How an Engagement is Initiated
No advisory work, no access to client systems, no review of confidential documentation, and no billable activity of any kind commences until a formal written engagement letter has been issued by Yamasuki Advisory and confirmed in writing by the client. The process below is followed without exception for every engagement.
Discovery Call
A complimentary 30-minute scoping call, conducted via video conference. During this session, Yamasuki assesses the client's regulatory exposure, organisation size, and specific challenge. The call is a working session — not a sales presentation. If Yamasuki cannot add clear value, this is communicated directly.
No obligation · No fee · No documentation signedScope Confirmation & Engagement Letter Issued
Within 48 hours of the discovery call, Yamasuki issues a written Engagement Letter to the client. This document constitutes a formal offer to provide services and is legally binding upon acceptance. It confirms the agreed scope, all deliverables, the fixed total fee, the payment schedule, and the engagement timeline. It also incorporates these Terms of Engagement by reference.
Engagement Letter — formal written document issued by YamasukiClient Acceptance & Contract Formation
The contract between the client and Yamasuki Advisory is formed when the client provides written acceptance of the Engagement Letter — by email confirmation, countersignature, or electronic signature via DocuSign. Verbal acceptance is not sufficient to form a contract. Acceptance of the Engagement Letter constitutes acceptance of these Terms of Engagement in full.
Written acceptance required — email or e-signature via DocuSignStatement of Work (SOW) — Where Required
For engagements exceeding €10,000 in total value, or for any engagement involving access to client IT systems, SAP environments, or classified regulatory documentation, a formal Statement of Work (SOW) document is issued alongside or following the Engagement Letter. The SOW expands the scope detail, defines technical access requirements, names responsible personnel on both sides, and sets milestone checkpoints.
Statement of Work — issued for engagements of €10,000+ or involving system accessInitial Invoice & Commencement
Upon receipt of written acceptance and payment of the initial invoice (100% for engagements under €10,000; 50% deposit for larger engagements), Yamasuki will confirm a commencement date in writing. Advisory work begins on or after the confirmed commencement date. Not before.
Work begins only after: written acceptance + initial payment clearedWhat the Engagement Letter Contains
Every Engagement Letter issued by Yamasuki Advisory contains the following elements as standard. Clients should expect to see all of these before signing.
Parties
Full legal names of Yamasuki Advisory and the client entity, including registered address and company number where applicable.
Engagement Description
A plain-language description of the specific service being engaged, including its name from the Yamasuki service catalogue and the product ID for Stripe billing reference.
Defined Deliverables
A specific list of all deliverables the client will receive — e.g. board report, gap analysis, remediation roadmap. What is not listed is not included.
Fixed Total Fee
The confirmed total fee in EUR, excluding VAT. This figure is binding — it cannot be increased unilaterally by Yamasuki after the letter is accepted.
Payment Schedule
The exact invoicing timeline — when each invoice will be issued, the amount, and the due date. Follows the payment terms set out in Section 8 of these terms.
Engagement Timeline
Expected start date (conditional on payment and signed acceptance), duration of engagement, and expected delivery date for final output.
Named Adviser
The name of the primary Yamasuki adviser responsible for the engagement. This person is the client's point of contact throughout. Substitutions require client notification.
Client Obligations
What the client is required to provide — access, documentation, personnel availability, or system credentials — for the engagement to proceed as scoped.
Statement of Work (SOW)
A Statement of Work is a more detailed technical document issued for larger or more complex engagements. It operates alongside the Engagement Letter and does not replace it.
When an SOW is issued
Yamasuki issues a formal SOW for: engagements with a total value exceeding €10,000; all SAP GRC and IAM engagements where access to live SAP environments is required; Full DORA/NIS2 Implementation Programme engagements; M&A security due diligence engagements; and any engagement where the client requests one regardless of value.
What the SOW covers
- Technical scope: precise systems, environments, and datasets in scope and explicitly out of scope
- Access requirements: specific system credentials, VPN access, or third-party authorisations required from the client
- Milestones & checkpoints: stage gates where Yamasuki presents interim findings for client review before proceeding
- Named personnel: both the Yamasuki adviser(s) and the client contact responsible for each workstream
- Assumptions: conditions that must hold true for the SOW to remain valid — e.g. that client documentation will be provided within an agreed timeframe
- Exclusions: an explicit list of activities not covered by the engagement fee
Scope Management & Change Requests
The scope of every Yamasuki engagement is defined in the Engagement Letter and, where applicable, the SOW. Yamasuki operates on a strict scope management policy.
