Solutions not problems
Many consultants either walk away at this point after listing all the areas of legal non-compliance, or they propose the most effective risk controls from the top of the hierarchy without giving any consideration to the cost of implementing those recommendations
