GRC services that get you certified and keep you audit-ready.
Our consultants assess, test and strengthen your controls across security, IT and business processes, with evidence that stands up to auditors.
What we offer
Our GRC services
Fifteen services across security, quality, privacy, continuity and financial controls, delivered by practitioners.
ISO 27001 implementation
Gap assessment, risk assessment, Statement of Applicability and ISMS build-out through to certification readiness.
ISO/IEC 27001:2022
ISO internal audit services
Independent internal audits that prepare you for certification and surveillance audits, with clear findings and corrective action plans.
ISO 27001 · ISO 9001 · ISO 22301 · ISO 27701
ISO 9001 quality management
Quality management system design, process documentation, internal audits and certification support.
ISO 9001:2015
NIST framework assessments
Current and target profile assessments, control gap analysis and a prioritised roadmap against NIST.
NIST CSF 2.0 · NIST SP 800-53
IT general controls testing
Design and operating effectiveness testing of access, change management, operations and backup controls.
SOX ITGC · COBIT 2019
Business controls testing
Testing of process and application controls across order-to-cash, procure-to-pay, record-to-report and payroll.
SOX · ICFR · IFC
SOC 1 reporting services
Readiness, control descriptions, bridge letters and support for service organisations working with their auditor.
SOC 1 · SSAE 18 · ISAE 3402
SOC 2 readiness
Trust Services Criteria mapping, control design, evidence collection and auditor liaison for Type I and Type II reports.
SOC 2 · AICPA TSC
DPDPA and privacy compliance
Personal data mapping, consent and notice review, data principal rights processes and breach response readiness.
DPDP Act 2023 · GDPR · ISO 27701
Third-party risk management
Vendor inventory, risk tiering, due diligence questionnaires, evidence review and ongoing monitoring.
TPRM · Outsourcing guidelines
Business continuity management
Business impact analysis, continuity and disaster recovery plans, and exercises that prove they work.
ISO 22301
PCI DSS compliance
Scoping, gap assessment and remediation support for organisations that store, process or transmit card data.
PCI DSS v4.0
AI governance
Policies, risk assessments and controls for responsible AI, aligned with emerging AI management standards.
ISO/IEC 42001 · NIST AI RMF
IT policies development
A complete, practical library of IT and security policies, standards and procedures your teams can follow.
ISO 27002 · NIST CSF 2.0
Risk assessments
Enterprise, IT and cyber risk assessments with a living risk register and clear treatment plans.
ISO 31000 · NIST SP 800-30
Frameworks
Standards and regulations we cover
We map controls once and reuse the evidence across frameworks, so your teams answer each question only once.
Our approach
How a GRC engagement runs
Scope
Agree systems, frameworks, owners and deadlines.
Assess
Walk through processes, test controls and document gaps with evidence references.
Remediate
Design fixes, write procedures and coach control owners until tests pass.
Report and sustain
Deliver clear reports and a compliance calendar to keep evidence current.
What you get
Clear outcomes, not just reports
- A prioritised gap report with owners and target dates
- Control descriptions and a risk and control matrix
- Tested workpapers with evidence references
- Policies and procedures written for your organisation
- Readiness for your certification or external audit
- Optional use of the GRC Lab platform during the engagement
Preparing for an audit or certification?
Share your timeline and scope, and we'll propose a plan within two business days.