would be useful.