Audit & Advisory GRC

With the risk assessment, almost always. A certification obtained without one produces a management system describing a theoretical organisation: expensive to maintain and disconnected from real threats. The risk assessment is in any case a requirement of the standard, not an optional first step. If the deadline is contractual — a client, a tender — a gap analysis says within weeks what separates the current state from the target, and what certification will really cost.

They are built to be accepted: policies, risk assessment, statement of applicability and evidence follow the structure the target frameworks expect. An auditor does not validate a document, though, they validate a practice — a process described but not applied shows up in interview. That is why we prefer a short corpus that is genuinely maintained to exhaustive documentation nobody keeps alive.

No, and nobody can do both. Certification is issued by an accredited body, independent from whoever advised: that independence is the very condition of its worth. We prepare you — gap analysis, building the management system, assembling the evidence, support during the audit — and the certification body then steps in. A provider promising the certificate itself is selling either a mock audit or a conflict of roles.