Expertise · Digital consulting
Diagnosis on real systems, not on interviews: we read the code, measure production with commands you can repeat and ask for the primary document for each statement. The result is a list of decisions with who decides each one, not a presentation.
Already builtThe method was applied fully on ourselves and the results are in the repository, with file and line. Three concrete deliverables: a register of data processing activities checked line by line in production, with what could not be confirmed marked “unverified” and eight points explicitly left to the owner’s decision; an accessibility and performance audit that states from the start what it could NOT measure, with five limitations listed, and that claims no compliance level; and a register of evidence for public claims, which removed three non-existent awards that had circulated between internal documents without anyone asking for the original. The specialised consulting on AI adoption and team training has its own page and complements this one, it does not duplicate it.
The most expensive technical decisions are not made on false information. They are made on information that was true eighteen months ago. One internal document picks up a figure from another, the third cites the second, and the chain breaks exactly where no one asked for the original. That is why the first part of our work is not strategy, it is verification.
We applied the method to ourselves before selling it. We built an evidence register for every public claim on our own site, with the rule that a claim has one row with the primary document, not the document that repeats it. The result: three awards we displayed did not exist — the respective programmes do not exist or did not have the stated edition. In contrast, a real distinction that public research could not confirm in two hours was clarified in a minute with the original email. That is the difference between searching and asking for the original.
The second part is measurement, with commands anyone can repeat. We discovered that thirty pages on our own site had 105 words each, 104 of which were identical — the only unique word on each page was the domain name. It did not come from an opinion about thin content, but from a comparison of word sets across page bodies extracted from production. A figure like that closes a discussion that would otherwise last for months.
The third part is what we do with the result. We do not deliver a presentation with recommendations, but a list of decisions, each with who takes it. In our own register, eight points remained explicitly the responsibility of the owner — from the actual existence of a publicly declared email address, to aligning two contradictory positions we had published in different places. A consultant who had “resolved” them on their own would have produced a prettier document and an organisation just as exposed.
What it covers
A register with one statement per line: the primary document, the date, where it is found, whether it is publishable. The document that repeats the statement does not count as a source. Applied to us, the register eliminated three non-existent awards and confirmed three real ones, one of them through an original email found in the archive — a private source, showable on request, which no public search could have produced.
The verification commands are included in the deliverable, so anyone can repeat them without us. When the document and the measurement do not agree, the measurement is right: while preparing this work, we found an internal document that declared a file about 16% smaller than it was, and an infrastructure diagram that described a server we had moved away from.
In our own accessibility and performance audit, the limitations section comes before the results and lists five things: render indicators the tool did not expose, keyboard activation the automation could not reproduce faithfully, the absence of screen reader tests, the inability to emulate the reduced motion preference, and the lack of field data. The conclusions drawn are marked as deductions, not observations.
The same audit contains no declared compliance level, because a complete audit requires testing with real screen readers, on real devices, with users — none of that had been done. What it does contain are individual findings, each with the relevant criterion, ordered so the work can be prioritised. Three blockers counted, the rest improvements.
Technical fact from our own code: publishable, with the line. Actual project status: publishable, with the real reason, not the euphemism. Commercial result — clients, improvement percentages, volumes: not publishable without measurement and the client’s agreement. Comparison of the type “first” or “best”: not publishable without criterion and date. This grid applies before a line is written, not in proofreading.
The published policy and the implementation must not diverge, and divergence is hard to see from the inside. Examples from our own audit: the page promised IP address anonymisation, but the code sent it in full in a notification; the publicly declared retention period was not enforced by anything. The resulting rule: if a code change alters what is collected, where it goes, or how long it is kept, the published text changes at the same time.
A good pilot has a clear start, a clear end, a numeric criterion decided in advance, and a stopping path that does not cost. We write explicitly what the system is not allowed to do and how it hands over to a human. If the diagnosis shows that the correct answer is “do not build this now”, we write it just as explicitly — it is the cheapest delivery possible.
A report that reaches nobody is equivalent to a report that does not exist. In one internal system, a daily report was dead for eleven days while the scheduled task was triggering correctly — the command used was exiting silently on error. We look at this class of defect explicitly, because it appears in no requirements list and triggers no alarm.
Each unresolved point gets a line: what it is, why it matters, who decides. Eight such points remained in the register itself. Consulting that solves them on its own produces a smoother document and an organisation just as exposed.
What it looks like
Everything you say publicly or internally about capabilities, results, partners and certifications goes into a list. For each, we ask for the primary document. We deliver: the register with confirmed statements, those disproved and those left without a source, with the recommendation for each.
