Controls Assurance
What we do → Trust & Assurance
Controls Assurance
Independent design, implementation, and operating-effectiveness testing of controls across your business, technology, and digital stack.
We test whether your controls actually work — not just whether they exist. Design assessments, operating-effectiveness testing, and remediation support across cyber, IT, privacy, and operational control frameworks.
What we cover
- Design assessment of control frameworks against ISO 27001, NIST CSF, COBIT 2019, and sector regulations
- Operating-effectiveness testing with sampling, evidence collection, and gap scoring
- Control maturity benchmarking against industry peers
- Remediation planning with effort estimates and sequenced delivery
What you receive
An evidence-backed control assurance report, a maturity scoring sheet, and a sequenced remediation roadmap. Reports formatted for board and audit committee consumption.
Our approach
We work in three defined phases. Design review maps your stated controls against the framework and surfaces design gaps. Operating effectiveness testing samples live evidence over a defined window — ticket queues, access review logs, change records, incident response artefacts. Issues reporting ranks findings by residual risk, not by control count.
Typical engagement
- Phase 1. Design assessment (2–4 weeks)
- Phase 2. Operating effectiveness testing (4–8 weeks depending on sample size)
- Phase 3. Issue closure support and management response (4–12 weeks)
Prerequisites
- Named engagement sponsor on the client side
- Read-Only Access to Systems in scope
- Access to policies, standards, procedures and prior audit reports where available
- Point of contact for each control owner function
Related practices
