Do we need compliance software?

Not always. For smaller scopes, well-structured documents work. Tooling helps when evidence volume or frameworks multiply.

Will this slow our teams down?

It shouldn’t. We design controls proportionate to risk and build them into existing workflows rather than adding parallel processes.

Can you act as our auditor?

No. We prepare you for audit and support you through it, but certification is performed by an independent accredited body.

What happens after certification?

Controls need to keep operating. We can run internal audits, surveillance prep and ongoing reporting, or hand over to your team.

Controls that satisfy auditors without slowing the business.

Policies, risk management, security controls and audit readiness designed around how your organisation really works, with evidence collected as you go.

01 / What we build

Five capabilities, one control framework.

Most engagements combine several of these. Every policy, control and risk register is written to be used, not filed away.

01Clear rules, clear owners

Governance & policy

Policies, roles and decision rights that are short enough to read and specific enough to follow.

Typical work

Policy framework & library
Roles & accountability (RACI)
Board & committee reporting
Policy review cycles

You get an approved policy set with owners, review dates and plain-language summaries.

policies / library

PolicyStatusReview

Information securityOwner · CISOApprovedMar 27

Acceptable useOwner · HRApprovedJan 27

Data retentionOwner · DPOIn reviewNov 26

Supplier managementOwner · ProcurementOverdueSep 26

Incident responseOwner · ITApprovedFeb 27

02Know what could go wrong

Risk management

A living risk register with likelihood, impact and treatment, reviewed on a regular cadence.

Typical work

Risk assessment workshops
Risk register & appetite
Third-party & vendor risk
Business continuity planning

You get a prioritised risk register, treatment plans and a reporting rhythm for leadership.

risk / heat map

Likelihood Minor Moderate Major Severe LikelyR4R1 PossibleR7R2 · R5R3 UnlikelyR9R6 RareR8

Impact → · 9 open risks · reviewed monthly

03Standards and regulations

Compliance & certification

Gap analysis and implementation support for the standards your customers and regulators expect.

Typical work

ISO 27001 readiness
SOC 2 preparation
GDPR & data protection
Sector regulations

You get a gap assessment, remediation plan and support through to certification.

iso-27001 / readiness

ISO 27001 readiness72% complete

✓Scope & context definedClause 4

✓Risk assessment completeClause 6

✓Statement of ApplicabilityAnnex A

Access control reviews8 of 12 systems

Supplier assessments14 of 22

Internal auditScheduled Dec

04Protect systems and data

Security controls

Technical and organisational controls that reduce real risk, from access management to incident response.

Typical work

Access & identity reviews
Security baselines
Incident response plans
Awareness training

You get documented, tested controls with owners and evidence of operation.

controls / coverage

System MFA Backup Logging Patching Microsoft 365✓✓✓✓ CRM✓✓Partial✓ Finance✓✓Gap✓ Laptops✓Partial✓✓ Legacy ERPGap✓PartialGap

05Evidence on demand

Audit readiness

Continuous evidence collection and internal audits so external audits hold no surprises.

Typical work

Internal audit programmes
Evidence collection
Control testing
Auditor liaison

You get an evidence library, internal audit reports and support during the external audit.

audit / evidence

Evidence collected86%+9 pts

Open findings4−3 this month

Days to audit38On track

Evidence items collectedPer week

02 / Is this for you

Sound familiar?

These are the situations that most often bring leadership teams to us. If two or more apply, a governance review is usually worth a conversation.

01
A customer is asking for certification

A key deal or tender needs ISO 27001, SOC 2 or a detailed security questionnaire.
02
Policies exist but aren’t followed

Documents were written once, filed away and no longer reflect how people work.
03
Risk lives in people’s heads

Leadership knows the big risks informally, but nothing is recorded, owned or reviewed.
04
Audits are a scramble

Every audit means weeks of chasing evidence across email, drives and spreadsheets.
05
Regulation is changing

New data protection, sector or AI rules apply and it isn’t clear what needs to change.
06
Vendors hold sensitive data

Suppliers and SaaS tools process your data with little oversight or assessment.

03 / How we deliver

Proportionate controls, proven with evidence.

We prioritise by risk, implement in stages and collect evidence continuously, so audit season is a review, not a scramble.

012–3 weeks

Assess

Interviews, document review and control testing against the frameworks that apply to you.

OutputGap analysis and risk-ranked findings.
021–2 weeks

Plan

A remediation roadmap with owners, effort and sequencing agreed with leadership.

OutputApproved roadmap and governance cadence.
03Monthly cycles

Implement

Policies, controls and processes put in place, starting with the highest risks.

OutputOperating controls with evidence.
04Ongoing

Assure

Internal audits, reporting and continuous improvement, through certification and beyond.

OutputAudit-ready evidence and regular reporting.

04 / Ways to work

Pick the model, not a compromise.

Every proposal states which model we recommend and why. You can switch between them as the work matures.

01

Gap assessment

A fixed-price assessment against a chosen standard or regulation.

Control-by-control review
Risk-ranked findings
Remediation roadmap

Best for organisations preparing for a first audit or tender.

02Most common

Certification programme

End-to-end support from gap analysis to a successful external audit.

Policies & controls built
Evidence & internal audit
Auditor support

Best for teams with a deadline for ISO 27001, SOC 2 or similar.

03

Fractional GRC lead

Ongoing part-time governance and compliance leadership for your organisation.

Risk & policy ownership
Board reporting
Vendor & audit management

Best for growing businesses without a dedicated compliance function.

05 / Technology

Recognised frameworks, applied pragmatically.

We map your controls to the standards that matter for your sector and customers, and use tooling only where it saves real effort.

Standards

ISO 27001SOC 2ISO 9001NIST CSFCyber Essentials

Regulation

GDPRHIPAAPCI DSSNIS2EU AI Act

GRC tooling

VantaDrataOneTrustServiceNow GRC

Security

Microsoft EntraDefenderCrowdStrikeKnowBe4

06 / Questions

Before you commit.

The questions buyers ask most about governance, risk and compliance engagements.

Most organisations reach audit readiness in three to six months, depending on their starting point and how quickly decisions are made.

All services

Start a project

Facing an audit, a tender or a new regulation?

Tell us what you need to demonstrate and by when. We’ll come back with a realistic plan and an honest view of the gaps.

Let's Talk Get a Quote

Controls that satisfy auditors without slowing the business.

Five capabilities, one control framework.

Governance & policy

Risk management

Compliance & certification

Security controls

Audit readiness

Sound familiar?

A customer is asking for certification

Policies exist but aren’t followed

Risk lives in people’s heads

Audits are a scramble

Regulation is changing

Vendors hold sensitive data

Proportionate controls, proven with evidence.

Assess

Plan

Implement

Assure

Pick the model, not a compromise.

Gap assessment

Certification programme

Fractional GRC lead

Recognised frameworks, applied pragmatically.

Before you commit.

01How long does ISO 27001 or SOC 2 take?

02Do we need compliance software?

03Will this slow our teams down?

04Can you act as our auditor?

05What happens after certification?

Often paired with

Facing an audit, a tender or a new regulation?