About
Why Novaris exists
Most "AI consulting" firms are trying to sell you AI. Novaris doesn't build or implement AI systems — we bring enterprise risk management, fraud-risk, and controls-testing (RCSA) discipline to the AI your institution has already adopted, and price it for a compliance team of two or three rather than a Fortune 500 model-risk department.
"Examiners already have a language for model risk. Our job isn't to invent a new one for AI — it's to extend the one your institution is already fluent in, apply the same rigor we've applied to fraud and enterprise risk for years, and add the EU AI Act pieces before they show up as a surprise."
Novaris was built on a specific premise: AI governance shouldn't be a new discipline bolted onto your institution — it should be an extension of the COSO ERM, fraud-risk, and controls-testing programs you already run. That's why every engagement starts with a COSO ERM-based compliance assessment rather than a generic AI checklist. It's also why AI Fraud & Trust — deepfake risk, prompt injection, identity fraud, AI misuse — is a full practice area here, not an afterthought. Most AI governance firms come from a compliance or technology background and don't cover either.
Founder name placeholder — replace with real name and specific prior roles before publishing.
- Every assessment follows a published methodology — no black-box scoring.
- Recommendations are scoped to what a two- or three-person compliance team can execute, not a Fortune 500 department.
- We're an advisory practice, not a law firm — findings inform your counsel, they don't replace them.
Methodology
How an assessment actually runs
Transparency here matters more for a governance advisor than almost anywhere else — you should be able to evaluate the process before you buy it.
Week 1 — Discovery
Structured interviews with compliance, IT, and lending or underwriting teams to build the AI system inventory. This is where most institutions first see the full list of AI in production.
Week 2 — Classification & scoring
Each system is classified by EU AI Act risk tier and scored against NIST's four functions, using the same methodology behind the free readiness check.
Week 3 — Findings & readout
A findings report prioritized by actual risk, presented in a format built for a board or exam conversation — not a 60-page document nobody will read.
Want to see the methodology applied to your institution?
Twenty minutes is enough to know if it's a fit.
Book a 20-minute posture call