The audit · Seven days
Seven days to see how the work really runs.
Before any software goes in, we spend seven days learning how your business really works: what it does, every system it uses, the spreadsheets and paper included, and how one piece of work moves from start to finish. On day seven you get a written readout to keep: what to fix and in what order, every law that applies and whether you meet it, the places where one person can act alone when a second should check, and a fixed price to put it right.
€6,300, one fixed fee.
Seven days
Days one to three: with you
The questions, one part at a time. Every system you run on, the spreadsheets, the paper and the chat groups included. One process, from a customer's first contact to the record it leaves, walked step by step.
Days four to six: the findings
What was found and how serious each one is, where a second person's check is missing, and the price of the build.
Day seven: the readout
One sentence, five numbers and the three findings that matter most, then the detail. You keep it as a PDF.
What it asks
Every question comes from one bank, in parts. The first part, the business itself, decides which of the rest apply: a 20-person firm that sells only to businesses is not asked about consumer law, NIS2 or a reporting channel, and a financial firm is asked about suitability, complaints, and fitness and probity under the Central Bank's codes.
142 questions in 18 parts
Asked of every business
The business
15What it does, its size, its customers and its sector: this decides which questions follow.
Systems
9Every system the business runs on, who owns it, and where the true copy of each record lives.
How the work flows
8The processes that cost the most, step by step: where work is typed twice, waits or lives on paper.
Personal data
12What personal data is held, where, why and for how long, and whether the GDPR basics are in place.
Security
7Sign-ins, devices, updates, backups and what happens on a bad day.
Duties to split
9Where one person can start and finish something that should need two. Each one found becomes a blocker in the build.
People and safety
18Contracts, hours, training and workplace safety duties.
Tax and filings
7Returns and filings on time, and how money reaches the accounts.
Day-one access
5Access, exports and devices: what the build needs on day one.
Asked when they apply
- AI in use7
- Health and care7
- Children and vulnerable adults3
- Financial services8
- Selling to consumers6
- Products you make or sell7
- Life sciences8
- Energy and utilities3
- Telecoms and digital infrastructure3
Try this in a copy of your own, for two hours, with nothing to sign up for.
Open your own copyWhat it finds
From what was seen
Each finding comes from an answer, a system in the register or a step of a process, with the fix it needs.
Unknowns count
"Not sure" is an answer. It raises a finding of its own, one step milder. Nothing unknown passes as fine.
Duties to split become blockers
Where one person can do something alone that should need a second person, such as adding a supplier, changing its bank details and paying it, the build adds the second person's approval before it can happen.
Each law, duty by duty
Every duty that applies is marked gap, in place or not known, with the questions that showed it, and listed once.
Set aside with a reason
A finding the auditor sets aside keeps its reason, and the readout lists it with the rest.
The readout
The first page of a readout, for a payments firm whose every name and number is made up. The pages after it carry the systems, each process before and after, every law that applies, the build plan and the price.
Audit readout
A payments firm
A payments firm runs on 8 systems. The audit found 23 things to fix, 5 of them serious, and 3 duties one person should not hold alone.
Sample · every name and number is made up
- Systems
- 8
- 1 connect today
- Typed twice
- 3
- steps that re-enter what is already somewhere
- Serious findings
- 5
- of 23 open
- Blockers to build
- 3
- duties to split
- Laws with gaps
- 6
- of 18 that apply
Where the gaps are
21 gaps across 6 of the 18 laws that apply. Each bar is that law’s duties for this business.
- Information security (ISO 27001 controls)8 of 17
- GDPR and the Data Protection Act6 of 15
- The EU AI Act3 of 3
- DORA (digital operational resilience)2 of 2
- EU sanctions1 of 1
- Health and safety1 of 14
GapIn place
23 findings, by how serious
- 5
- Serious
- 15
- Medium
- 3
- Minor
8 systems, and how each connects
- Payments platformNot yet
- SalesforceNot yet
- Screening serviceNot yet
- ICT register, ExcelBy file
- Incident log, ExcelBy file
- SlackNot yet
- Email, Microsoft 365Not yet
- Accounts, XeroConnects today
What matters most
- Serious
AI helps decide hiring, credit, insurance or access to services.
Becomes a blocker. Checked against the AI Act's high-risk list, with a person reviewing every decision and the review recorded.
- Serious
Signed-off records can be changed without a trace.
Blocker: signed-off records lock. A change is a new entry with a name and a reason, and the original is kept.
- Serious
June's outage was classified major 31 hours after it was found, and the initial notification went out late.
Incidents logged in Comply as they are declared, the classification timed from awareness, and DORA's clocks watched with a warning before each report falls due.
The pages after it
Duties to split
Where one person can start and finish something that should need two, each one a blocker in the build.
Systems
Each system, who owns it, what it holds the true copy of, and whether it connects today, by file or not yet.
Each process, before and after
Every step, marked where it is typed again, done on paper or waits, and what it becomes after the build.
Everything found
Every open finding, most serious first, each with its fix.
The laws that apply
Each duty, marked gap, in place or not known.
The build plan
What the build does, grouped, each with the finding it answers.
The price
The build's fixed price, and Run & Monitor for each business.
Still to find out
The questions nobody could answer yet.
Want this on your own systems? It starts with an audit of how your business really runs.
Book an auditThe price
The audit is one fixed fee, agreed before it starts. The build is quoted from the readout at a fixed price, and Run & Monitor is a monthly fee for each business.
- Audit
Assessment: systems and compliance audit
€6,300
- 7 days: systems map, where work is keyed twice or lost
- Compliance check for the sector's laws
- Fixed-price build plan
- A map of everything the business runs: each system, supplier, AI tool, data flow and website, with its owner and how sensitive its data is
- Build
Build: connect and automate
from €15,000
- Connect the customer's systems (CRM, email, payments, accounts, website)
- Workflows with retries and alerts
- Controls mapped and evidence switched on
- Access governance: leavers' sign-ins removed, admin access approved by a second person, access reviewed every three months
- Privacy operations: data requests on their legal clocks, erasure across every system, the record of processing
- AI governance: the AI-use register and each use's class under the AI Act
- The incident clocks for GDPR, NIS2 and DORA
- The business's own trust centre
- Run
Run & Monitor
from €850 a month for each business
- Monitoring of every connected system
- Eurus's assistants watching every check, with what needs you ranked first
- Fixes to workflows and integrations
- Monthly assurance report
- A named FourWinds lead
- Access reviews and data requests kept to their dates
- Restore tests recorded as evidence, with their dates
Book the audit.
Tell us what the business does and a week that suits. The dates and the fee are agreed before anything starts.
Or write to support@fourwinds.ie.