A senior consultant walks one of your sites, tests the controls that carry the most exposure, and writes it up plainly.