Oakwolf Group

How to Use This Script

This is a reference check, not a sales call — but Oakwolf conducts reference checks at a depth no other firm does, and that depth is itself a differentiator. The reference should hang up thinking two things: (1) the consultant I'm vouching for is in good hands, and (2) whoever just called me actually understands Epic Security better than the firms currently calling on me.

Lead with the consultant

Spend the first half genuinely on them. Short-changing the reference check loses all credibility for everything else.

Ask in reverse

Our QUESST asks the consultant what they did. You're asking the reference what they saw the consultant do. Same domains, different vantage point.

Drop pain grenades

A grenade is a diagnostic question phrased as reference validation. It tells you about their environment as much as about the consultant — without you asking directly.

Pattern-match, don't pitch

When the reference describes a problem, name the pattern — don't name a solution. "That's one of the most common post-go-live patterns we see" earns a follow-up. "We have a service for that" does not.

Earn the second conversation

The goal of this call is not to sell anything. The goal is for the reference to end the call wanting another one.

SECTION 1

Opening & Framing

SET THE TONE — YOU'RE A PEER, NOT A VENDOR

Thank & Qualify

"Thanks for taking the time. Before I ask about [Consultant Name], are you familiar with Oakwolf Group at all?"

Who Oakwolf Is

"We're a specialized healthcare IT consulting firm — we support health systems with net-new implementations, assessments and benchmarks, major optimizations, and post-live support."

The Epic Security Practice

"I lead our Epic Security Practice where we typically support clients around: template and RBAC sprawl, moving from manual to automated provisioning, external access debt and slow termination velocity, and audit programs that look clean on paper but fail under real scrutiny."

Why We're on This Call

"We vet deeply on both ends — a structured assessment with the consultant, and a reference conversation with someone like you to verify. I'll start with questions about [Consultant] and then some organizational questions for context. Sound good?"

Confirming Relationship & Context

How long did you work with [Consultant] and in what capacity — direct oversight, project partner, cross-functional?

How long has your organization been live on Epic?

What was the scope of the engagement — implementation, refuel, optimization, ongoing support?

How many sites and users are a part of the health system?

What was the state of your Epic environment when they came in — and what specific problem were they brought in to solve?

SECTION 2

Technical Validation — Select a Domain

SECTION 3

Functional & Workflow Capability

CLINICAL BRIDGE — DOER OR DRIVER?

Did [Consultant] show up in workflow discovery and requirements conversations, or were they more of a back-of-house builder?

How well did they translate between clinical or operational stakeholders and the security/IAM team?

Were they effective at pushing back on "our workflow is unique" claims and driving toward standardization?

Did they participate in governance or design committee meetings? What was their presence like in those rooms?

If you went through a go-live with them — what did security readiness look like the week before? Did they catch things that would have hurt you at cutover?

SECTION 4

Consultative Capability

ADVISORY MINDSET — DOER OR DRIVER?

Did [Consultant] identify security gaps or inefficiencies your team wasn't already aware of? Can you give me an example?

Did their work change how your team operated long-term, or was it more of a point-in-time fix?

How did they handle leadership-level conversations — with your CISO, VP, or operational leaders?

Did they ever have to push back on a senior stakeholder to protect security integrity? How did that land?

How did they balance speed with compliance and governance when there was pressure to move fast?

SECTION 5

Mentorship, Documentation & Knowledge Transfer

CRITICAL AT MANAGER / DIRECTOR LEVEL

Did [Consultant] mentor or upskill members of your internal team?

After they rolled off, was your team able to maintain the work — or did some of it degrade once they were gone?

How would you rate their documentation? Would a new analyst be able to pick it up cold and maintain it?

What did they leave behind that you still reference today?

SECTION 6

Quantifiable Impact

PUSH FOR NUMBERS — SAME AS WE PUSH THE CONSULTANT

Can you attach specific, measurable impact to [Consultant]'s work — template reduction, automation rate improvement, EMP/SER cleanup, termination velocity, UAR cycle time, ticket volume, external account cleanup?

If you were presenting the ROI of that engagement to your CFO or CIO, how would you frame it — risk reduction, FTE savings, compliance posture, audit readiness?

Looking at where you are today vs. where you were when [Consultant] started — where's the work that still needs to be done?

⚡ THE PIVOT QUESTION

The last question above is the most important in this entire script. It invites the reference to describe current-state pain without feeling sold to — because you asked in the context of the consultant's engagement. Whatever they say here is your qualification for a future conversation. Listen, take notes, don't pitch. Name the pattern, offer one thought, and ask if it would be useful to compare notes in a follow-up.

SECTION 7

Environment & Market Intelligence

PEER-TO-PEER — BY THIS POINT YOU'VE EARNED IT

Big picture — what are the two or three biggest Epic Security problems on your plate right now?

Where do you think the most urgent security spend at your system is going in the next 12 months — IAM, RBAC rationalization, external access, authentication, audit program, something else?

Any recent or upcoming M&A activity that's going to land on the security team?

Any upcoming Epic upgrades, refuels, or reimplementations on the roadmap?

What audits or inspections are you preparing for in the next 6–12 months?

How's your internal Epic Security team sized today — and where are the gaps you're backfilling with consultants?

SECTION 8

Close & Next Steps

WRAP THE REFERENCE — PLANT THE SEED ONLY IF EARNED

Reference Check Close

"This has been incredibly helpful — I have a clear picture of [Consultant]'s work with you. Before I let you go, anything else I should know? Anything you'd want a future client of theirs to hear?"

The Soft Pivot — Only If Earned

"One last thing — you mentioned [specific pain]. That's a pattern we see constantly across health systems. If it'd be useful, I'd be happy to set up 30 minutes with one of our security principals to walk through how other systems your size have worked through it."

The Referral Ask

"Before we wrap — [Consultant] is one you'd work with again?"

OAKWOLF GROUP