Trust & firm
Frequently asked questions
Direct answers on scope, tools, confidentiality, travel and independence.
Before entrusting a file
Direct answers on the mandate, the information and how it will proceed.
These responses describe the common rules. The proposal then sets out what depends on your document, your client, your country and your deadline.
Frequently asked questions
What a supplier or a principal needs to know before scoping.
In what situations can you intervene?
iKNSA steps in whenever a relationship with a client or a European market creates a decision to be worked through: questionnaire, security annex, announced audit, findings, renewal, tender, incident, regulatory exposure, product security or the maintenance of several commitments.
Do you work for the supplier or for the European contracting party?
Both mandates are possible, but they are never conflated. The proposal specifies who mandates, who funds, who receives the conclusions and what may be communicated to the other party.
Who works on the engagement?
The proposal names the roles required for the scope: mandate leadership, governance review, technical examination or specialist contribution. Any prospective partner, their role and their access to information are declared before they take part.
Do we already need a questionnaire or an audit report?
No. An actual document speeds up qualification, but the first exchange can start from a deadline, a draft contract, a client relationship or a difficulty proving something. Attaching a file to the form remains optional.
Can a confidentiality agreement be signed before documents are exchanged?
Yes, where the sensitivity of the file justifies it. Recipients, purpose, sharing restrictions and retention conditions are then agreed before substantive analysis.
Who can see the information and the conclusions?
Only the people and parties authorised under the mandate can access the relevant items. The register retains their source and restrictions; any trust room exposes only a selection that has been expressly authorised.
Do you deal directly with my European client?
Never without the supplier's explicit written authorisation, except where legally required. Where such participation is planned, iKNSA's role, the information that may be shared and the person who signs off on positions are defined before the exchange.
Can you step in once an audit or a tender has already begun?
Yes, if the timeframe still allows for a useful review. The document and the deadline are then dealt with first: blocking criteria, sensitive answers, available evidence, reservations and decisions that must be obtained before sending.
What happens if the conclusion reveals a significant gap?
The gap is neither concealed nor dramatised. The report distinguishes what is established, partial or unverified, then links the impact to a reservation, a decision, a remediation and a closure criterion.
Does remediation carried out by iKNSA count as independent validation?
No. Advice, implementation, verification and certification are distinct roles. A correction supported by iKNSA is never presented as an independent certification of that same correction.
Must we replace our GRC or documentation tools?
No. Existing tools can remain the working source. The engagement organises the relationship between requirement, commitment, evidence, exception, action and deadline without imposing the replacement of a suitable system.
Can engagements be carried out remotely or on site?
Both formats are possible depending on what needs to be observed. A visit is only retained if it provides evidence that documents, interviews or remotely accessible systems cannot. Eligibility and travel conditions are confirmed before booking.
What deliverables do we receive?
The mandate defines the deliverables required for the decision: response matrix, contractual positions, findings, evidence index, remediation plan, preparation report or maintained register. Each deliverable states its scope, sources, limitations and recipients.
What happens to our file at the end of the engagement?
The arrangements for export, handover, withdrawal of access, transition and deletion are agreed as part of the mandate. The relationship does not depend on retaining documents or data.
How are the schedule and price set?
After reviewing the trigger, scope, stakeholders, deadline and expected assurance level. The proposal then sets out the timeline, planned sessions, client mobilisation, responsibilities and fees; no fixed prices or timelines are calculated automatically on the site.
Your situation
Present the trigger, the deadline and the expected decision.
You can describe the context without attaching a document, or add the relevant document if it is useful for qualification.