The pressure is on every system that feeds the financial statements

The Department of War has set a target of a clean, department-wide audit opinion for fiscal year 2028, with a clean opinion on the FY2027 Working Capital Fund statements as the first milestone. The department's Inspector General engages an independent public accounting firm for the statement audits, and components that fail independent audits can face funding consequences under the FY2024 National Defense Authorization Act.

Every contractor and component whose systems feed those statements will feel the effect: more evidence requests, more reconciliations and less tolerance for undocumented controls.

• Ledger-to-subledger reconciliations
• IT general controls (ITGC) testing and remediation
• Evidence packages organized by audit assertion
• Corrective action plan tracking
• Auditor request management

Improper payments are a data problem first

On March 20, 2025, the President signed an executive order directing agencies to share data to stop waste, fraud and abuse. The White House fact sheet cites an estimated $236 billion in improper payments in fiscal year 2023, with 74% of them overpayments.

Finding those payments requires the skills our principal has applied for decades: validating data warehouses, writing analytic scripts and tracing anomalies to their cause. That work recovered $20 million in potential lost revenue for Fortune 100–500 clients and cut data-analysis error rates by 30%.

• Duplicate payment and vendor screening
• Eligibility and identity data matching
• Anomaly detection across transactions
• Root-cause analysis and control fixes
• Recovery and reporting support

CMMC is now a contract requirement

The DFARS rule implementing CMMC was published on September 10, 2025 and became enforceable on November 10, 2025. The Department is phasing in requirements over three years, starting with self-assessments, and contracting officers can include CMMC requirements in solicitations during the phase-in.

Level 2 rests on the 110 security requirements of NIST SP 800-171 Revision 2, evaluated through 320 assessment objectives. Level 2 certification assessments are performed by a CMMC Third-Party Assessment Organization (C3PAO) every three years, with results recorded in eMASS.

• Gap assessment against all 110 requirements
• System Security Plan (SSP) development
• Plan of Action and Milestones (POA&M)
• Scoping of systems that handle FCI and CUI
• C3PAO assessment preparation

Your accounting system is part of your contract

Cost-reimbursable and time-and-materials contracts depend on an accounting system that segregates direct and indirect costs, tracks labor accurately and excludes unallowable costs. Weak systems lead to withheld payments, disallowed costs and lost competitiveness.

We design and maintain systems that meet FAR Part 31 cost principles and DFARS business system expectations, then prepare you for every type of DCAA engagement.

• Chart of accounts and job costing
• Timekeeping and labor distribution controls
• Indirect rate pools and provisional billing rates
• Incurred cost submissions
• Billing system controls and audit defense

The 2024 revisions changed the numbers

The revised Uniform Guidance (2 CFR 200) took effect on October 1, 2024. The Single Audit threshold rose from $750,000 to $1,000,000 in federal expenditures; organizations without a negotiated indirect rate may use a de minimis rate of up to 15%, up from 10%; and the equipment threshold rose from $5,000 to $10,000.

Budgets, cost allocation plans and policies written under the old rules may now leave money on the table or create audit findings.

• Budget and budget justification rebuilds
• Indirect cost and de minimis rate decisions
• Allowable-cost reviews
• Subrecipient monitoring
• Single Audit preparation

The rulebook is being rewritten

The Revolutionary FAR Overhaul stems from a 2025 executive order to streamline the Federal Acquisition Regulation and its supplements. Agencies have issued class deviations adopting rewritten FAR parts, including Part 31 on contract cost principles, and GSA's "Refresh 30" effort is updating Multiple Award Schedule solicitations and contracts such as OASIS+, Alliance and Polaris.

Industry groups report dozens of clauses added, removed or replaced, with roughly 90 days to accept refreshed schedule terms. The next phase is formal rulemaking with public comment.

• Clause-by-clause impact reviews
• Policy and procedure updates
• Cost accounting practice alignment with Part 31 deviations
• Contract modification review before acceptance

The same rigor federal auditors demand, applied to your family's assets

Wealth is now held in systems: custodians, fund administrators, cloud accounting, banking portals and the personal devices of every family member. Each one is a door. We test those doors the way a Big 4 information systems auditor would, then report to you in plain language.