4.1 — What Happens When New Work is Identified
If, during an engagement, Yamasuki identifies additional work that falls outside the agreed scope — whether due to greater complexity than anticipated, additional systems in scope, or client-requested additions — this is handled through a formal Change Request.
A Change Request is a written document issued by Yamasuki that specifies: the nature of the additional work; the additional fixed fee; the impact on timeline; and whether client acceptance is required before the additional work proceeds. No additional work is undertaken without a signed Change Request. The client's original fee is never increased without a signed Change Request.
4.2 — Client-Caused Delays
Where an engagement is delayed because the client has not provided required access, documentation, or personnel availability as agreed in the Engagement Letter or SOW, Yamasuki reserves the right to reschedule the engagement to the next available adviser slot. No fee adjustment is made in favour of the client in this circumstance.
Important: Scope creep is never billed silently. If Yamasuki discovers that an engagement is more complex than scoped, the client will be notified immediately. Yamasuki will not exceed the agreed fee without a written Change Request signed by the client — even if doing so means the engagement takes Yamasuki longer internally.
Intellectual Property & Deliverable Ownership
5.1 — Client Deliverables
Upon receipt of full payment for an engagement, the client receives full ownership of all original work product produced specifically for that engagement — including reports, gap analyses, remediation roadmaps, policy documents, and framework designs. These deliverables are the client's property to use, distribute internally, and share with regulators, auditors, or enterprise clients without restriction.
5.2 — Yamasuki Methodology & Frameworks
The analytical methodologies, assessment frameworks, scoring systems, template structures, and knowledge base that Yamasuki applies during an engagement remain the intellectual property of Yamasuki Advisory. Deliverables may incorporate these frameworks as applied outputs, but the underlying methodology is not transferred to the client.
5.3 — Third-Party Tools & Software
Where Yamasuki uses third-party software or tools in delivering an engagement, any licences required are covered by Yamasuki's own subscription agreements unless otherwise stated. Clients are not required to purchase third-party licences to receive the deliverables from a Yamasuki engagement.
Confidentiality & Non-Disclosure
NDA Status: Confidentiality obligations under this Section are express contractual terms — not implied. They are binding on the client from the moment the Engagement Letter is accepted. For higher-risk engagements, a separate standalone Mutual NDA is also executed. See the tiered structure in Section 6.5.
6.1 — Definition of Confidential Information
"Confidential Information" means all information, in any form or medium, disclosed by one party (the "Disclosing Party") to the other party (the "Receiving Party") in connection with an engagement or potential engagement, whether disclosed before or after the Engagement Letter is signed and whether or not marked as confidential. This includes without limitation:
- Information disclosed during discovery calls and scoping sessions, prior to formal contract formation
- Regulatory compliance gaps, audit findings, and vulnerability assessments
- SAP system architecture, role configurations, Segregation of Duties conflicts, and access control data
- Business strategy, commercial relationships, client lists, and financial information
- Personally identifiable data, employee information, and data subject records
- The existence, scope, and findings of any engagement between Yamasuki and the client
- Any deliverables, reports, or outputs produced during the engagement
6.2 — Standard Carve-Outs
Confidential Information does not include information that the Receiving Party can demonstrate by written evidence: (a) was already known to the Receiving Party at the time of disclosure, without restriction; (b) is or becomes publicly available through no act or omission of the Receiving Party; (c) was independently developed by the Receiving Party without reference to the Disclosing Party's Confidential Information; or (d) was lawfully received from a third party without restriction. Additionally, either party may disclose Confidential Information to the extent required by law, court order, or regulatory authority — provided the Receiving Party gives the Disclosing Party prompt prior written notice where permitted, and cooperates with any application to limit the scope of required disclosure.
6.3 — Yamasuki's Obligations
Yamasuki shall: hold all client Confidential Information in strict confidence; use client Confidential Information solely for the purposes of delivering the agreed engagement; not disclose client Confidential Information to any third party without the client's prior written consent; restrict internal access to client Confidential Information to personnel who need it for the engagement; and apply at minimum the same standard of care it uses to protect its own confidential information of equivalent sensitivity — and in any event no less than reasonable professional care.
6.4 — Client's Obligations
The client shall treat all Yamasuki Confidential Information — including Yamasuki's methodologies, assessment frameworks, pricing structures, and proprietary tools — with equivalent care. The client shall not disclose Yamasuki deliverables, reports, or methodologies to third parties (other than their own regulators, auditors, or legal advisers on a need-to-know basis) without prior written consent from Yamasuki.
