Two ways we work.
We establish or extend a management system with AI governance, or we audit and assess it independently.
ISO/IEC 42001, on the system you already run — or from the ground up
AI governance and an AI management system that reuse the ISMS or QMS you have, and add what is AI-specific.
- A scored gap register with evidence
- A system design: shared processes, AI-specific additions, roles, the risk and impact method
- Readiness before the certification body's own audit
Independent internal audits and assessments
ISO/IEC 42001, ISO/IEC 27001 and ISO 9001, following ISO 19011 by someone who knows the systems and processes underneath.
- An agreed audit plan, criteria and schedule
- Evidence-based findings, graded, with a clear report and a closing meeting
- Never of a system we designed or implemented
What you can ask for
The engagements, by standard. Each line names the question it answers and what you receive.
ISO/IEC 42001
Implementation · integration · internal audits · assessments- AI governance and risk assessmentWhere do we stand, and what should we do first? A scored view against NIST AI RMF and ISO/IEC 42001, with findings that write the next step.
- Gap assessmentHow far is our current system from the standard? A scored gap register with the evidence behind each finding.
- AIMS implementationWe need an AI management system and have nothing to build it on. The system designed and built from the ground up: scope, policy, roles, the risk and impact method, controls, readiness.
- Integration into an existing ISMS or QMSWe already run ISO/IEC 27001 or ISO 9001 and don't want a second system. Shared processes identified, the AI-specific requirements added where they belong, one integrated system.
- Internal auditOur audit programme needs an auditor independent of the system. An agreed audit plan, graded findings with evidence, a report and a closing meeting.
- Readiness assessmentThe certification body is coming. Are we ready? A readiness view before the certification body's own audit, with what to close first.
ISO/IEC 27001
Internal audits · assessments- Internal auditDo the controls operate in the systems, or on paper? An audit following ISO 19011 of the ISMS, its controls sampled in the systems and the records.
- Gap and readiness assessmentWhat will the certification or surveillance audit find? The gaps against the standard, graded and evidenced, before the external auditor sees them.
- Independent management system effectiveness reviewThe system conforms. Does it do its job? A read on a system, process or control set, with findings traceable to evidence.
ISO 9001
Internal audits · assessments · 2026 transition- Internal auditDoes the process deliver what it should, every time? An audit of the processes as they run, against the standard and your own criteria.
- Gap and readiness assessmentWhere do we stand before the next certification visit? The gaps, graded and evidenced, and what to close first.
- Process effectiveness reviewThe process conforms. Does it perform? Effectiveness rather than clause coverage: the measures, the actions, and what changes when the process doesn't deliver.
- ISO 9001:2026 transition gap assessmentThe sixth edition is out. What changes for us? The list of gaps against the 2026 edition and what to change before the transition period ends on 30 September 2029.
How we work
We start from the processes and systems you already run. The scope is fixed and agreed in the first conversation. You own the content; we bring the method and the enterprise-systems experience. The certification body audits; we don't.
For ISO/IEC 27001 and ISO 9001 we audit and assess; we don't implement them. For ISO/IEC 42001 we do both, and we never audit a system we designed or implemented.
Start a conversation
Tell us which standards you run, which you're adding, and when the next audit is. We'll come back with a clear read on where you stand and a sensible first step.