Case Studies
Read the three case studies.
Three real companies from our research book. Three full audits. The numbers below are what the same failures cost, and what the audits found. We caught what the problem was. Every one of these issues can be fixed, and every one of them needs fixing now, before an open door becomes a paid penalty.
01
The Adviser
What the same failure cost
$35 MILLION
A registered adviser, audited before an examiner audits it. Six findings.
Start here02
The Venture Firm
What the same failure cost
$400,000
Published numbers checked against the firm's own filing. Three versions of one number.
03
The Builder
What the same failure cost
$11.3 MILLION
A construction prime, graded the way a buyer grades it. Two findings, three passes.
Case Study One
The adviser
An SEC registered adviser · Read November 8, 2026
$35 MILLION
The penalty one of the largest advisory firms in the country paid in 2022, after a vendor it had never checked resold drives holding the information of about 15 million customers. The rule broken was the safeguards rule. SEC Press Release 2022-168. The findings below are openings of the same kind, and they are open right now. Closed now, they stay findings on a page. Left open, they are how a penalty starts.
The audit · Standard header scan scores
The filed domain
The website address in the firm's own federal filing
15 / 100
Grade F · 6 of 12 checks failed
The live domain
Where the filed address forwards every client
25 / 100
Grade D minus · 5 of 12 checks failed
15 MILLION
Customer records on the resold drives in the enforcement case
6
Findings in this audit
2
Domains read, the filed one and the live one
1
The website address in the filing forwards to a different domain, over an unencrypted hop. The filing and the door do not match.
Fix route: We correct the filed address and the redirect now, so the record and the door agree before an examiner compares them.
2
The filed domain scores 15 of 100 on the standard header scan, failing six of twelve checks.
Fix route: We rebuild the header layer to the full standard set and confirm every check passes.
3
The live domain scores 25 of 100 on the same scan, failing five of twelve checks.
Fix route: We run the same rebuild on the domain clients actually reach.
4
The domain that carries the firm's email publishes no DMARC record, and no SPF record answered for it.
Fix route: We publish both records and move the policy to full enforcement, before a spoofed message in the firm's name reaches a client.
5
A standard transport assessment could not complete. Its probes were refused, so part of this posture cannot be verified at all.
Fix route: We open the door to verification, keep the protections that matter, and record what every check returns.
6
The live domain's registration expires on December 13, 2026, about five weeks after the audit.
Fix route: We confirm the renewal and the protective locks now, because five weeks is no time to discover a lapsed domain.
The Challenge
A mid sized adviser lives one examination away from the questions the $35 million case asked.
The Role
The verification desk selected the firm, ran the audit, and wrote the findings record.
The Strategy
Every published claim the firm makes, checked against its own filing.
The Execution
Six findings, each one verified before it was written down.
The Outcome
Six findings with their fix routes, caught while each one is still a fix and not yet a penalty.
Case Study Two
The venture firm
Published numbers checked against its own filing · Read November 8, 2026
$400,000
Combined penalties two investment advisers paid in March 2024, because what they published claimed capabilities the record behind them did not support. The charge was never that the work failed. It was that the statements could not survive a read against their own record. SEC Press Release 2024-36. Until the figures are reconciled, every new reader finds the gap first and asks the firm to explain it.
One firm · Three sizes · Nothing reconciles them
Claimed on the website
The statistics band: total assets under management
$550 MILLION
Filed with the Commission
Gross assets across its private funds, filing of March 31, 2026
$521,133,376
The three funds presented
Their published sizes, added together
$405 MILLION
The three figures measure different things, and no page reconciles them, so a diligence reader meets three sizes for one firm and has to stop and ask.
3
Funds presented on the website
against
40
Private funds counted in the firm's own filing
1
Three published figures for one size, and nothing reconciles them.
Fix route: We set one governed figure set and carry it everywhere the firm publishes, before the next diligence read reconciles the numbers for the firm.
2
The filing counts 40 private funds. The website presents three.
Fix route: We align the published roster with the filing count, and state the reason wherever the counts differ.
3
No DMARC record, so a message spoofing the firm reaches a limited partner with no published policy against it.
Fix route: We publish the record and move it to full enforcement, before a spoofed message reaches a limited partner in the firm's name.
4
The header scan returned 25 of 100, failing five of twelve standard checks.
Fix route: We apply the full standard header set and confirm every check passes.
5
The www address redirects down to an unencrypted address before returning to the secure one.
Fix route: We rebuild it as a single secure redirect chain.
◆
Every figure here is the firm's own, read from its website and its filing on the same morning. The distance between claim and record is the whole finding.
The Challenge
Every number a venture firm publishes is a claim its next diligence process will test against its filings.
The Role
The desk read the website in full and set it against the firm's own federal filing.
The Strategy
Claims against filings first, because that is the check diligence runs first.
The Execution
Five findings, each read from what the firm itself publishes and files.
The Outcome
Closed now, the distance is an edit. Left open, it becomes an answer owed under pressure.
Case Study Three
The builder
A construction prime · Graded the way a government buyer grades it
$11.3 MILLION
Paid by a prime contractor and its subcontractor under the False Claims Act in June 2024. Both admitted the cybersecurity testing their contract required was never completed. The application launched, and within twelve hours it was shut down with applicants' personal information exposed. U.S. Department of Justice, June 17, 2024. The layer below scores zero right now, and it stays at zero until somebody closes it.
The audit · Protective header layer
0 / 100
The protective header layer scores zero
Five of twelve checks failed. Of the standard protective headers, only content type protection is present.
One published business development email link is malformed
A defect shipped inside the firm's own contact path, in the address itself.
The address redirects are correct
The plain address moves to the secure one, and the www address settles on the main domain.
The domain dates to 2003 and runs to September 2027
A long held registration with years of horizon left.
Email authentication rejects spoofed mail outright
The strongest posture of any firm in this set.
The Challenge
Buyers read a public system as evidence of whether a firm runs its checks before the fact or after it.
The Role
The desk graded the public system layer by layer and recorded the passes with the failures.
The Strategy
Transport and redirects, the protective header layer, email authentication, and every published contact path.
The Execution
Two findings and three passes, each read from primary sources on November 8, 2026.
The Outcome
One unwatched layer, caught while the fix is still a configuration change. Left unwatched, it is the first thing the next buyer grades.
Found first, problems like these can be prevented, avoided, simplified, or redirected.
Every figure on this page is a public enforcement fact, or a figure the firm itself published or filed. That is what an audit reads, and it is all an audit needs.
Start With The AuditPhoto credits
- Case Study One · “Low angle view of skyscrapers,” photograph by Sean Pollock, via Unsplash and Wikimedia Commons. License: CC0 1.0 Universal. Wikimedia Commons
- Case Study Two · “Conference Room Irvine Tax Solutions,” photograph by Irvinemarketingservice, own work, via Wikimedia Commons. License: CC BY-SA 4.0. Wikimedia Commons
- Case Study Three · “Tower crane rising at hollywoodHUB construction site, Portland, Oregon,” photograph by PortlandAppraisalBlog, own work, via Wikimedia Commons. License: CC BY-SA 4.0. Wikimedia Commons