Nine questions, answered before anything is signed.
Every answer below is a sentence the engagement letter or this site already states; nothing is written here for the first time. Print it, or save it as a PDF, and file it with the letter.
What exactly do you access, and with what rights?
Read-only, in your own systems. Your office creates the logins, logs their use and can revoke them any day.
ParetoAlpha holds no credential that can approve or release a payment. Payment runs are prepared for your signer, who releases every one.
Is MFA required; what about personal devices; any breach in the last three years?
Read-only, in your own systems. Your office creates the logins, logs their use and can revoke them any day.
ParetoAlpha's own platform: MFA, encryption, backups, subprocessors, dated, on the security page
Will you complete our NIST, SIG or CIS questionnaire; do you hold a SOC report or ISO certificate?
ParetoAlpha holds no SOC report or ISO certificate. I complete your security questionnaire instead.
What data leaves our systems, where is it kept, and when is it destroyed?
No copy of your documents leaves your systems. The record is sealed as fingerprints; the bytes stay with you.
I keep no copy of your documents. My copy of the finding is kept for four years under the NDA, then destroyed.
Are access rights reviewed and removed at the end?
Your office creates the read-only logins to online banking, logs their use and revokes them on day five.
Read-only, in your own systems. Your office creates the logins, logs their use and can revoke them any day.
What is in the contract: confidentiality, liability, termination?
The signed engagement letter governs.
The NDA is one-way: only the family's information is protected. It is signed by ParetoAlpha and comes with the engagement letter, before any access.
Under the letter, ParetoAlpha's liability is limited to the fee paid.
$15,000 a month. Fixed for twelve months. Cancel any month. The same for every family.
What do you do if you find what looks like fraud, and whom do you tell?
If something looks like fraud, I stop the work and tell the principal in writing the same day. If money appears to be in transit, I tell the principal at once, so the bank can be called. What happens next is the family's decision. If the principal appears to be involved, I stop the work, return the fee in full, and step away. Nothing here limits a disclosure the law requires.
Are the findings privileged, and should our counsel engage you?
Privilege is not offered. If the family's counsel wants to engage ParetoAlpha, counsel says so.
I am not a CPA. This is not an audit or an attest engagement.
Who are you, and what are you not?
ParetoAlpha, Inc. is not registered with the SEC, is not a CPA firm and is not a law firm. It keeps the books and the record, and releases no payment.
The family's name appears nowhere: not on this site, not in an example, not in a reference, without written consent.
Professional liability $2 million per claim and $2 million aggregate; cyber liability $1 million. The certificate is in the envelope.