We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

ORCAA (O'Neil Risk Consulting and Algorithmic Auditing, Inc.) review

Advisory firm

A US firm that audits hiring and insurance algorithms for bias and advises on AI governance, with named work for HireVue, Uber and the Colorado Division of Insurance.

Relevant if you need a bias audit under New York City's Local Law 144 or Colorado's SB21-169

Price Not published
Indemnity cover Not published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

ORCAA scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 3/5
Qualifications of the people who do the work 3/5
What it publishes about fees 2/5
Knowledge of your sector 2/5
Independence from what it sells 4/5
Who carries the risk if the advice is wrong 2/5

What ORCAA offers, and what it publishes

ORCAA audits algorithms for bias and advises on AI governance. HireVue published the results of ORCAA's bias audit of one of its hiring tools on 12 January 2021. Uber published ORCAA's report on its AI governance on 4 December 2024. In April 2022 Colorado's Division of Insurance announced a partnership with ORCAA on its algorithm-testing rules for insurers.

ORCAA does not publish a price. Its service pages describe scope and method but show no fees. A third-party directory lists its pricing as undisclosed. It does not publish professional indemnity cover or engagement terms. It does not say whether it uses AI tools itself.

Founder and chief executive Cathy O'Neil holds a PhD in mathematics from Harvard. ORCAA does not sell compliance software. We found no work on ISO 42001, the US NIST AI RMF or Colorado's AI Act. Fast Company and MIT Technology Review described the 2021 HireVue audit as narrow in scope, and noted HireVue's promotional use of it.

Strengths

  • Long, verifiable track record in algorithmic bias auditing since 2016, including high-profile named engagements (HireVue 2021, Uber 2024) and a state-government partnership (Colorado Division of Insurance, 2022).
  • Named, credentialled leadership bench beyond the founder: in-house counsel (Tom Adams, Fordham Law), a strategist with degrees from Columbia and Princeton (Jacob Appel), and academic affiliates holding PhDs (Harvard, UC Berkeley) disclosed on ORCAA's own site.
  • Structurally independent: the firm sells audit and advisory engagements only, states its outputs are reports and recommendations rather than certificates, and does not market a licensed compliance-software product.
  • Confirmed, currently-active New York corporate registration matching a verifiable public record, ruling out shell-company concerns.

Things to check

  • No evidence found of ORCAA delivering NIST AI RMF, ISO 42001 readiness, or Colorado AI Act (SB24-205) high-risk-system impact-assessment engagements; its published track record is bias audits under NYC Local Law 144 and Colorado's insurer-focused SB21-169.
  • No fee schedule, rate card, or price range is published anywhere on ORCAA's own site; a third-party directory lists its pricing as undisclosed.
  • The firm's highest-profile early audit, the 2021 HireVue review, was publicly characterized by independent outlets as narrow in scope and used by the client as a PR exercise.

Common questions

What regulator-facing work has ORCAA done?

It partnered with the Colorado Division of Insurance on the state's algorithm-testing rules for insurers under SB21-169, announced in April 2022. Its published bias audit work also covers New York City's Local Law 144.

Does ORCAA publish its fees?

No. Its service pages describe scope and method but list no fees, rate card or price range, and a third-party directory marks its pricing as undisclosed.

Does ORCAA work on ISO 42001 or Colorado's AI Act?

Not that we found. Its published record covers bias audits under New York City's Local Law 144 and Colorado's SB21-169, not ISO 42001, the US NIST AI RMF or Colorado's AI Act, SB24-205.

Does ORCAA issue certificates?

No. Its site describes its output as audit reports and recommendations, not certificates, and it does not sell compliance software.

Evidence for each ORCAA score

Show our working

Notes behind each thing to check

  • No evidence found of ORCAA delivering NIST AI RMF, ISO 42001 readiness, or Colorado AI Act (SB24-205) high-risk-system impact-assessment engagements; its published track record is bias audits under NYC Local Law 144 and Colorado's insurer-focused SB21-169. (orcaarisk.com's service pages and news history, plus third-party listings, show only NYC LL144/CO SB21-169 work; SB24-205 and ISO 42001 do not appear anywhere.)
  • No fee schedule, rate card, or price range is published anywhere on ORCAA's own site; a third-party directory lists its pricing as undisclosed. (orcaarisk.com's service pages describe scope and method but list no prices; ComplyIndex marks pricing fields "Undisclosed".)
  • The firm's highest-profile early audit, the 2021 HireVue review, was publicly characterized by independent outlets as narrow in scope and used by the client as a PR exercise. (Press coverage in Fast Company and MIT Technology Review described the audit's limited scope and HireVue's promotional use of it.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 3/5 Real regulator-facing history (NYC LL144, CO SB21-169 with the state insurance division) but no evidence of defending a client through an enforcement action or litigation.
Qualifications of the people who do the work 3/5 Founder holds a Harvard math PhD and named staff hold law/policy degrees and PhDs, but no formal audit-body membership or privacy-certification credential is disclosed for the firm.
What it publishes about fees 2/5 ORCAA publishes no fee schedule or pricing tiers on its own site; engagement cost is undisclosed and scoped per project only.
Knowledge of your sector 2/5 Deep, verified track record in hiring and insurance bias audits, but no found evidence of NIST AI RMF, ISO 42001, or Colorado AI Act SB24-205 work.
Independence from what it sells 4/5 Independent auditor selling no compliance software license or certificates; own site states its output is audit reports, not certifications.
Who carries the risk if the advice is wrong 2/5 No disclosed professional-indemnity or E&O insurance; the HireVue audit's limited scope drew public criticism the firm did not visibly rebut.

Sources for ORCAA

  • ORCAA's legal entity is registered with the New York Department of State as a domestic business corporation, DOS ID 4958764, initial filing 2016-06-07, and appears in the Department's live "Active Corporations" dataset (which by its own description contains only currently-active filings), confirming active status. (DOS ID 4958764, filed 2016-06-07, status: active) (data.ny.gov, checked 20 September 2026)
  • The Colorado Division of Insurance announced it had partnered with ORCAA to help implement SB21-169's algorithm-testing regime for insurers. (Colorado DOI and ORCAA partnership, announced April 2022) (doi.colorado.gov, checked 20 September 2026)
  • HireVue published the results of an ORCAA algorithmic bias audit of one of its hiring assessment tools. (HireVue audit results published 12 January 2021) (orcaarisk.com, checked 20 September 2026)
  • Uber published ORCAA's report on Uber's AI governance systems and processes. (Uber and ORCAA AI governance report published 4 December 2024) (orcaarisk.com, checked 20 September 2026)
  • ORCAA's founder and CEO, Cathy O'Neil, holds a PhD in mathematics from Harvard and previously worked as a professor at Barnard College and as a quant at hedge fund D.E. Shaw. (PhD Mathematics, Harvard University) (cathyoneil.org, checked 20 September 2026)

Regulated sectors

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.