Governance, Risk & Compliance (GRC)
Governance frameworks, risk management and compliance programmes.
- Governance frameworks and operating models
- Roles, responsibilities and accountability
- Risk management frameworks, registers and risk appetite
Services
Governance, risk, compliance, cybersecurity, data protection and AI governance, delivered as advisory work sized to your organisation.
Our services
Each service page sets out what the work covers, how we approach it and who it suits.
ISO & Compliance Readiness
Preparation for ISO 27001, ISO/IEC 42001 and related standards.
- Gap assessment against the requirements of the standard
- Scoping of the management system
- Risk assessment and risk treatment
Data Protection & Privacy
UK GDPR and Data Protection Act 2018 obligations and privacy programmes.
- Data mapping and records of processing
- Lawful basis and privacy notice review
- Data protection impact assessments
AI Governance & Responsible AI
Governance over how AI is selected, implemented, used and monitored.
- Inventory of AI use and classification by risk
- AI governance policy and lines of accountability
- Responsible AI principles turned into working controls
Cybersecurity Governance & Vulnerability Management
Cybersecurity governance and vulnerability management programmes.
- Cybersecurity governance and policy framework
- Security risk assessment
- Design of the vulnerability management process
View this service: Cybersecurity Governance & Vulnerability Management
Technology Risk & IT Controls
Technology risk assessment and the IT controls that manage it.
- Technology risk assessment
- Design of IT general controls: access, change, operations and backup
- Control documentation and ownership
SOC 2 & Controls Readiness
Preparing your controls and evidence for a SOC 2 assessment.
- Scoping against the Trust Services Criteria
- Readiness assessment and gap analysis
- Control design and documentation
Audit, Assurance & Regulatory Readiness
Support with audits, assurance activity and regulatory readiness.
- Audit preparation and coordination
- Support for internal audit activity
- Assurance mapping across regulatory and framework requirements
Frameworks we advise on
The standards and regulations our advice is built around. We help you prepare for them, and we do not issue certificates.
- ISO/IEC 27001Information security management
- ISO/IEC 42001AI management systems
- UK GDPR and Data Protection Act 2018Data protection
- SOC 2Service organisation controls
- NIST AI RMFAI risk management
Advisory and readiness support only. Independent bodies carry out assessments and issue any certificate.
Our approach
A structured approach to governance, risk and compliance
Five steps, from understanding where you are to keeping controls effective as things change.
Step 1: Assess
Understand your organisation, obligations, systems and existing controls.
Step 2: Identify
Find the gaps and risks that matter, and rank them by their effect on you.
Step 3: Design
Design proportionate controls, policies and documentation to close those gaps.
Step 4: Implement
Support your team in putting the controls and processes into practice.
Step 5: Monitor & Improve
Review how controls perform, track change and keep improving over time.
Not sure which service you need?
Describe what you are trying to achieve and we will tell you where we can help.