Do you need an independent assessment of your IT and information security, or support with improvements? Our audits assess risks, control effectiveness and compliance. Our advisory work helps you strengthen information security and risk management and prepare for audits.
Before starting, we agree whether you need an independent audit or advisory support, and define the scope and expected deliverables.
When management needs an objective assessment, we evaluate IT governance, information security, control effectiveness and compliance against agreed criteria.
Explore IT auditsIf you need help planning and implementing improvements, we assess risks, design controls, develop documentation and help you prepare for an audit.
Explore information securityWe offer risk assessment, information security advisory and IT audit services, from risk analysis to strategic advice, including risk assessments for essential service providers.
Who is it for? Management, IT leaders and those responsible for internal audit who need an independent assessment of IT governance, information security or control effectiveness.
When is it useful? Before major IT decisions, after significant changes or an incident, and as part of periodic risk-based assurance.
What we do:What will you receive? An audit report setting out the scope, criteria, conclusions, risk significance and prioritised recommendations. We discuss the findings with responsible staff and management.
Request a quoteWho is it for? Management, risk managers and IT leaders who need to assess IT and cyber risks or improve their risk management arrangements.
When is it useful? When planning a new system or service, changing a service provider, preparing for a significant change or updating a risk assessment.
What we do:What will you receive? A risk register with ratings and supporting rationale, and a risk treatment plan with actions, owners and target dates. Risk acceptance decisions remain with your management.
Request a quoteWho is it for? Organisations that need practical support to develop their information security arrangements, documentation and controls.
When is it useful? When establishing an information security management system, addressing deficiencies or clarifying responsibilities and security measures.
What we do:What will you receive? Agreed policies and procedures, defined roles and responsibilities, and an implementation plan. Implementation support can be included within the agreed scope.
Request a quoteWho is it for? Organisations seeking to assess their readiness to meet a particular standard, contractual requirements or other applicable information security requirements.
When is it useful? Before an external audit or client assessment, when implementing new requirements, or when addressing existing gaps.
What we do:What will you receive? A requirements-to-evidence matrix, gap analysis and prioritised improvement plan. An audit readiness assessment identifies unresolved issues; it is not a certificate and does not guarantee a positive external audit outcome.
Request a quoteWho is it for? Organisations developing or using AI solutions that need an independent assessment of governance, data use and risks.
When is it useful? Before deployment, when the intended use or data changes, or as part of a periodic assessment of an existing solution.
What we do:What will you receive? An audit report covering identified risks, control deficiencies, assessment limitations and prioritised recommendations. Technical model testing and its scope are agreed separately.
Request a quoteWho is it for? Essential service providers that need to assess service disruption risks and inform their continuity arrangements.
When is it useful? When preparing or updating a risk assessment, when key dependencies change, or following a disruption or exercise.
What we do:What will you receive? A documented risk assessment covering service dependencies, disruption scenarios, risk ratings and a plan of measures. Applicable service requirements and the methodology are defined in the scope of work.
Request a quoteWho is it for? Owners and operators of offices, server rooms and other important facilities who need an independent assessment of the adequacy of physical security measures.
When is it useful? When bringing a new facility into use, after refurbishment or a security incident, and as part of periodic assurance.
What we do:What will you receive? An audit report with site-specific findings, risk significance and prioritised improvement recommendations. Any technical testing and its scope are agreed in advance.
Request a quoteWho is it for? Management, service owners and IT leaders responsible for maintaining operations and restoring services during disruptions.
When is it useful? When establishing continuity arrangements, changing a critical service or supplier, or reviewing plans following an exercise or disruption.
What we do:What will you receive? A business impact analysis, business continuity and IT recovery plans within the agreed scope, and, where an exercise or test is included, a report with an improvement plan. The proposal defines the scope of planning and testing.
Request a quoteGV Audit's services draw on more than 25 years of professional experience in IT, information security, risk management and auditing.
Our experience includes IT and information security audits, the development of information security management systems, critical infrastructure protection, and assessments of organisational risk management and business continuity.
We combine audit, management and hands-on implementation experience to assess control effectiveness and provide recommendations suited to your organisation's needs and resources. We work against agreed assessment criteria, drawing on ISO/IEC 27001 and 27002, COBIT and ISACA guidance, among other frameworks.
