From: Ishan Jadhwani, Chief Executive Officer, Neuroscale LLC · Date: 2026-05-16 · Re: Formal deferral of Audit Committee constitution; compensating-control disclosure for CC1.2 · Re-evaluation: Annually at the Q1 ISMS Management Review
Decision
Neuroscale LLC is member-managed and has not constituted a board of directors or an audit committee. By decision of its sole member and Chief Executive Officer, Ishan Jadhwani, Neuroscale formally defers constituting a board and audit committee for the period covering the initial Type II observation window (June 22 – September 22, 2026) and the first subsequent Type II observation window (September 22, 2026 – September 22, 2027), and adopts the compensating controls below in their place. This decision is taken with the awareness that SOC 2 Trust Service Criterion CC1.2 (“The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control”) would, in a more mature governance structure, be evidenced by an independent Audit Committee. The compensating controls below are management’s documented response, and are the controls tested against CC1.2 during the initial and first-subsequent Type II observation windows. This memo is the artifact referenced by:- Whistleblower Policy — the conflicted-report escalation path (reports concerning the CEO/CTO/CISO route to VGC LLP).
- Anti-Bribery & Anti-Corruption Policy — executive-misconduct reporting path.
- ISMS Management Review procedure — the independent-reviewer participation slot filled by VGC LLP.
- SOC 2 Readiness Timeline — board / audit-committee deferral decision.
- Controls Inventory — CC1.2 control row pointing at this memo.
- Executive Management Ethical Survey 2026 — the no-board document evidence for the board-charter, board-CV, and board-meeting Vanta slots.
Why deferral is appropriate at current scale
- Company stage. Neuroscale is an early-stage, member-managed LLC with a sole member and a small executive team. Constituting a formal board and audit committee with independent directors at the current scale would impose governance overhead disproportionate to the risk surface and would likely under-resource the time of any independent director recruited to fill the seat.
- Compensating-control depth. As documented below, Neuroscale has retained credentialed external counsel (VGC LLP) whose engagement explicitly includes quarterly review of the risk register and the ISMS Management Review minutes. VGC’s review is independent of management and of any operational role inside Neuroscale.
- Re-evaluation commitment. This deferral is reviewed annually and the decision to constitute a board and audit committee will be revisited when (a) Neuroscale closes a financing round or otherwise establishes a board, (b) any customer or regulatory commitment triggers a requirement for a formal board or audit committee, or (c) the next material change in scope of the SOC 2 report adds Trust Service Criteria where independent committee oversight is material.
Compensating controls
The following compensating controls are the operative CC1.2 mechanism for the period covered by this memo. Each is documented in the Controls Inventory and tested with the cadence and evidence indicated.| # | Compensating control | Cadence | Independent reviewer | Evidence |
|---|---|---|---|---|
| 1 | Outside-counsel review of the Risk Register. VGC LLP (Brandt Mori, primary) reviews the Risk Register at least quarterly for material changes, accepted-risk concentration, and treatment-plan progress. | Quarterly | VGC LLP (engagement letter on file, scope amended 2026-05-16 to include this review) | VGC review memo filed in the SOC 2 evidence library (Governance > Risk Register Reviews) |
| 2 | Outside-counsel review of ISMS Management Review minutes. VGC LLP reviews each ISMS Management Review minutes packet for material findings, escalations, and management response. | Quarterly (each ISMS-MR) | VGC LLP | VGC review memo attached to ISMS-MR minutes at /registers/management-review-minutes/<YYYY-Q?>.mdx |
| 3 | Outside-counsel review of breach determinations. VGC LLP reviews every Severity 1 / Severity 2 incident closure per the Incident Response Policy and signs the breach-or-not determination before customer notice. | Per incident | VGC LLP | Incident ticket; breach-determination memo |
| 4 | Whistleblower channel routes independently. The anonymous-reporting channel is independently hosted and segregated from corporate identity and the CTO/CISO administrative chain; reports route to the CEO, and any report concerning the CEO, CTO, or CISO routes to VGC LLP first for handling without internal notification. See Whistleblower Policy. | Continuous + per report | CEO; VGC LLP for conflicted reports | Channel audit log; VGC investigation file |
| 5 | Annual independent governance review. At an annual governance review, the CEO and VGC LLP review this memo, the prior 12 months of ISMS-MR minutes, the prior 12 months of VGC review memos, and the prior 12 months of risk-register changes. The decision to constitute formal governance bodies or continue to defer is recorded in the review minutes. | Annual | CEO; VGC LLP (independent) | Oversight-review minutes filed in management-review-minutes |
Re-evaluation triggers
This deferral is automatically revisited on any of:- Annual review at the Q1 ISMS Management Review.
- Closing of a financing round that leads Neuroscale to constitute a board.
- Customer contract or regulatory commitment that requires a formal board or audit committee.
- Material expansion of the SOC 2 scope (e.g., adding Processing Integrity, or adding US-government scope above the current commercial-cloud posture).
- Any Severity 1 incident where the post-mortem identifies independent oversight as a contributing factor.
- Any whistleblower report alleging that compensating-control #4 above failed (i.e., a report about the CEO, CTO, or CISO that was routed internally instead of to VGC).
Sign-off
By signing this memo, the undersigned, in the capacity of sole Member and Chief Executive Officer of Neuroscale LLC, ratifies the deferral of constituting a board and audit committee and accepts personal accountability for the operation of the compensating controls described above for the period stated.| Role | Name | Status | Date |
|---|---|---|---|
| Chief Executive Officer and sole Member | Ishan Jadhwani | Approved; executed signature retained in the SOC 2 evidence library | 2026-05-17 |
Concurrence — Outside Counsel
VGC LLP, as outside General Counsel, concurs that the compensating controls described above are appropriate at Neuroscale’s current scale and commits to performing the review activities assigned to VGC in the table above.| Firm | Signatory | Status | Date |
|---|---|---|---|
| VGC LLP | Brandt Mori (engagement principal) | Concurrence pending | — |
Version history
| Version | Date | Description | Author | Approved by |
|---|---|---|---|---|
| 1.0 | 2026-05-16 | Initial deferral memo for the initial Type II observation window and the first subsequent Type II observation window. | Cameron Wolfe | Ishan Jadhwani, CEO; VGC LLP (concurrence pending) |
| 1.1 | 2026-06-12 | Observation-window dates updated to June 22 – September 22, 2026 (initial) and September 22, 2026 – September 22, 2027 (first subsequent) per the 2026-06-12 schedule shift. | Cameron Wolfe | Ishan Jadhwani, CEO |
| 1.2 | 2026-06-16 | Reframed to reflect that Neuroscale is member-managed with no board of directors (removing the “single-member Board” construct); compensating controls unchanged. Aligned with Advantage Partners’ no-board guidance and the new Executive Management Ethical Survey. | Cameron Wolfe | Ishan Jadhwani, CEO |