We offer five core service areas, each delivered by senior practitioners with direct experience of the work — not oversight of it. Engagements are available on a project, retainer or co-sourced basis.

Internal Audit

WHO THIS IS FOR

Organisations without an in-house internal audit function, or those looking to supplement existing capability with senior external expertise.

WHAT WE DELIVER

We design and deliver risk-based internal audit programmes tailored to your organisation's size, sector and risk profile. Outputs are practical, board-ready and focused on what matters — not on producing audit reports for the sake of it.

Our internal audit services include:

• Co-sourced internal audit — ongoing delivery as your external IA function
• Outsourced IA — full service, including planning, delivery and committee reporting
• Follow-up and thematic reviews — targeted work on specific risk areas
• IA effectiveness reviews — independent assessment of your existing function
• IA set-up and maturity support — helping you build internal capability

Typical engagement: £5,000 – £25,000 depending on scope and duration. Retainer arrangements available.

Governance Advisory

WHO THIS IS FOR

Boards, trustees and leadership teams who need to strengthen their governance frameworks — or who want an independent view of how well their current arrangements are working.

WHAT WE DELIVER

• Governance framework development — terms of reference, matters reserved, committee structures
• Board effectiveness reviews — independent assessment of how your board operates
• Governance code reviews — including the Charity Governance Code and equivalent frameworks
• Policy and procedure frameworks — rightsized, accessible and fit for purpose
• Governance health checks — a structured, fixed-fee review of your current arrangements

Governance Health Check — fixed fee, defined scope, board-ready output. Contact us for pricing.

Risk Management

WHO THIS IS FOR

Organisations that know risk management matters but haven't yet built the frameworks, language or culture to make it work in practice.

WHAT WE DELIVER

• Risk framework development — definitions, appetite statements, classification and common language
• Risk register design and implementation
• Risk training and embedding — workshops for boards, executives and operational teams
• Risk maturity assessments — where you are and how to improve
• Ongoing risk monitoring and reporting support

Resilience & Business Continuity

WHO THIS IS FOR

Organisations — particularly those operating critical services — who need to know they can withstand and recover from disruption.

WHAT WE DELIVER

• Business Continuity Management System (BCMS) development, including ISO 22301 alignment
• Business impact analysis and continuity plan development
• