Scoping & gap assessment
Defensible scope definition — systems, locations, people, third parties — followed by a clause-level and control-level gap analysis with effort estimates.
Loading page content
Executive summary
A certification is a deadline attached to several hundred small tasks. Programmes fail because ownership is vague, evidence is collected late, and the controls are first tested during the audit itself. This engagement runs certification as a delivery project with named owners, dated milestones and an internal audit deliberately harder than the real one.
A certification is a deadline attached to a very large number of small tasks. Programmes fail not because the requirements are hard but because ownership is vague, evidence is collected late, and the first time anyone tests the controls is during the audit itself.
We run certification as a delivery project. Scope is agreed in week one. Every clause and control is assigned to a named owner with a due date. Evidence is collected continuously into a structured repository, and we run an internal audit that is deliberately harder than the real one.
The methodology is built around a 14–20 week programme for a first ISO 27001, or 10–16 weeks for SOC 2 Type I — and, more importantly, a control set built to hold without drama at the surveillance audit.
Why certifications slip
Each capability below is a discrete workstream with its own owner, deliverables and definition of done.
Defensible scope definition — systems, locations, people, third parties — followed by a clause-level and control-level gap analysis with effort estimates.
Full management system build: context, leadership, planning, support, operation, evaluation and improvement, with the Statement of Applicability that ties it together.
Automated and semi-automated evidence collection wired to the systems that generate it, so the repository is always audit-ready rather than assembled under pressure.
Independent internal audit conducted to ISO 19011, plus a facilitated management review that produces real decisions rather than minutes.
Auditor selection, Stage 1 and Stage 2 preparation, on-site support and nonconformity closure — we are in the room for the audit.
Where you need several certifications, we sequence them to reuse controls and evidence rather than re-running the same assessment work for each one.
Each benefit is stated with the commercial consequence attached, because a capability without a consequence is a feature list.
Scope fixed in week one, every clause and control assigned to a named owner with a due date, and a live burn-down of open items.
16 weeks to first certification, held as a commitment rather than an estimate.
An internal audit run to ISO 19011 by former certification-body auditors, with findings closed before the external auditor arrives.
Zero major nonconformities across every engagement we have taken to certification.
Controls and evidence mapped across frameworks from the start rather than retrofitted afterwards.
Controls and evidence collected once, then reused rather than re-gathered for the second certification.
Evidence collected continuously from the systems that generate it, so no retrospective archaeology exercise.
Cuts audit-period engineering involvement from weeks to tens of hours.
Phases overlap deliberately — design begins before assessment closes, so the programme does not stall waiting for a document to be signed off.
Weeks 1–2
Agree the boundary, the applicable framework version and the certification body, then build the master plan with dates and owners.
Weeks 2–5
Clause-by-clause and control-by-control gap analysis, producing a remediation backlog sized in effort and sequenced by dependency.
Weeks 5–14
Implement the management system and close control gaps, with weekly delivery checkpoints and a live burn-down of open items.
Weeks 12–18
Operate the controls long enough to generate evidence, run internal audit and management review, and close findings before the auditor arrives.
Week 18 onward
Stage 1 and Stage 2 support, followed by a maintenance calendar that keeps the system healthy through surveillance audits.
Named artefacts, listed in the statement of work. If it is not on this list, we will tell you before you sign rather than after.
Sector constraints change the delivery approach more than they change the obligations. These are the sectors this methodology is built around.
Fixed fee for defined scopes, retainer for ongoing services. We do not price advisory work on time and materials, because that misaligns our incentive with your outcome.
3 weeks
Organisations deciding whether and when to certify
Commercial basis: Fixed fee
14–20 weeks
Organisations committed to achieving certification
Commercial basis: Fixed fee, milestone-based
20–36 weeks
Organisations pursuing two or more certifications
Commercial basis: Fixed fee, discounted per additional framework
Every proposal states what is included, what is not, and what would trigger a change request. If the scope we recommend is smaller than the one you asked for, we will say so.
One implementation, cross-mapped. Each framework below links to its own obligations and control domains.
Specific answers about scope, timeline and what we will and will not do.
Ask a practitioner directly. First responses come from the person who would run your engagement, within one business day.
Ask a questionTurn data protection law into working product behaviour.
We map where personal data actually lives, rebuild consent and rights flows into your product, and leave you with a privacy programme that survives an audit and a board question.
Explore capabilityDefensible security, built around how your business actually loses money.
Threat-led security strategy, architecture and control design that prioritises the handful of scenarios that would genuinely hurt you — not a generic checklist of 300 controls.
Explore capabilityOne operating model for privacy, security, risk and AI accountability.
We design the committees, policies, decision rights and reporting lines that let trust obligations be managed as one programme instead of four competing ones.
Explore capabilityCombining capabilities reduces cost — the second framework typically lands at about half the price of the first.