A long-form, anonymized write-up of a real engagement — intended for procurement, board, and gatekeeper review. The full four-pillar diagnosis, the 60-day remediation sequence, the outcome, and what it means for an LE agency, a corporate security program, or a family office evaluating a fixed-price risk engagement.
The Director of Security at a 340-bed regional acute-care system reached out eleven weeks before a scheduled Joint Commission re-accreditation visit. The previous survey had closed with three Requirements for Improvement on the Environment of Care standards, and the organization did not want to repeat the cycle. Two of the open RFIs had been formally committed to the corrective-action plan at the prior visit; one of those commitments had already slipped its deadline once.
What the Director had, going into the engagement, was a Board that wanted a clean survey, an accreditation coordinator who was stretched thin across multiple parallel workstreams, a security team of three uniformed officers covering three entrances on the overnight shift, and a facilities team that had been quietly absorbing small physical-security asks for two years without a consolidated backlog. None of those conditions were unusual. They were, in fact, the conditions that show up at most acute-care systems between survey cycles.
What the Director did not have was a consolidated, ranked view of where the organization actually was exposed — versus where it was compliant on paper. The prior cycle's RFIs had been resolved individually, without a framework that would let the Board see whether the next cycle would surface a new wave.
The decision was to engage Vigil Advisory for a structured risk diagnosis under the Small Business tier ($1,500) — a fixed-price scope that delivered a ranked set of physical, personnel, procedural, and cyber-physical findings within two weeks of the on-site visit. No discovery phase. No retainer. The report was the deliverable.
A walk-through of the perimeter surfaces, including the visitor parking deck and the loading dock, identified an HVAC service corridor accessible from a public-facing stairwell that was unlocked between 6 PM and 6 AM. The corridor terminated inside the mechanical room for floors two through five — including the air-handling units serving medication storage and the central sterile processing suite. The access path was not in any of the organization's drawings. It had been added during a 2019 renovation and never reconciled into the access-control plan.
This was the highest-ranked finding in the report. It was a single physical-path vulnerability with first- and second-order consequences against the medication chain of custody and the sterile processing environment — both inside the Joint Commission's Environment of Care lens.
Observation of the front-entrance visitor flow (and a review of the contractor badging process at facilities intake) revealed that contractor and visitor badges issued at the lobby desk were not being reclaimed or audited at the end of each visit. Badges routinely sat in the possession of staff who had moved on to other floors by mid-morning, and uncollected contractor badges were, in two observed instances during the on-site week, found in staff break rooms on the fourth floor — the medication storage level.
This was not a hostile-actor insider-threat finding; it was a process-degradation finding. But the consequence was the same: a path existed, that should not have, and that an inspector could easily confirm.
A review of the eastern-wing overnight staffing plan — and the documented access-control layering around the controlled-substance storage room on that wing — surfaced a coverage gap in the third-shift rotation. The insider-threat checkpoint (a staffed secondary access layer, with documented dual-signature verification for any controlled-substance access during the 11 PM to 7 AM window) had been silently collapsed into a single-staffed verification step in 2023 and never reconciled to the written policy.
This finding carried the highest reputational and regulatory exposure of the three. A Joint Commission surveyor would have asked for the written policy, then asked whether the written policy actually described the on-floor reality. If those two did not match — and they did not — the finding would have been a Requirement for Improvement on the day of survey.
The east-wing medication corridor had nominal camera coverage, but the camera at the south end had been down for nine days pending a vendor replacement part, and the camera at the north end of the same corridor had a 14-second blind spot between the corridor and the elevator bank. Neither gap was flagged in the camera-health monitoring. Neither was the responsibility of any single named owner.
This was the lowest-severity of the three credential-and-exposure findings — but it was the one most likely to make the report persuasive to a non-security Board reader, because it described an exposure that was, in a literal sense, on camera. The board could see it.
The report landed on a Wednesday. The Director did three things before the next week's standing Board meeting.
