01 End-to-end PKI transformation
The National Public Key Infrastructure (PKI), providing trust services (digital signatures, authentication and timestamping) for government and regulated industries, required comprehensive modernisation. The system…
Management System Assurance
Independent audit of QMS, ITSM, BCMS and ISMS against agreed criteria. Implementation and remediation support is available as a separate advisory engagement, with independence safeguards.
We provide independent assurance of organisational management systems so quality, IT service management, continuity and information-security obligations are evidenced against agreed criteria — not merely declared. Implementation and remediation support is offered only as a separate advisory engagement; when independence is required, assurance and advisory roles are segregated (separate scope and, where needed, separate team).
What this covers
- Independent audit of design and operating effectiveness
- Criteria mapping to ISO and supervisory expectations
- Risk-rated findings with ownership and priority
- Prioritised remediation recommendations for client-owned action
- Optional advisory implementation support under a separate engagement
- Optional independent verification / retest after remediation
Typical outcomes
Clear audit trail for management and supervisors; prioritised remediation recommendations the client can own; optional advisory or verification under a separate, independence-aware scope.
When to engage
Organisations needing independent assurance of QMS, ITSM, BCMS or ISMS ahead of supervisory, certification or contractual review — without conflating auditor and implementer roles.
Engagement model
- Agree assurance scope, criteria and evidence expectations.
- Audit design and operating effectiveness against the agreed baseline.
- Report risk-rated findings and prioritised remediation recommendations.
- Optional: separate advisory engagement for implementation support, or independent verification after remediation — with role segregation when independence is required.
Reference frameworks for this engagement:
Practitioner credentials for this engagement:
Cases
05 vCISO — QMS, ISMS and BCMS
A regulated electronic communications operator required accredited quality, information-security and business-continuity management systems — a condition of continued operation under essential-entity and licence…
08 Enterprise asset & risk graph
A regulated B2B organisation lacked a single source of truth for information assets, services and dependencies — configuration items, clusters, physical equipment and locations were not linked in a deterministic model…
Tell us which management system and supervisory expectations apply. We will outline an assurance approach, evidence plan and — if needed — a separate advisory scope that preserves independence.