At what point though is this just consulting? Since everyones risk tolerances are different and may or may not have good network architectures or software pract

At what point though is this just consulting? Since everyones risk tolerances are different and may or may not have good network architectures or software practices how would this apply generally to other companies or networks?