We have worked with them to assess our current risks, develop business cases for new services and implement those services in line with their recommendations. It has been an enjoyable relationship and they are always available if we need support or advice. The amount of detail that comes across from these consultants in such short timescales can sometimes be overwhelming so it's important you know what your priorities are and get everything agreed at the outset! They do great work but I don't think there should be any surprises when working with them - just understand each other's needs/wants and make sure all expectations are clear before hand. Our main risk areas were around data privacy. Their approach was very pragmatic and focused on how we could best address this area without having to spend too much time on paperwork etc which saved us lots of time down the road.