The Bureau

Independence

The Bureau assesses. It does not fix what it assesses, and it is never paid more for a better score. Everything below is a constraint on us, published so a counterparty can check it rather than take our word for it.

The boundary

What the Bureau may and may not do

May
  • Assess a property and issue a TIA Score, grade, and layer breakdown.
  • State findings and deficiencies against the published model — what is missing, which layer it belongs to, what it costs in score terms, and in what order it matters.
  • Re-score, monitor continuously, and publish score history and trend.
  • Publish the model, its weightings, its sector profiles, and its version history.
  • Publish generic guidance on what raises a score, available to everyone equally — including people who never buy anything.
  • Train, examine, and certify operators.
  • Benchmark, rank, and issue portfolio and peer-percentile reporting.
  • Produce the insurance posture report as advisory output.
May not
  • Design, specify, select, procure, install, configure, or project-manage security measures at a property it scores.
  • Recommend a named vendor, product, or installer for a scored property.
  • Accept compensation contingent on a score, a score change, a certification outcome, or a policy written against its output.
  • Accept compensation from a carrier, broker, or MGA in connection with a property it scores.
  • Score a property in which AIA or any principal holds an ownership or financial interest.
The grey zone, resolved

Where the line falls, precisely

The hard case is the remediation plan inside the assessment report. The line runs through it rather than around it: findings, priorities, and score consequences are inspection output and stay with the Bureau. Design, product selection, and delivery are consultancy and leave it.

Permitted — assessment outputProhibited — consultancy
Perimeter lighting fails the model at 4 of 11 measured points; this is the largest single recoverable deficiency, worth about 6 points.Install this fixture at these coordinates; here is the wiring plan.
Access control at the north entrance is unmonitored between 22:00 and 06:00.Use this vendor's system; we will manage the installation.
Addressing these three items in this order recovers the most score per dollar.We will design and deliver the programme, priced at X.
Compensation

The firewall around what an assessor earns

Fixed fee, published

Assessment is priced at a published fixed fee. Never contingent, never a success fee, never indexed to score movement. Monitoring is priced identically for a property scoring D and one scoring A — a score that goes up must not cost the customer more, and a score that goes down must not cost us anything.

No assessor is paid on outcomes

No assessor's salary, bonus, or equity may be linked to the scores they issue, to score improvements at properties they assessed, or to revenue AIA earns from an assessed party. No assessor takes part in commercial negotiation with a party whose property they will score.

Recusal and cooling-off

An assessor may not score a property they have advised, or where a member of their household has a financial interest. Where AIA has provided remediation consultancy to a property, the Bureau does not score it for two years from completion. Any personal relationship with an assessed party is declared before assignment, and the assignment goes to someone else.

Disclosure on the report

Every issued score carries the model version that produced it, the assessor of record, and the data-confidence state the model computed. Disclosure of commercial relationships with the assessed party over the preceding 24 months is committed and not yet built — it needs relationship tracking per party, and we would rather say that than imply it is already on the page.

Not invented here

The boundary is the one assurance already uses

A reviewer should be able to map each commitment onto something they already recognise, rather than evaluating a bespoke arrangement invented by the party that benefits from it.

ISO/IEC 17020

Inspection bodies. Conditions independent third-party inspection on the body not undertaking activities that compromise its judgement on what it inspects.

ISO/IEC 17065

Product, process, and service certification. Requires a certification body not to provide consultancy on the subject matter it certifies.

ISO/IEC 17021-1

Management system certification. Imposes a cooling-off period between consultancy and certifying the same client — the source of our two-year bar.

Sarbanes-Oxley §201

Prohibits, rather than merely discloses, a list of non-audit services to audit clients. Precedent that a structural conflict is answered with a prohibition.

SEC rules for rating agencies

Separate analytical from commercial functions and bar analyst compensation tied to fees from the rated party.

LEED

Separates standard-setting from certification, with accredited professionals as third parties rather than the certifier.

Reviewing us for a carrier or a lender?

The methodology, the version history, and the appeal process are published alongside this. If something you need is missing, ask for it — a boundary that cannot survive being read is not one.