Audit-Ready Implementation

The system built, rehearsed, and handed over.

The whole management system built end to end, rehearsed before anyone official sees it, and handed to your certification body ready to be assessed. One consultant, one price, and twelve to sixteen weeks for a company of eight to ten people.

12 TO 16 WEEKS · END TO END35 DOCUMENTS · IN YOUR HANDS1 PRICE · FIXED BEFORE YOU COMMIT
The engagement, stage by stage

From first gap analysis to the day the auditor arrives.

01 · 1 to 2 weeks · Where do we stand?

First, where you actually stand.

Every requirement of the standard, measured against how your company runs today: what would fail an audit, what it takes to fix, and who owns each fix.

Gap Analysis Report47 REQS
ISMS Scope StatementSCOPE
Asset InventoryREGISTER
02 · 2 to 3 weeks · The auditor's first ask

Your risks, scored and ruled on.

The two documents every certification auditor opens first: your real risks scored before and after treatment, and a defensible ruling on all 93 controls. Stage 1 is largely a read of those two.

Risk Register & Treatment PlanSCORED
Statement of Applicability93/93
Risk Assessment MethodologyMETHOD
03 · 2 to 3 weeks · The system takes shape

Policies your team will actually follow.

The full policy suite and operating registers, written around the way your company actually works. Short, specific, and owned by named people.

Information Security Policy Suite12+ DOCS
Access, Change & Incident RegistersLIVE
Supplier & Legal RegistersMAPPED
04 · 1 to 2 weeks · The dress rehearsal

A rehearsal, and somebody else signs the real one.

I walk the whole system the way a certification body would, grade what I find, and we close it. What I will not do is sign that off as your Clause 9.2 internal audit, because nobody can audit their own work. That one is run by someone independent of me: a named person inside your company, who I train and hand the programme to, or an outside auditor if you would rather.

Internal Audit ChecklistGRADED
Nonconformity & Corrective Action RegisterCLOSED
ISMS Programme CalendarAUDIT SCHEDULED
05 · 1 to 2 weeks · Leadership signs

Leadership signs it, the auditor receives it.

Management review with your leadership, the closing engagement report, and a clean handover to the certification body of your choice. You walk into Stage 1 with the whole system already exercised once.

Management Review MinutesSIGNED
Client Engagement ReportVERDICT
Certification Body HandoverREADY
The last stage

What the auditor
actually examines.

Every document a certification body examines: the policy suite, the operating registers, the internal audit record, the management review. Finished, versioned, and describing how your company actually runs, which is what holds up when an auditor interviews your people as well as reading your files.

Policy suite12 SIGNED
Annex A controls93/93 RULED
Internal auditFINDINGS CLOSED
Management reviewMINUTED
Risk registerSCORED & TREATED
Document set35 VERSIONED
One engagement, one price

£9,500 to £24,000

That band covers a single-site company of roughly eight to twenty-five people, and the low end is a company of about eight. Headcount and a second site move you within it, and anything larger comes from the call rather than from this page. Your exact price is fixed on a thirty-minute scoping call, no charge, before you commit anything, and it doesn't move after that. Includes everything in the Gap Assessment and Risk Register & SoA services.

Twelve to sixteen weeks is the window for a company of eight to ten people, the bottom of the size band above. A bigger company is more of everything, so the window stretches with the price, and yours is fixed on the scoping call. It is my working time, and it assumes you can turn questions around inside a couple of days. What I can't schedule is your certification body's own booking queue, or any period they want to see the system operating before they audit it. I'll tell you on the call what that adds for the body you're considering.

One thing is deliberately not in the fee: the Clause 9.2 internal audit itself, because I built the system and cannot be the one who audits it. Training somebody inside your company to run it, and handing them the programme to do it with, is included and costs you nothing extra. If you would rather bring in an outside auditor, that is their invoice, and I'll tell you on the call roughly what it runs to. If somebody else built your system and the audit is all you need, that is a service of its own.

Send me a message Book a 30 minute call Read the work