First, she shared the report — the full unredacted version, before any of it was anonymized for distribution — with the Chief Operating Officer, the Chief Nursing Officer, and the accreditation coordinator. The report was kept tight: a ranked list of findings, the language of the actual vulnerability in plain terms, and a recommended remediation sequence with cost estimates anchored to the four pillars. Total remediation budget across all four findings was approved within the COO's existing operating authority; no Board vote was required.
Second, she convened a sixty-day working group with one named owner per finding. The HVAC finding went to Facilities. The visitor management finding went to the Director of Patient Access. The overnight east-wing rotation finding went to the CNO. The camera-coverage finding went to the contracted vendor, with a named internal owner for the SLA going forward.
Third, she scheduled weekly thirty-minute check-ins with each owner. These were not status meetings. They were short, drilled to specific remediation milestones, and they ended when each milestone was checked off against the report's recommended sequence.
The HVAC finding closed in week three. The visitor management finding closed in week four, after a one-week delay caused by a vendor change to the badge-reconciliation form. The overnight rotation finding closed in week six, after the written policy was ratified by the nursing leadership council and the named checkpoint role was staffed. The cameras closed in week seven.
By day sixty, all four findings were closed. None had re-opened for re-remediation. None had inadvertently surfaced a new dependency in adjacent processes.
The story above is anonymized, but the shape of it is not unusual. It is what happens when a fixed-price, practitioner-delivered risk assessment lands in front of a Director or a Chief of Security who has the authority — and the will — to act on what the report says. The four-pillar framework gives the reader a structure. The ranked findings give the Board something to vote against. The sixty-day working group gives the operating team a sequence they can actually execute. The result is a closed loop from "we think we have a problem" to "we have a defended position, in writing, on the day of survey."
For an LE agency reading this: the same sequence applies to a CALEA or POST audit cycle. The diagnostic is, in many cases, smaller than an accreditation cycle for healthcare — but the consequence of finding drift between the documented policy and what is happening on the floor is exactly the same. A fixed-price engagement, with ranked findings and a sequence to close them, is the artifact that lets a commander walk into a Board or a city council meeting with something he or she can defend.
For a corporate security program reading this: the cost line is the point. The Small Business tier, at $1,500, is the entry point for a department that has been told for two budget cycles that its security exposure is on the agenda, and has not been able to produce a report to defend the spend. A four-pillar, ranked, fixed-price diagnostic — delivered in weeks, not in months — is what makes the budget visible to the CFO.
For a family-office principal or a chief-of-staff reading this: the most useful comparative point is not the cost of the assessment, but the alternative cost of letting a single high-severity finding sit open for a quarter. The HVAC-path finding above would, on a single overnight incident, have been a multi-million-dollar exposure in legal fees and reputational cost. The cost of finding it, ranking it, and remediating it was, for this client, $1,500 plus internal staff time. That ratio is the entire argument.
Read the executive protection engagement to see how the same fixed-price model applies to family-office and corporate principal protection.
Vigil Advisory takes a limited number of engagements per quarter specifically because the operating model above — a structured diagnosis, a ranked report, a defended remediation — is what holds across cycles, and that is what we are selling. Not a discovery engagement. Not a retainer. A fixed-price artifact that the next person in the role can pick up and use.
For teams evaluating how to upskill after the diagnostic lands, the companion guide — How to Choose a Security Training Program — walks through the five criteria that separate operator-grade instruction from a certification mill.
The Credential Stack
Ammo program management, logistics, civil-military liaison, international operations. Full spectrum military experience, not one rotation and a marketing story.
Command-level supervisory experience. Patrol operations, investigations, fugitive apprehension, courtroom procedure. Not patrol officer turned vendor — the rank speaks for itself.
Elite tactical certifications that most security firms claim as marketing language. These are documented, operational credentials earned in the field.
Designed and managed international law enforcement training programs for the US Department of Justice. That means curriculum development, instructor selection, and cross-cultural program delivery — at scale.
A 30-minute conversation, scoped to your environment — agency, corporate, or family office. No retainer. No obligation. We will tell you whether a four-pillar engagement is the right step from here, and what the next step is if it is not.
Book a strategy call →