6.5 — Tiered NDA Structure
Yamasuki operates a three-tier confidentiality structure depending on the sensitivity of the engagement:
Before the Discovery Call
For any discovery call where the prospective client intends to disclose sensitive compliance, system, or financial information, Yamasuki offers a brief mutual Discovery NDA (1 page) to be signed before the call. Available on request at contact@yamasuki.ie. Not mandatory but recommended where the client has procurement requirements.
All Engagements (this Section)
This Section 6 applies to all engagements as part of the Terms of Engagement incorporated into every Engagement Letter. It creates binding confidentiality obligations on both parties from the moment the Engagement Letter is accepted.
Higher-Risk Engagements
A standalone Mutual Non-Disclosure Agreement is executed prior to commencement for: any engagement involving access to live production systems or SAP environments; engagements where the client has shared, or will share, personally identifiable data; clients whose own procurement policy requires a standalone NDA; and any engagement the client requests it for, regardless of scope.
Where Client Requires Their Template
Where a client's procurement policy requires the use of their own NDA template, Yamasuki will review and, subject to reasonable negotiation, execute that document. Yamasuki's standard position is that its own template is preferred but client templates are considered on their merits.
6.6 — Duration of Confidentiality Obligations
Confidentiality obligations under this Section survive the termination or expiry of the relevant engagement for a period of five (5) years. Confidential Information that constitutes a trade secret (including SAP architecture details, proprietary compliance frameworks, or commercially sensitive regulatory strategies) is protected indefinitely under Irish law regardless of the 5-year general term.
6.7 — Associate Consultants
Where Yamasuki engages an Associate Guild member to deliver any part of a client engagement, that associate is bound by a separate written confidentiality and non-disclosure agreement with Yamasuki prior to any access to client information. Associates are permitted to access only the client Confidential Information directly necessary for their specific workstream. Yamasuki remains fully responsible to the client for any breach of confidentiality by an associate consultant.
6.8 — Remedy for Breach
Both parties acknowledge that a breach of confidentiality obligations may cause irreparable harm for which damages alone may not be an adequate remedy. Accordingly, in the event of a breach or threatened breach, the non-breaching party is entitled to seek injunctive or other equitable relief from the Irish courts without the requirement to post a bond or prove actual damages, in addition to any other rights and remedies available at law.
Limitation of Liability
7.1 — Total Liability Cap
Yamasuki's total aggregate liability to a client under or in connection with any engagement — whether arising in contract, tort (including negligence), or otherwise — shall not exceed the total fees paid by the client to Yamasuki under the relevant Engagement Letter in the 12 months preceding the event giving rise to the claim.
7.2 — Exclusions
Yamasuki is not liable for: regulatory fines or penalties imposed on the client, regardless of whether Yamasuki was engaged to assist with the relevant compliance area; loss of revenue, contracts, or enterprise client relationships; indirect, consequential, or special damages of any kind; or decisions made by the client on the basis of Yamasuki's advisory outputs that were materially inconsistent with those outputs.
7.3 — Client Responsibility for Implementation
Yamasuki provides advisory and consultancy services. Implementation of any recommendations, remediation steps, or governance frameworks is the responsibility of the client unless Yamasuki has explicitly been contracted to perform implementation as part of the scope. Advisory outputs constitute professional recommendations — they do not constitute a guarantee of regulatory compliance or audit success.
What this means in practice
A Yamasuki gap analysis or maturity assessment reflects an objective assessment of your compliance posture at a point in time, based on the documentation and access provided. Acting on that assessment promptly and thoroughly is the client's responsibility. Yamasuki's liability for the quality of the advisory output is capped at the fees paid — not the potential regulatory exposure the client faces.
Payment Terms
| Engagement Type | Invoice Schedule | Due Date | Work Commences |
|---|---|---|---|
| Fixed-fee project (under €10,000) | 100% on commencement | 14 days from invoice | After payment cleared |
| Fixed-fee project (€10,000+) | 50% on commencement · 50% on final delivery | 14 days from each invoice | After 50% deposit cleared |
| Monthly retainer | Monthly in advance + setup fee (1× month rate) on first invoice | Monthly on invoice date | After first invoice cleared |
| Annual digital licence | 100% on purchase | Immediate | Delivery within 2 working days |
| Board / executive workshop | 100% minimum 5 working days before session | 5 days before session date | On date agreed at booking |
8.1 — Late Payment
Invoices not paid by the due date are subject to statutory interest under the European Communities (Late Payment in Commercial Transactions) Regulations 2012 at the applicable reference rate plus 8 percentage points. Yamasuki reserves the right to pause all work on the engagement until outstanding invoices are settled. Advisory output, including final reports, will not be released until all fees are paid in full.
