Architecture review & assurance
A design needs sign-off, the internal reviewers are conflicted or oversubscribed, and you need a defensible opinion you can stand behind.
An architecture review is worth having only if it could come back negative. The value lies in an independent opinion that will survive challenge from your audit function, your regulator, or the team whose design it is.
What I review
On-premises, cloud, hybrid and SaaS designs. Platforms handling high-value transactions. Analytics systems operating over large regulated data estates. Third-party and vendor systems being onboarded.
How I work
Threat model first. Checklists tend to find only the things you already knew to look for, so they come second.
Findings written for two audiences. An engineer needs enough detail to fix the issue. An executive needs to understand what happens if it goes unfixed. One document, readable by both.
A recommendation you can act on. The point of a review is a decision. I will say whether the system should go live, what conditions apply, and what I would accept as evidence those conditions have been met.
Building the capability
Where it is useful, I will leave behind the review criteria and threat-modelling approach so your own architects can run the next one. Creating a permanent dependency on an external adviser tends to be poor value for the client.