Eleven phases, applied to the ones your scope needs
A repeatable methodology run with standardised templates, working papers, assessment checklists, evidence repositories and quality review procedures, so the work is consistent, traceable and defensible when somebody checks it.
Engagement preparation
Governance and coordination established before work starts
Engagement plan with scope assumptions, deliverables, dependencies and milestones. Stakeholders identified on both sides with roles confirmed. Communication channels, reporting frequency, status meetings, escalation paths and decision points agreed. Confidentiality commitments, approvals and access arrangements completed.
Initial assessment & scoping
Your business context, not a generic starting point
Business model, operating environment and strategic objectives understood. Applicable legal, regulatory, contractual and framework requirements identified. Scope boundaries defined across entities, departments, systems, services, processes, sites, assets and third parties. Assumptions, exclusions and priorities confirmed in writing.
Gap assessment & recommendations
Current state measured against the requirement set
Policies, procedures, standards and governance documents assessed for existence, adequacy and alignment. Control implementation evaluated against applicable requirements. Each requirement rated Compliant, Partially Compliant or Not Compliant. Current state compared against the defined target state, with prioritised remediation actions issued.
Policy, procedure & administrative system development
The documentation the regulator expects to see
Required documentation identified against regulatory obligations and standards. Existing governance documents reviewed for adequacy, consistency and duplication. Policies, procedures, standards, guidelines, work instructions, forms, templates and registers developed or updated. Roles, approval authorities, workflow activities and accountability defined within each procedure.
Evidence collection & control validation
Documented and operating are different claims
Required evidence identified per control and assessment point. Documentation, records, screenshots, approvals, logs, reports, training records and configurations collected. Evidence reviewed for completeness, validity, accuracy and relevance. Alignment validated between documented control, actual practice and operational evidence, with clarification requested where material is incomplete or inconsistent.
Risk assessment & treatment support
A register that drives decisions rather than records them
Assets identified across information, systems, applications, infrastructure, personnel, facilities and third-party services. Threats, vulnerabilities and risk scenarios identified and evaluated against agreed likelihood and impact criteria, accounting for existing controls. Risks prioritised on inherent or residual basis. Treatment actions defined, mitigate, accept, avoid or transfer, with owners, target dates and status.
Data classification support
Sensitivity assigned by the business, not by us
A structured collection format agreed for identifying information assets. Business units coordinated to catalogue data owned, used, processed or stored. Findings reviewed with data owners, classification levels assigned against internal policy, and the results connected to access restriction, handling, retention and treatment decisions.
Business impact analysis support
What a disruption would actually cost
BIA approach, worksheet, criteria and impact categories introduced to stakeholders. Sessions facilitated to identify critical services, supporting systems and dependencies. Disruption impact evaluated across financial, operational, legal, regulatory and reputational dimensions. Recovery time and recovery point objectives defined, and completed information reviewed for consistency.
Awareness sessions & training
Delivered to your people, in your context
Sessions tailored to the organisation’s risks, policies and operational practice, delivered across departments and levels of responsibility. Topics selected from password hygiene, phishing awareness, acceptable use, data classification, incident reporting and clean desk practice. Customised material prepared for internal use, with attendance records documented as evidence.
Internal audit & management review
Findings closed before the external auditor arrives
Audit scope, criteria and plan defined against the applicable framework. Documentation, records and evidence reviewed; interviews and walkthroughs conducted. Observations, nonconformities and improvement opportunities documented in an internal audit report. Management review agenda prepared, inputs summarised, and decisions, actions and ownership recorded.
Reporting & follow-up
Delivered, documented and retained
Agreed deliverables and reports prepared in accordance with the approved scope and provided within the agreed timeline through the agreed channel. Issuance documented including date, recipient and follow-up actions. Engagement records, plans, methodologies, results and reference sources, retained under defined retention provisions.
Three ratings, and the middle one is where the work is
Documentation we develop
Policies, procedures, standards, guidelines, work instructions, forms, templates and registers, developed against a defined document methodology, aligned to the applicable standards and your operational reality, with roles, approval authorities and records defined inside each procedure.
What sustains it afterwards
Implementation planning, document approval, communication and awareness, version control and publication. A management system that is maintained rather than assembled again before each supervisory review.
Phases that run as engagements in their own right
Risk assessment
Asset identification, evaluation, prioritisation and treatment, with the register handed over.
Data classification
The collection sheet, the four sensitivity levels and the business validation behind them.
Internal audit & readiness
Audit scope, evidence review, nonconformities and the management review that closes them.