The Advisor Who Wants to Assess Its Own Client
Northline Advisory is a 22-person consulting firm that has provided vCISO and compliance support to a 180-employee defense electronics manufacturer, Apex Relay, for 19 months. Northline helped write Apex Relay's SSP, policies, and POA&M and coached staff through mock interviews. Northline now wants to expand into CMMC assessments and has two employees who passed the Certified Assessor exam. The firm plans to use the same consultants who advised Apex Relay to perform Apex Relay's Level 2 assessment, arguing that they know the environment best and that a separate team is unnecessary because the firm has only one assessment team. Apex Relay's assessment is scheduled in 45 days. Northline's managing partner asks you whether the plan is permissible and, if not, what structure would allow the firm to both advise and assess without undermining the assessment's credibility. The firm cannot afford to create a wholly separate legal entity this year.
1. Assess the conflict-of-interest and independence problem in Northline's plan. Explain whether passing the assessor exam or using a separate team solves the issue.
Read the worked answer
Northline's plan creates a self-review threat that cannot be cured by the fact that two staff passed the assessor exam. A CMMC assessment is an independent attestation; if the same firm wrote Apex Relay's SSP, policies, and POA&M and coached its staff, the assessors would be evaluating their own work and would have a financial incentive to find it sufficient. The organizational conflict exists even if a 'separate team' is used, because Northline has one assessment team, shared leadership, and shared revenue. Accreditation rules generally prohibit a C3PAO from assessing an organization it has advised on the same scope; client consent does not remove the conflict.
The practical conclusion is that Northline must choose one role for Apex Relay this cycle. It can remain the advisor and refer the assessment to an independent C3PAO, or it can decline further advisory work and observe a documented cooling-off period before any assessment. It should not perform the Level 2 assessment in 45 days.
For the future, Northline needs a written conflict-of-interest policy, separate assessment and consulting profit centers, no personnel crossover, independent quality review, and a rule that no assessor touches a client they advised. If it cannot create structural separation this year, it should not pursue both services for the same client.
2. Recommend a compliant path for Northline and Apex Relay over the next 45 days, including what Northline should say to the client and what it should build for future engagements.
Read the worked answer
Immediate steps: disclose the conflict in writing to Apex Relay; document the advice; do not sign or support an assessment engagement. Help Apex select an independent C3PAO and provide a clean evidence index, but do not sit in interviews or influence sampling. If Northline wants to assess, it must not have advised Apex on the same scope; given the 19-month history, that is not realistic for this assessment. Future structure: a separate legal entity or at minimum a formally approved firewall with separate management, compensation, and quality review; a conflict register; and a cooling-off rule.
Communication to Apex should be direct: 'We can help you prepare or assess you, not both.' Northline should explain that an independent assessment protects Apex's credibility with the prime and DoD. It can offer a transition plan: introduce the new C3PAO, hand over evidence without advocacy, and stay available for remediation after the assessment. This preserves the relationship and avoids a challenge to the assessment.