Services

What we audit

Assurance, advisory and technical testing. Every engagement is scoped in writing, evidenced, and reported to whoever is accountable for acting on it.

Choosing the right engagement

If you are not sure which of these you need, describe the problem rather than the solution when you get in touch. The most common mistake we see is an organisation commissioning a penetration test when the actual question their board asked was about governance — two very different engagements, and only one of them answers it.

How our engagements run

The same six-stage shape across every assurance engagement, scaled to the scope.

Audit and assurance

Independent examination of whether controls exist, are well designed, and actually operate.

IT General Controls (ITGC)

Access, change, operations and development controls tested to ISACA ITAF and COBIT 2019.

Information Systems Audit

Full-scope IS audit covering governance, infrastructure, applications and third parties.

ISO 27001 Gap Assessment

Independent gap and internal audit against ISO/IEC 27001:2022 clauses and Annex A.

VAPT / Penetration Testing

Network, web, mobile, API and internal testing mapped to OWASP and PTES.

Virtual CISO (vCISO)

Fractional security leadership for organisations that need a CISO but not a full-time one.

IT Governance & COBIT

Governance design and capability assessment using COBIT 2019 and ITIL 4.

Advisory and technical testing

Where the need is to build or to test rather than to assure.

IT Policies & Procedures

Board-ready policy suites written against the frameworks your regulator actually cites.

IT Risk Register

Build or independently validate an IT risk register your audit committee can defend.

Secure Source Code Review

SAST-assisted manual review against OWASP ASVS and the CWE Top 25.

ERP Implementation Review

Pre and post go-live assurance for SAP, Oracle and Dynamics 365 programmes.

Business Continuity & DR

BCMS and disaster recovery audit against ISO 22301 with live invocation testing.

Cyber Security Training

Board briefings, audit committee sessions and practitioner training, onsite or remote.

Internal Audit Co-Sourcing

Audit universe, risk-based annual plan and quarterly delivery for functions without IT audit capability.

Cybersecurity Assessment

Maturity assessment across the six NIST CSF 2.0 functions, evidenced rather than self-scored.

Cloud Security Review

AWS, Azure and Google Cloud configuration, identity and shared-responsibility assurance.

Targeted Reviews

One area, scoped tightly and finished quickly — access, change, privileged access, backup or vendor risk.

Frameworks and standards we audit against

ISACA ITAF COBIT 2019 ISO/IEC 27001:2022 ISO 22301:2019 NIST CSF 2.0 OWASP ASVS PCI DSS IIA Standards

Need an independent view?

Tell us the scope, the regulator and the deadline. We will come back with an approach, a team and a fee estimate.

Request a proposal