Governance & assurance
Decision rights, operating models, controls and reporting that stand up to scrutiny.
Learn more →Our approach
Engagements are designed around outcomes and decision points, proportionate to organisational context, regulatory exposure and risk posture. We focus on clarity, evidence and sustainability rather than “one-size-fits-all” templates.
Service areas
Common engagement types are grouped into four complementary areas.
ISO/IEC 27001 readiness
Scope, gap analysis, SoA and internal audit support, structured and evidence-aware.
Learn more →Operational resilience
Practical alignment for resilience and regulatory expectations (e.g., DORA / NIS2).
Learn more →PCI-DSS advisory and support
Scoping, gap analysis, risk-based advisory and PCI-DSS security requirements.
Learn more →AI governance & assurance
Scope, gap analysis, ISO/IEC 42001 AI management systems readiness.
Learn more →GDPR and Privacy
Supporting practical GDPR compliance and privacy‑by‑design implementation.
Learn more →Advisory and delivery services
Examples below are typical. We shape each engagement to fit your environment.
Governance & assurance
- Governance operating model: roles, decision forums, escalation paths
- Assurance design: what needs to be evidenced, how, and for whom
- Control rationalisation: reduce noise, improve effectiveness
- Executive reporting: metrics, narratives, actions and ownership
ISO/IEC 27001 readiness & internal audit support
- Scope definition and boundary setting
- Gap analysis and prioritised roadmap
- Statement of Applicability (SoA) and evidence mapping
- Internal audit planning and readiness support
- Certification readiness and improvement planning
Regulatory alignment & operational resilience (DORA / NIS2 / GDPR)
- Baseline and gap assessments
- Evidence alignment and reporting expectations
- Dependency and third-party considerations
- Remediation planning with ownership and sequencing
Risk assessments & audit readiness
- Current-state posture reviews (controls, evidence, governance)
- Plain-language risk narratives for executive audiences
- Remediation planning and realistic sequencing
- Audit walkthrough preparation and evidence readiness
Policies, standards & procedures
- Policy hierarchy and documentation structure
- Core policies and standards aligned to good practice
- Operational procedures aligned to delivery reality
- Ownership and review cycles that keep documentation defensible
AI governance & assurance
- Alignment to ISO/IEC 42001 and emerging regulatory expectations
- Evidence, documentation and reporting to support assurance and scrutiny
- AI risk assessment across use cases, data, models and human involvement
- AI governance operating model: accountability, oversight and decision rights
PCI DSS advisory & support
- Scope definition and cardholder data flow mapping
- Gap assessment against applicable PCI DSS requirements
- Third-party and service provider dependency considerations
- Remediation planning with clear ownership and sequencing
Awareness & human risk
- Awareness strategy aligned to organisational risk
- Targeted sessions for leaders and teams
- Reinforcement approach (campaigns, role-based learning)
- Measurement and improvement over time (not “tick-box”)