Our principal reads a balance sheet and a system access log with equal authority. That dual view finds the gaps a single-discipline adviser misses: the wire approval with no second signer, the former employee still holding portal access, the vendor whose cloud settings no one has checked.

One adviser across the triangle

Many families hold assets, homes and entities in more than one jurisdiction. As a dual citizen of the United States and Barbados, our principal works comfortably across Manhattan, Brickell and Barbados's west coast, coordinating with your attorneys, trust officers and accountants rather than replacing them.

Photo: Colleton, Barbados

Who can move money, and who checks?

A family office is a small institution handling institutional-scale assets. Many run on trust and a few key people, which is exactly where losses begin: a single person who can create a vendor and pay it, a former assistant whose portal access was never removed, or a wire request approved by email alone.

We test those controls the way an information systems auditor tests a public company, mapped to COBIT, NIST CSF, ISO 27001 and COSO, and then explain the results in plain language.

• Payment and wire approval controls
• Segregation of duties
• User access to banking and accounting systems
• Change management for financial systems
• Backup, recovery and record retention

Your security is only as strong as your vendors'

Family offices depend on custodians, fund administrators, accounting firms, IT providers and cloud platforms such as AWS, Azure and Google Cloud. Each one holds data or access that could be misused. Yet few families review those providers with the rigor a corporate vendor-risk program would apply.

We inventory every provider, review their security assurances and contracts, and identify where a single vendor failure could expose assets or private information.

• Vendor inventory and data-flow mapping
• Review of SOC reports and security attestations
• Contract terms for security, breach notice and data return
• Cloud configuration reviews
• Concentration and continuity risk

The family, not the office, is often the easiest way in

The FBI estimated $16.6 billion in losses to internet-enabled crime in 2024, according to industry reporting. Attackers target personal email, social media, reused passwords and poorly secured home devices, and some time their attacks for when a family is traveling and cannot see security alerts.

We apply a practical protection program to every family member, without making daily life harder than it needs to be.

• Inventory of devices, accounts and home networks
• Removal of unnecessary public personal data
• Multifactor authentication and password managers
• Separate home and guest networks; device updates
• Travel precautions and family training, including code words for urgent requests

Senior financial oversight without a full-time hire

Many families and closely held businesses do not need a full-time chief financial officer, but they do need someone senior watching the numbers. Our fractional CFO service provides consolidated reporting across entities and accounts, reconciliation of cash and investments, and analytics that flag unusual payments, duplicate vendors and unexplained transfers.

Our principal holds an MSc in Finance and has led finance and audit functions for organizations from a $300K baseline to $5M in annual operations, and inside a $96B+ enterprise.

• Consolidated multi-entity reporting
• Cash and investment reconciliation
• Budget and cash-flow planning
• Fraud and anomaly detection
• Coordination with your CPA, attorneys and trustees

New York, Miami and Barbados

Holding assets, homes and entities in more than one jurisdiction multiplies the number of banks, administrators, advisers and reporting obligations a family must manage. Inconsistent controls across those jurisdictions create gaps that are hard to see from any single office.

As a dual citizen of the United States and Barbados, our principal coordinates controls and reporting across both, working alongside your attorneys, tax advisers and trust officers rather than replacing them. We do not provide legal or tax advice; we make sure the financial controls and records your advisers rely on are sound.

• Consistent controls across jurisdictions
• Entity and account inventories
• Reporting support for your advisers
• Barbados economic substance considerations, coordinated with your counsel

Books that are ready before anyone asks

Every engagement starts with a simple goal: records complete and accurate enough that an auditor, a lender or a board member can follow every number back to its source. For federal contractors that also means FAR-compliant job costing, timekeeping and indirect cost pools; for nonprofits, restricted fund accounting; for corporations, close processes that support SOX controls.

We work inside your existing systems where possible and recommend changes only when they reduce risk or effort.

