One senior practitioner, start to finish
Highpoint Risk Management Consulting helps organizations build, run and mature their governance, risk and compliance programs. Twenty years of hands-on audit leadership across PCI DSS, SOC, SOX and ISO 27001 — applied directly to your program, not delegated down a bench.
Most compliance problems are not knowledge problems. They are scoping problems, evidence problems and sequencing problems that surface six weeks before fieldwork, when there is no time left to fix them. The work here is to find those early, decide what actually matters, and get the program into a state where the audit is uneventful.
Services
Practical, audit-tested guidance — from first gap assessment to sustained certification.
PCI DSS readiness and advisory
ISA-led gap assessments, scoping and segmentation strategy, remediation roadmaps, and assessor-ready evidence preparation for merchants and service providers.
SOC 1, SOC 2 and SOC 3 readiness
Control design, readiness assessment and audit management so your first — or fifteenth — SOC examination runs without surprises. Financial-reporting controls under SOC 1, security and the other Trust Services Criteria under SOC 2, and the general-use SOC 3 report derived from it.
SOX compliance
The full SOX control population — IT general controls, business process controls and application controls — scoped, tested, remediated and defended to the external auditor.
ISO 27001 implementation and internal audit
ISMS design, risk assessment, Statement of Applicability development, full clause 4–10 and Annex A internal audit, and certification support.
AI governance and compliance
EU AI Act readiness and NIST AI RMF alignment — inventorying AI use, classifying risk, and building the controls and documentation regulators and customers now expect.
Fractional compliance leadership
Senior GRC leadership on a fractional basis: program ownership, board and auditor communication, and team mentoring without the full-time cost.
Risk assessments and program design
Enterprise and IT risk assessments that produce decisions and priorities, not shelfware.
Common questions
What does Highpoint Risk Management Consulting do?
Highpoint Risk Management Consulting is an independent GRC advisory practice that helps companies prepare for and pass security and financial compliance audits. Core work covers PCI DSS, SOC 1, SOC 2 and SOC 3, SOX, ISO 27001, NIST CSF, AI governance and third-party risk management. Engagements range from a single gap assessment through fractional compliance leadership.
Who runs Highpoint Risk Management Consulting?
Hovsep G. Iskikian, a CISA-certified and PCI ISA-qualified GRC practitioner with approximately twenty years of experience, including director-level leadership of audit and compliance programs at a regulated fintech. Clients work directly with him; engagements are not handed to junior staff.
What size company is Highpoint RMC a good fit for?
Companies facing their first major audit, companies that have outgrown a compliance-automation tool, and pre-IPO or newly public companies standing up a SOX program. Typical clients are technology, fintech and SaaS companies between roughly 50 and 1,000 employees that need senior judgment rather than additional headcount.
Is Highpoint RMC an audit firm or a certification body?
No. Highpoint RMC is an independent advisory practice. It prepares organizations for external audits, runs internal audits, and works alongside assessors and certification bodies, but it does not issue SOC reports, PCI Attestations of Compliance or ISO 27001 certificates. Keeping those roles separate protects the independence of your external audit.
Where is Highpoint Risk Management Consulting located?
Highpoint Risk Management Consulting, LLC is a California limited liability company based in the San Francisco Bay Area, serving clients across California and the United States. Engagements are delivered remotely, with on-site work available in the Bay Area.
How do I start an engagement?
Send an inquiry through the contact page at https://www.highpointrmc.com/contact or email hovsep@highpointrmc.com. The first step is a short call covering your framework, timeline and audit history. A scope and proposal follows within a few business days.
Audit on the calendar? Start with a conversation.
Preparing for an assessment, facing a new compliance requirement, or want experienced eyes on a program you inherited — the first call costs nothing and usually shortens the work.