# ORCAA (O'Neil Risk Consulting and Algorithmic Auditing, Inc.) - **Type:** Advisory firm - **Website:** https://orcaarisk.com/ - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A US firm that audits hiring and insurance algorithms for bias and advises on AI governance, with named work for HireVue, Uber and the Colorado Division of Insurance. ## ORCAA scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 3/5 Real regulator-facing history (NYC LL144, CO SB21-169 with the state insurance division) but no evidence of defending a client through an enforcement action or litigation. ### Qualifications of the people who do the work: 3/5 Founder holds a Harvard math PhD and named staff hold law/policy degrees and PhDs, but no formal audit-body membership or privacy-certification credential is disclosed for the firm. ### What it publishes about fees: 2/5 ORCAA publishes no fee schedule or pricing tiers on its own site; engagement cost is undisclosed and scoped per project only. ### Knowledge of your sector: 2/5 Deep, verified track record in hiring and insurance bias audits, but no found evidence of NIST AI RMF, ISO 42001, or Colorado AI Act SB24-205 work. ### Independence from what it sells: 4/5 Independent auditor selling no compliance software license or certificates; own site states its output is audit reports, not certifications. ### Who carries the risk if the advice is wrong: 2/5 No disclosed professional-indemnity or E&O insurance; the HireVue audit's limited scope drew public criticism the firm did not visibly rebut. ## Sources for ORCAA Every line carries the page it was read on and the date it was checked. - ORCAA's legal entity is registered with the New York Department of State as a domestic business corporation, DOS ID 4958764, initial filing 2016-06-07, and appears in the Department's live "Active Corporations" dataset (which by its own description contains only currently-active filings), confirming active status. - Source: https://data.ny.gov/resource/n9v6-gdp6.json?dos_id=4958764 - Checked: 2026-09-20 - The Colorado Division of Insurance announced it had partnered with ORCAA to help implement SB21-169's algorithm-testing regime for insurers. - Source: https://doi.colorado.gov/news-releases-consumer-advisories/division-of-insurance-partners-with-orcaa-to-protect-colorado - Checked: 2026-09-20 - HireVue published the results of an ORCAA algorithmic bias audit of one of its hiring assessment tools. - Source: https://orcaarisk.com/in-the-news/2021/1/12/orcaas-audit-of-hirevue-is-live - Checked: 2026-09-20 - Uber published ORCAA's report on Uber's AI governance systems and processes. - Source: https://orcaarisk.com/in-the-news/2024/12/4/uber-publishes-orcaas-report-on-its-ai-governance - Checked: 2026-09-20 - ORCAA's founder and CEO, Cathy O'Neil, holds a PhD in mathematics from Harvard and previously worked as a professor at Barnard College and as a quant at hedge fund D.E. Shaw. - Source: https://cathyoneil.org/ - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Not published - Client results: Published - How it uses AI: Not published ## Strengths - Long, verifiable track record in algorithmic bias auditing since 2016, including high-profile named engagements (HireVue 2021, Uber 2024) and a state-government partnership (Colorado Division of Insurance, 2022). - Named, credentialled leadership bench beyond the founder: in-house counsel (Tom Adams, Fordham Law), a strategist with degrees from Columbia and Princeton (Jacob Appel), and academic affiliates holding PhDs (Harvard, UC Berkeley) disclosed on ORCAA's own site. - Structurally independent: the firm sells audit and advisory engagements only, states its outputs are reports and recommendations rather than certificates, and does not market a licensed compliance-software product. - Confirmed, currently-active New York corporate registration matching a verifiable public record, ruling out shell-company concerns. ## Things to check Each one carries the factual basis it rests on. - No evidence found of ORCAA delivering NIST AI RMF, ISO 42001 readiness, or Colorado AI Act (SB24-205) high-risk-system impact-assessment engagements; its published track record is bias audits under NYC Local Law 144 and Colorado's insurer-focused SB21-169. - Basis: orcaarisk.com's service pages and news history, plus third-party listings, show only NYC LL144/CO SB21-169 work; SB24-205 and ISO 42001 do not appear anywhere. - No fee schedule, rate card, or price range is published anywhere on ORCAA's own site; a third-party directory lists its pricing as undisclosed. - Basis: orcaarisk.com's service pages describe scope and method but list no prices; ComplyIndex marks pricing fields "Undisclosed". - The firm's highest-profile early audit, the 2021 HireVue review, was publicly characterized by independent outlets as narrow in scope and used by the client as a PR exercise. - Basis: Press coverage in Fast Company and MIT Technology Review described the audit's limited scope and HireVue's promotional use of it. ## Where this firm appears - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.