Hi,
tell him that security is not a binary thing. You can't just say that this system is secure and this system is not. It's all about risk management and it's a never ending process. Hence the question is who is going to manage those risks after security consultant is gone. Based on my experience there seems to be heaps of changes and rework just before go-live as everyone is trying to hit the go live date. Who is going to check that these changes do not have negative impact on security controls designed during blue print phase. There will be also changes after go live as business starts using the system and realize that some assumptions were bogus, some were wishful thinking.
Cheers