• Monthly close and reconciliations
• Financial statements (GAAP or federal grant standards)
• Budget-to-actual and cash-flow forecasting
• Fixed assets and depreciation
• Audit support schedules

Systems that pass both audits and attacks

Financial systems are now the main target for both auditors and attackers. We implement and secure ERP platforms and cloud environments, test IT general controls and build the documentation that frameworks such as NIST SP 800-53 and 800-171, FISMA, FedRAMP and SOC 2 require.

Our principal holds CISA, CISM, CRISC and CCISO credentials and AWS ML/AI certification, and began his career in information systems audit at PwC.

• ERP implementation and optimization
• Cloud security configuration (AWS, Azure, GCP)
• IT general controls testing
• Access reviews and role design
• Incident response planning

From award to closeout, compliant at every step

Winning a federal award is the start of a long list of obligations: billing correctly, tracking allowable costs, meeting reporting deadlines and preparing for audits. We manage those obligations for contractors and grant recipients so program teams can focus on delivery.

Our principal has served as primary technical and proposal writer on federal contracts and grants from $2 million to $50 million, including CDC and SAMHSA awards.

• Contract billing and invoicing
• Allowable vs. unallowable cost segregation
• Grant budgets and federal financial reports
• Subrecipient and subcontractor monitoring
• Closeout support

On time, on budget and on the record

Programs fail financially long before they fail operationally: a budget that is not tracked against progress, change orders approved without cost analysis, or deliverables that cannot be traced to contract requirements. We connect schedule, scope and cost so leaders see problems early.

• Earned value management (EVM)
• Integrated master schedules
• Risk registers and mitigation plans
• Change order financial impact analysis
• CDRL and deliverable tracking

Events that run smoothly and reconcile to the penny

Conferences, trainings and executive meetings carry real financial and compliance risk, especially for federal funds. We plan events with the same discipline we bring to accounting: compliant procurement, per diem verification, approval workflows and a full post-event reconciliation.

Our principal is also a senior travel and meeting consultant and convention and meeting planner.

• Venue sourcing and contract negotiation
• Registration and attendee management
• FTR/JTR and GSA per diem compliance
• Vendor procurement and performance terms
• Post-event reconciliation and ROI

When one partner is better than five

Separate vendors for accounting, IT security, compliance and program management create gaps where findings emerge. Our integrated solutions put those functions under one leadership team with one set of standards.

• Full back-office outsourcing
• Federal contractor support packages
• Audit readiness programs
• Private-client risk programs

Protecting patient data and program dollars

Healthcare organizations hold some of the most sensitive data and some of the most complex funding in any sector. Our affiliate, Echo Health Solutions, provides independent pharmacy and 340B program management, while Echo Consulting Solutions provides the IT audit, cybersecurity governance and financial compliance that support it.

Our principal has led finance, internal audit and HIPAA security compliance for a multi-site, federally funded health organization, with ten consecutive clean external audits.

• ITGC testing in clinical systems
• HIPAA Security Rule risk analysis
• Clinical data-warehouse validation
• Federal health grant compliance

Strong finances protect the mission

Nonprofits answer to donors, foundations, federal agencies and the public. We provide the fund accounting, grant compliance and audit preparation that keep that trust, including Single Audit readiness under the 2024 Uniform Guidance threshold of $1,000,000 in federal expenditures.

Organizations seeking fiscal sponsorship or help forming a 501(c)(3) can work with our affiliated nonprofit, United National Care.

• Restricted and unrestricted fund accounting
• Federal and foundation grant management
• Form 990 preparation support
• Single Audit readiness

Winston A. Liburd, MSc — Principal

Winston leads Echo Consulting Solutions and its affiliate, Echo Health Solutions. He began his career in information systems audit at PwC, serving Fortune 100–500 clients in the airline, hospitality and healthcare sectors, then held finance leadership roles at The Wendy's Company and at a distribution division of The Kroger Co. before leading finance, internal audit and compliance for a multi-site, federally funded healthcare organization.

His work combines two disciplines that rarely sit in one person: executive corporate finance and technical IT controls. He holds an MSc in Finance from Georgia State University and a BBA in Accounting from Hofstra University, and is a dual citizen of the United States and Barbados.