What it is
A requirement-by-requirement assessment. I map where you are against the regulations and frameworks that apply, then name the gaps, the risk, and the actions that close them.
Why it matters
Unrecognised exposure
Many organisations assume they comply without ever mapping operations against what the regulation actually requires.
A policy is not compliance
Having a policy does not mean the organisation meets the obligation that policy is meant to satisfy.
Expectations are rising
Across sectors, regulatory expectations are rising. The cost of being out of alignment is rising with them.
How it works
- 1
Scope the regulations
The regulations and frameworks in scope are identified and agreed with you.
- 2
Map the requirements
Each requirement is written down in plain language.
- 3
Assess alignment
Current practice is assessed against each requirement, and the evidence is reviewed.
- 4
Gaps and output
Non-compliant and partial areas are identified, risk-rated, and given an action.
What you receive
- Compliance status by requirement: compliant, partially compliant, non-compliant, or not assessed
- A risk-rated gap register, with recommended actions and timelines
- An executive summary with a clear verdict for leadership
What changes
Exposure that was invisible becomes visible, and manageable. You can show regulators, funders, and the board exactly where you stand, and how you will close the gaps.
What a finding looks like
An illustrative example, written to show the form of the work. It is not a client record.
- Requirement
- Show who has access to the personal data you hold.
- Status
- Partially compliant
- Gap
- Access is granted. The record of who approved it is incomplete.
- Action
- Rebuild the access record for the systems in scope.
Fees
I do not publish a flat fee for this review. I scope it and price it before any work begins.