Our experts' credentials include the following certifications and auditor qualification:
Three examples of completed client projects: the initial challenge, the work we carried out and the results delivered to the client. The projects are described anonymously.
Challenge: The information security management system's documentation, responsibilities and processes needed to be aligned with the standard's requirements.
Result: We developed documentation and process descriptions and provided an overview of unresolved gaps. This enabled the client to plan an independent internal audit.
Organisation: An organisation beginning to implement ISO 27001.
Our work: We advised on defining the management system scope and assessing risks. Together with the client, we developed policies, procedures, a risk treatment plan and a Statement of Applicability, and helped improve processes and gather implementation evidence.
Next steps: The client was able to plan and commission an independent internal audit. Readiness to commission a certification audit could then be assessed after addressing the internal audit results and completing the management review.
Challenge: The management system's compliance and effectiveness needed to be assessed before the initial certification audit and subsequent surveillance audits.
Result: We delivered an internal audit report with conclusions, nonconformities and opportunities for improvement, enabling the client to plan corrective actions.
Organisation: An organisation planning certification or already certified.
Our work: We prepared a risk-based audit plan, reviewed documentation, conducted interviews and checked implementation evidence on a sample basis. In subsequent internal audits before surveillance audits, we also assessed the remediation of previous deficiencies and changes made.
Next steps: The client could use the report to plan corrective actions and inform management reviews and preparations for external audits. We performed the internal audit within the agreed scope and in line with our independence principles.
Challenge: Service disruption risks, critical dependencies and the adequacy of existing safeguards needed to be assessed using a consistent methodology.
Result: We developed a risk assessment and a plan of measures with owners and target dates. The client could use these to update its continuity plans.
Organisation: An essential service provider.
Our work: We mapped the processes, people, IT, infrastructure and suppliers required to deliver the service. We analysed disruption scenarios, assessed likelihood and impact, and documented risk treatment measures.
Next steps: The client could use the risk assessment to improve continuity arrangements and plans, and select disruption scenarios for exercises or testing.
We start with your needs and agree the objectives, scope, deliverables, schedule and fees before work begins.
Tell us what you would like to address, your organisation's sector and any relevant deadline. Together, we clarify whether you need an audit or advisory support.
We then define the scope and prepare a proposal. If we need more information to estimate the work involved, we clarify it before agreeing the fees.
Depending on the scope, we need an overview of your IT services and systems, existing risk assessments, information security documentation and previous audit reports.
We agree contact people, interviews and secure arrangements for sharing the evidence needed to assess controls. An initial enquiry only needs a description of your requirements; sensitive materials are shared through an agreed channel.
For audits, you receive a report covering the scope, assessment criteria, conclusions, evidence-based findings and recommendations prioritised by risk significance.
For advisory engagements, you receive the agreed deliverables, such as a risk register, action plan, policies, procedures or an audit readiness assessment.
We discuss the results and clarify the next steps with your contact people and, where appropriate, management.
The effort required depends on the number of systems and processes in scope, organisational complexity, the availability of documentation, and the extent of interviews and control testing.
Fees also depend on any on-site work, specialist involvement and the schedule. Our proposal specifies the pricing basis, assumptions and your expected contribution. Any additional work and its cost are agreed before it is undertaken.
No. We also support small and medium-sized businesses that need a structured approach to information security.
Yes. We identify documentation and control gaps against agreed requirements and prepare an improvement plan. Within the agreed scope, we support implementation and review the evidence provided.
Before accepting an audit, we assess the impact of previous advisory work and other relationships on our independence. We do not audit solutions we have designed or implemented ourselves. Where we have advised in the same area, we agree with the client on a change of audit scope or the involvement of a separate independent auditor. If independence cannot be maintained, we decline the audit engagement.
In advisory engagements, management decisions and risk acceptance remain with the client's management. Advisory work and audit preparation do not guarantee a positive outcome in a subsequent audit.
Yes. Our reports include a management summary explaining the key findings, their impact on the organisation and the recommended order of action.
We offer one-off assessments, project-based support and long-term engagements.
Briefly describe your situation and we will get back to you as soon as possible.