Services

How engagements run

Every practice engagement is assembled from these five services. The practice decides the obligation set; the service decides the mechanics. Time and materials, with checkpoints, and every stage produces an artifact you keep.

SVC_IR

Inspection Readiness

Preparing for third party technology inspections where an inspector validates evidence against defined criteria. The work centres on operational proof: confirming controls are implemented, records exist and are complete, and responsibilities and escalation paths are clear.

Deliverables
  • Inspection evidence pack
  • Validated control to evidence map
  • Remediation actions for identified gaps
Typical timeline2 to 4 weeks
Inputs we needControl framework, existing evidence, inspection scope
SVC_AR

Assessment Readiness

Internal or pre external evaluation of how well the organization aligns with management system requirements: control maturity, policy and procedure structure, role clarity, and management system architecture.

Deliverables
  • Gap assessment report
  • Prioritized remediation roadmap
  • Draft management system with supporting documentation
Typical timeline3 to 6 weeks
Inputs we needCurrent policies, risk register, org chart
SVC_IA

Internal Audit Support

Building and running the internal audit program certification bodies expect before Stage 2. They look for evidence of a functioning program at Stage 1; without it, you are not ready.

Deliverables
  • Audit program design: scope, criteria, frequency
  • Auditor competency development
  • Annual audit plans and resource allocation
  • Findings management and corrective action tracking
  • Management review input for leadership reporting
Typical timeline4 to 8 weeks
Inputs we needManagement system scope, prior audit results, personnel list
SVC_CR

Certification Readiness

Structured preparation for independent certification audits. Stage 1 focuses on documentation completeness; Stage 2 on operational effectiveness and evidence the system works in practice.

Deliverables
  • Stage 1 documentation pack
  • Stage 2 evidence set
  • Audit interview preparation and readiness simulations
  • Certification body selection support, ISO/IEC 17021-1 aware
Typical timeline6 to 12 weeks
Inputs we needGap assessment, internal audit evidence, management review
SVC_GR

Governance & Risk

Establishing who is accountable for technology decisions, how risk is identified and managed, and how oversight is performed at leadership level. Connects operational controls to leadership accountability and regulatory expectations.

Deliverables
  • Governance operating model
  • Risk framework and tolerance definition
  • Committee terms of reference
  • Role accountability matrix
  • Executive dashboards for ongoing oversight
Typical timeline4 to 8 weeks
Inputs we needOrg structure, risk appetite, regulatory obligations

Start from your situation, not a service list.

The finder routes you to the obligation, the clock, and the first step; the right services follow from there.

Find what applies to youRequest a discovery call