Independent external auditing · ISO/IEC 27001 · ISO/IEC 42001 · ISO 22301
Attestware Systems provides internal audits, certification readiness audits, supplier audits and outsourced internal audit across information security, Artificial Intelligence (AI) governance and business continuity. Whether you need to meet the internal audit requirement of your standard, walk into your certification audit with no surprises, or give your board evidence it can rely on, you get a qualified independent auditor, a fixed price for an agreed scope, and a plain-English report that certification bodies, boards and customers accept.
What we audit
We audit management systems: the policies, risk assessments, controls and records that a standard requires an organisation to run. Our focus is the three standards where demand for qualified, independent auditors is sharpest.
The international standard for an Information Security Management System (ISMS). We audit whether your ISMS actually operates as documented: risk treatment, control effectiveness, records and management commitment.
Clauses 4 to 10 · Annex A: 93 controlsThe first certifiable standard for an Artificial Intelligence Management System (AIMS). We audit how you govern the AI you build, buy and use: inventory, risk and impact assessments, lifecycle controls and human oversight.
Clauses 4 to 10 · Annex A: 38 controlsThe international standard for a Business Continuity Management System (BCMS). We audit whether your continuity arrangements would actually hold in a disruption: business impact analysis, plans, exercising and recovery evidence.
Clauses 4 to 10 · Impact analysis · ExercisingServices
Plain-English findings, prioritised by risk, each with a practical corrective action. No jargon walls, no thirty-page preamble.
Every certified organisation must audit its own management system under Clause 9.2, and the auditor must be impartial. We run your internal audit programme so you get a qualified, independent auditor without hiring one.
About internal audits →A full dress rehearsal before your Stage 1 or Stage 2 certification audit, run with the same rigour the certification body will apply, so nothing they find is a surprise.
About readiness audits →Independent evidence about the third parties who hold your data or embed AI in your products, in place of taking a questionnaire answer on faith.
About supplier audits →Lead Auditor capacity for accredited certification bodies running ISO/IEC 27001 and ISO/IEC 42001 programmes, including Stage 1 and Stage 2 assessments and surveillance visits.
For certification bodies →A structured, evidence-based answer to the question boards are starting to ask: where does AI live in this organisation, and who is in control of it?
About AI health checks →A mapping of your current practices against the European Union's AI Act obligations that apply to you, with the gaps stated plainly and ranked.
About AI Act reviews →Beyond management systems
Internal audit is bigger than ISO. It is the independent, objective assurance function that tells a board whether risk is managed, controls work and governance holds. Most small and mid-sized organisations cannot justify an in-house internal audit team; we provide the function as a service, led by practitioners with a financial statement audit background, so the discipline of financial auditing carries into everything we examine. Explore outsourced internal audit →
Independence
We only audit. No consultancy, no implementation, no selling you the fix. A firm that builds management systems cannot impartially judge them, so we chose one side of the table and we stay there.
We check for conflicts before every engagement. If any relationship or prior work could compromise impartiality on your audit, we tell you and step aside. One exception is all it takes to turn independence into a slogan, so there are no exceptions.
We never certify. Accredited certificates are issued only by accredited certification bodies. When we audit, you get findings and a recommendation; when we audit under contract to a certification body, their independent decision-maker makes the certification decision, as ISO/IEC 17021-1 requires.
Platform
Compliance platforms have automated the auditee's side of the table. Almost nothing has been built for the auditor's side. We are building it: the Attestware platform is the tooling our own auditors work in. The principle behind it is simple. AI does not make audit judgements, the auditor does. What AI is genuinely good at is noticing, and an auditor who misses less builds a stronger, fairer case for the organisation being audited.
Process
We establish which standard, which parts of your organisation, and what the audit is for: an internal audit obligation, certification readiness, or assurance for a customer or board. You get a fixed scope and a fixed price. If fieldwork later uncovers more than we scoped, we pause and agree the extension with you before any extra day is worked or billed; the price never changes without your sign-off.
You receive a plan naming what will be examined and who we need to speak to, plus a single evidence request list. Everything is uploaded once to the platform; nobody chases attachments over email.
Interviews, evidence sampling and control testing, on site or remote. We test what actually happens, not what the policy says should happen.
Findings are prioritised by risk, each with a plain-English explanation and a practical corrective action. We walk your team through every finding so nothing in the report is a surprise.
When corrective actions are done, we verify them and close the findings formally, so your next audit, or your certification body, starts from a clean, evidenced position.
Credentials
FAQ
No. Only an accredited certification body can issue an accredited ISO certificate. What we do is everything around that moment: the internal audits the standard requires, the readiness audit before the certification body arrives, and, under contract to certification bodies, the lead auditing behind their certification decisions.
We explain every finding, agree practical corrective actions and verify them once done. What we will not do is design or implement the fix ourselves, because then we would be auditing our own work. For implementation help, you engage a consultancy of your choice; whoever implements, your auditor must have had no hand in it, and we hold ourselves to that rule without exception.
We take no implementation or consultancy work, we run a conflict check before every engagement, and we decline any audit where impartiality could reasonably be questioned. Independence is the product we sell, so we protect it more carefully than anything else.
No. We also provide outsourced internal audit as a function: risk-based audit plans, internal control testing, and governance and compliance reviews, reported to the board or audit committee. Our practice is led by financial statement audit experience, so finance processes and controls are home ground. We do not perform statutory financial statement audits, which are a separately regulated activity.
A typical internal or readiness audit for a small or medium organisation runs two to five auditor days depending on scope, spread over two to three weeks including planning and reporting. You get the exact duration and price at scoping, before you commit.
For most organisations, certification: an accredited certification body examines the system in two stages and issues the certificate if it holds up. Before that happens, the standard requires internal audits, and a readiness audit tells you what the certification body will find before they find it. Both are exactly what we do.
Because assurance only counts when it comes from someone with nothing at stake. A certificate says an independent third party confirmed your management system meets the standard. Strip out the independence and all that is left is your own opinion of your own work, which your customers already had for free.
Nothing physically stops an organisation printing its own certificate. The market decides what that paper is worth, and it decides quickly. The same logic applies one layer down, which is why the standards require internal audits to be independent too: an organisation reviewing its own work is marking its own homework.
A fixed fee, agreed at scoping and before you commit. The price follows the auditor days your scope genuinely needs, and we show you that calculation. We do not publish a rate card, because scope drives everything: a focused readiness audit for a small SaaS company and a multi-standard internal audit programme are very different engagements. What we will never do is surprise you after the work has started.
Two groups. Startups and growing companies that need credible, independent audit work without enterprise overhead, and certification bodies that contract lead auditors for their certification audits. If you are a large enterprise with a procurement portal and a panel process, we are probably not your firm, and we are comfortable saying so.
Yes. It is usually the efficient route, because ISO 27001, ISO 42001 and ISO 22301 share the same management system clauses: an integrated audit tests the shared machinery once and the standard-specific controls separately. One plan, one report and less interview time for your team.
Yes. Fieldwork can run remotely through the platform, with on-site days where the scope needs them. Management system audits translate well across borders because the standards are international by design.
Request an audit
Tell us which standard and what the audit is for. We will come back with a fixed scope, a fixed price and a start date.
Contact Attestware