IRON The full LION pass. Leave with a roadmap you can hand to a regulator.
The complete examination of how AI operates inside your firm, closing with a controls roadmap cross-mapped to ISO/IEC 42001 and the NIST AI RMF. This is the engagement Iron Lion is built around.
What you get
- Complete AI inventory. Sanctioned tools, shadow tools, and the AI features hiding inside software you already pay for.
- Exposure register. Every exposure documented, ranked, and tied to the obligation it violates: privilege, HIPAA, fair housing, FTC, state privacy law, professional rules.
- Controls roadmap, cross-mapped. The fixes, in order, each mapped to ISO/IEC 42001 and the NIST AI RMF so the work speaks the language an examiner expects.
- Vendor and tool verdicts. Keep, fence, or replace, with the reasoning written down.
- Executive briefing. A one-hour session for the partners or owners, plus a short written summary you can show to insurers, clients, or counsel.
- 30 days of follow-up. Questions answered while you start the fixes.
How it works
Locate · week one
Interviews, a staff survey, and a review of your systems. We find every place AI touches the business.
Identify · week two
Each touchpoint is tested against your obligations. What comes out is a register you can defend line by line.
Operationalize · week three
The roadmap: what to fix, in what order, mapped to the standards. Templates for the policies you will need.
Neutralize · week four
The executive briefing, the written summary, and the plan for keeping it current. Most firms move into a Governance Build from here.
Where this sits on the ladder
Every rung credits toward the next. Start where you are.
Questions people ask before they say yes
Why is this priced below what larger firms charge?
Comparable governance assessments from consulting firms run $15,000 and up. Iron Lion is a founder-led practice with no overhead to pass along, and the Audit is priced to be an easy yes for the firms it serves. That will not be true forever.
Cross-mapped to ISO/IEC 42001 and NIST AI RMF: what does that mean?
Every fix on your roadmap is tied to the specific control it satisfies in those two frameworks. It is not a certification. It is the map an auditor, insurer, or regulator will recognize.
Will this disrupt the practice?
About four hours of your team's time across the engagement, most of it in short interviews. The work happens on our side.
What if we already have an AI policy?
Then we test it. Most policies we see were written by a chatbot and never operationalized. The Audit tells you whether yours would hold.
Three to four weeks from now, you can defend it.
Book the 20-minute call. We will tell you honestly whether the Audit is the right rung or whether a Risk Report is enough.