Governance, Risk & Compliance

Governance, Risk & Compliance services

Risk assessments, audits, policies and certification. Choose a service to see what it covers and what you receive.

IT Risk Assessment

Identify, rate and prioritise your technology risks

Overview

We work with business and IT leaders to identify critical assets, threats and vulnerabilities, evaluate existing controls and rate residual risk using ISO/IEC 27005 and NIST-based methods. The result is a risk register and treatment plan leadership can own.

What we cover

Critical asset and business process identification
Threat and vulnerability analysis
Control effectiveness evaluation
Risk register and treatment plan

Capabilities

Business-led: Risks described in business terms, with owners who can act on them.
Recognised methods: Approaches aligned with ISO/IEC 27005 and NIST SP 800-30.
Technical depth: Optional technical testing to validate how well key controls work.

What you receive

IT risk assessment report
Risk register
Risk treatment plan
Executive briefing

IT Audit & Systems Review

Independent audit of IT controls and systems

Overview

We audit access management, change management, operations, backup, continuity and security controls, test evidence and report findings clearly for management, audit committees and external auditors.

What we cover

IT general controls audit
Application and business system controls review
Access and segregation-of-duties testing
Backup, continuity and disaster recovery review

Capabilities

Evidence-based testing: Controls tested with samples and evidence, not interviews alone.
Framework alignment: Findings mapped to COBIT, ISO/IEC 27001 and sector requirements.
Clear reporting: Findings rated by risk with agreed management actions and dates.

What you receive

Audit plan and scope
Audit findings report
Management action plan
Follow-up review

Security Policy Development

Clear, practical policies and standards

Overview

Policies copied from templates rarely fit. We write policy frameworks around how your organisation really works, aligned to ISO/IEC 27001, the Cybersecurity Act and sector directives, and help you roll them out.

What we cover

Information security policy framework
Acceptable use, access, data and incident policies
Technical standards and procedures
Policy rollout and acknowledgement

Capabilities

Tailored writing: Policies that reflect your structure, systems and risk appetite.
Layered framework: Short policies for everyone, detailed standards for those who need them.
Adoption support: Briefings and awareness material so policies are understood, not just signed.

What you receive

Policy framework
Approved policy documents
Standards and procedures
Rollout communication pack

ISO/IEC 27001 Readiness

Prepare your ISMS for certification

Overview

We guide you from scoping to certification audit: gap analysis, risk assessment, Statement of Applicability, policies, control implementation, internal audit and management review, at a pace that suits your team.

What we cover

Scope definition and gap analysis
Risk assessment and Statement of Applicability
ISMS documentation and control implementation
Internal audit and certification support

Capabilities

Pragmatic ISMS: A management system sized to your organisation, not a paperwork exercise.
Implementation help: Our engineers can implement the technical controls, not just document them.
Audit support: Internal audit and support during the certification body’s audits.

What you receive

Gap analysis report
Statement of Applicability
ISMS documentation set
Internal audit report

Regulatory Compliance Advisory

Meet Act 1038, Act 843 and sector directives

Overview

Regulated organisations face overlapping requirements from the Cyber Security Authority, the Data Protection Commission and sector regulators such as the Bank of Ghana. We map what applies to you, assess compliance and help you close gaps efficiently.

What we cover

Applicability mapping of laws and directives
Critical information infrastructure obligations
Data protection registration and compliance
Sector directive gap assessments

Capabilities

Regulatory mapping: One control set that satisfies multiple overlapping requirements.
Gap assessment: Evidence-based review of where you meet, partly meet or miss each requirement.
Reporting support: Help preparing submissions, reports and responses to regulators.

What you receive

Regulatory obligations register
Compliance gap assessment
Remediation plan
Regulator-ready evidence pack

CISO as a Service

Senior security leadership, on a flexible retainer

Overview

Many organisations need CISO-level judgement but not a full-time executive. Our virtual CISO builds your security strategy, owns the risk register, prepares board and regulator reporting and steers vendors and projects.

What we cover

Security strategy and multi-year roadmap
Board, audit committee and regulator reporting
Policy framework and risk register ownership
Vendor, budget and project oversight
Incident leadership when it matters most

Capabilities

Strategy and governance: A roadmap tied to business goals, with clear priorities, budgets and accountable owners.
Regulatory alignment: Guidance on the Cybersecurity Act, 2020 (Act 1038), the Data Protection Act, 2012 (Act 843) and sector directives.
Team development: Mentoring for your IT and security staff, so capability stays in-house as you grow.

What you receive

Security strategy and roadmap
Board-ready risk reporting pack
Policy set and risk register
Monthly leadership sessions

Governance, Risk & Compliance
that regulators recognise