Production is checked directly — headers, timings, content, behaviour at the limits — and the code is read. We deliver: the measurements with the exact command alongside, plus the list of places where the documentation and reality do not agree.
The limitations of the method go into the report before the conclusions. We deliver: the list of what could not be measured and why, plus what would be needed to make it possible — instrument, access or authorisation.
The findings are ordered by effect and remediation cost, with blockers counted separately. We deliver: the ordered list, with what each point remediates and how the remediation is checked.
One route, one numerical criterion decided in advance, one way to stop. We deliver: the definition of the pilot, the acceptance criterion and the list of remaining decisions, each with the name of the person who takes it.
The data
The questions anyone with a data protection officer would ask — asked here before they do.
A case
The situation
A presentation website displayed several distinctions. No one had questioned them: they appeared in internal materials, in presentations and in page copy, and each document seemed to rely on another.
What we built
We built a register with one statement per line and a single requirement: the primary document, not the document that repeats the statement. For each distinction we looked for the original source — the organiser’s announcement, the press article from the date of the event, the direct communication from the one who awarded it.
What came out
Three distinctions had no source at all: the programmes cited did not exist or had not had that edition. They were removed. Three were real and remained, with their public sources. The fourth, which public search could not confirm in two hours, was clarified in a minute with the original email from the one who awarded it — a private source, showable on request, because the organiser does not publish the winners’ list for that format. Claims of the type number of clients or years of profitability also appeared, left without confirmation; they were marked as non-public until verified in the company’s records.
What the case does not say
The chain did not break because of a deliberate invention. One document took from another, and the third cited the second as source — it broke exactly where no one asked for the original. That is why the register is useful only if it is kept up to date: at the first new statement added without a line in the register, the process starts again.
Questions
The other page is about AI adoption in the team: analysing repetitive processes, workshops on real examples and a pilot built together. This one is about diagnosis and decision, whether the answer involves AI or not. They complement each other: a diagnosis may conclude that the problem is not the lack of an assistant, but the fact that the contact form loses requests. You can start with either — but if you are not sure what hurts, start with diagnosis.
Uncomfortable things, published as such. Three displayed awards that did not exist, because one internal document had copied them from another without anyone asking for the original. The contact form returned 500 and lost requests without trace, because the notification channel credential had been revoked and no one was looking. A route that could initiate a phone call to any number, anonymously. The page promised IP address anonymisation, and the code sent it in full. And thirty pages that had 104 of 105 words identical to each other.
Because the deliverable includes the commands, not just the conclusions. A statement that the client can verify on their own, with a command from the report, cannot be agreeable — it is shown false on the first run. And when we cannot verify something, we write “unverified”, which is a valid conclusion. We used it eight times in our own register.
Yes, and it is the cheapest delivery we can make. One example from our own work: we had a plan to redirect 73 generated pages to pages considered “main”. The measurement showed that the destination pages were themselves thin — 105 words, 104 of them common. The conclusion was not “redirect faster”, but “do not redirect thin content into even thinner content; the destination is fixed first”. The redirection was conditional on rewriting the destination.
We say what can be concluded without it and what cannot. In our own content audit we did not have access to Search Console, analytics or sales data — so we did not declare traffic, conversion or observed cannibalisation, although those were exactly the conclusions that would have sounded most convincing. The correct order remained written in the report: first the data, then the decision, not the other way round.
We deliver a report with one finding per row, the verification commands and a list of decisions with an owner. If you also want a presentation for a meeting, we do that — but it is not the deliverable, it is a summary of it. The difference matters because a presentation cannot be verified, whereas a report with commands can.
As deep as needed for the statements in the report to have a file and a line. In practice that means reading routes one by one and asking, for each, who calls it and what it does when the verification cannot decide. An automated tool sees a route that returns an error on an empty request and moves on; reading it shows that nobody calls it any more and that it is open.
No. We are not accredited auditors, we do not issue certificates and we do not sign compliance attestations. What we deliver is a technical analysis with verifiable evidence, useful for deciding and fixing — not for satisfying a formal requirement that needs an accredited body. If that is what you need, it is better to find out now.
It does not produce revenue or traffic forecasts — we do not have the basis for them and we do not invent them. It does not compare suppliers based on the figures published by them; if we did not run the measurement ourselves, we write that it is a declared figure, not a measured one. It does not make commercial decisions for you. And it does not produce a document that appears complete by covering the places where we do not know with cautious wording — a vague audit is a way of saying nothing.
18 of them are code and files from our repositories. We don't publish their name or line: together, on a single page, they would describe too precisely how systems that aren't only ours are built. We go through them with you, in the repository, on request — verification stays possible, it just happens in a conversation.
Tell us about your process. Together we decide what is worth building, what we can connect, and how we check the result.