8.2 — Currency & Tax
All fees are quoted and invoiced in EUR. Irish VAT at the standard rate (currently 23%) is applied to all invoices issued to Irish-domiciled clients. EU business clients outside Ireland may provide their VAT registration number for zero-rating. Clients outside the EU receive invoices VAT-exempt. VAT treatment is the client's responsibility to confirm with their own tax advisers for their specific jurisdiction.
Termination
9.1 — Termination by the Client
A client may terminate a project engagement at any time by written notice to Yamasuki. Upon termination, the client is liable for all fees in respect of work completed up to the date of termination. If a 50% deposit has been paid and the engagement is terminated before completion of the first phase, the deposit is non-refundable. If a deposit has not been paid, the client is invoiced for the proportion of work completed at the agreed day rate equivalent of the fixed fee.
9.2 — Termination of Retainers
Monthly retainer agreements may be terminated by the client with 30 days written notice after the minimum 3-month term has elapsed. Notice given during the minimum term does not take effect until the end of that term. Fees for the notice period are due in full. The client retains all deliverables and reports produced during the retainer period.
9.3 — Termination by Yamasuki
Yamasuki may terminate an engagement with immediate effect if: the client fails to pay an invoice within 30 days of its due date; the client requests work that would require Yamasuki to act unlawfully or in breach of professional standards; or the client materially misrepresents their organisation or circumstances in the discovery or scoping process. In the event of Yamasuki-initiated termination other than for client breach, fees paid in advance for work not yet performed will be refunded on a pro-rata basis.
Governing Law & Disputes
These Terms of Engagement, the Engagement Letter, and any Statement of Work are governed by and construed in accordance with the laws of the Republic of Ireland. The parties submit to the exclusive jurisdiction of the Irish courts for the resolution of any dispute arising under or in connection with any engagement.
In the event of a dispute, both parties agree to first attempt resolution through direct negotiation between senior representatives of each party for a period of 30 days before initiating formal legal proceedings. Yamasuki may also propose mediation under the Mediators' Institute Ireland Code of Practice as an alternative to litigation.
Retainer-Specific Terms
11.1 — Minimum Term & Renewal
All monthly retainers have a minimum term of 3 months. After the minimum term, the retainer continues on a rolling monthly basis until terminated by either party in accordance with Section 9. Yamasuki will issue a retainer review summary every quarter — if the engagement intensity no longer justifies the current tier, Yamasuki will proactively recommend a downgrade.
11.2 — Scope of Monthly Service
The monthly hours, included services, and deliverables for each retainer tier are defined in the relevant Engagement Letter and on the Yamasuki pricing page. Unused hours within a given month do not carry forward to subsequent months. Consistent under-utilisation of a retainer tier is addressed at the quarterly review.
11.3 — Pausing a Retainer
After the minimum term, a client may pause a retainer for up to 60 consecutive days once per 12-month period with 30 days written notice. During a pause, no advisory work is delivered and no invoices are issued. The retainer resumes automatically on the agreed restart date at the same tier and fee.
Data Processing & Privacy
12.1 — Data Minimisation
Yamasuki accesses only the data, systems, and documentation strictly necessary for the delivery of the engagement scope. Client data is not retained beyond the engagement period except where required by Irish law or with the explicit written consent of the client.
12.2 — GDPR Compliance
Where an engagement requires Yamasuki to process personal data on behalf of the client (as a data processor under GDPR), Yamasuki and the client will enter into a Data Processing Agreement (DPA) prior to commencement. The DPA sets out the subject matter, duration, nature and purpose of processing, type of personal data, and the obligations and rights of both parties. Yamasuki's standard DPA is available on request.
12.3 — Sub-processors
Yamasuki uses a limited number of technology sub-processors in the delivery of services (e.g. secure document sharing, video conferencing). A list of current sub-processors is available on request. Clients will be notified of any material changes to sub-processors with reasonable advance notice.
Note on this document
These Terms of Engagement set out Yamasuki's standard commercial terms. They are incorporated by reference into every Engagement Letter. Where an individual Engagement Letter contains terms that differ from these standard terms, the Engagement Letter prevails. These terms were last updated in January 2025 and apply to all engagements commenced on or after that date. For any queries about these terms, contact contact@yamasuki.ie.