Every engagement follows the same six-stage sequence. You always know where we are, what's next, and what we need from you. No mystery consulting, no scope creep — just a disciplined delivery model refined over dozens of certifications.
We start with a structured discovery — mapping your business model, data flows, infrastructure, and the risks that actually matter to your customers and regulators. The output is a written scope statement and engagement plan that we both sign before any deep work begins.
We benchmark your current state against the target framework — clause by clause, control by control. The deliverable is a prioritised remediation plan that groups findings by risk, effort, and dependency, so your team knows exactly where to start.
We draft your policy suite — not from a template pack, but tailored to your operating model, technology stack, and risk appetite. Everything is version-controlled, approved through a documented workflow, and cross-referenced to the framework.
Policies on paper are worthless if they don't reflect what's happening in your environment. We embed with your engineering, IT, HR, and operations teams to operationalise controls — configuring tools, designing evidence workflows, and training key personnel. This is where most programs stall; it's where we put our hours.
Before a certification body sees you, we do. We run a full internal audit — independent, documented, and deliberately tough. The goal is to surface every finding now, when it's cheap to fix, rather than in front of an auditor you're paying by the day.
We don't hand you off to a certification body and disappear. We help you select a reputable CB, prepare your teams for Stage 1 and Stage 2 audits, sit in on opening and closing meetings, and drive any residual non-conformities to closure.
Controls that don't reduce real risk are waste. We design programs to make your business safer and your customers more confident — the certificate is a by-product of doing the work properly, not the goal itself.
We build evidence workflows that generate proof as a natural side-effect of running the business — not scramble drills in the week before an audit. Done right, your next year's audit is 70% easier than the first.
Every policy we draft is written for your specific stack and operating model. Generic boilerplate is lazy — and auditors see straight through it.
When something isn't working, we flag it early, document it, and propose a fix. We don't escalate to cover ourselves or pad hours with status meetings. You hired us to solve problems — we solve them.
For a first-time certification at a 20–100 person company, with a cooperative team and no exceptional complexity.
Timeline varies with complexity, team availability, and starting maturity. We quote firm after the discovery workshop.
We'll walk you through how this methodology maps to your business during a free 30-minute scoping call.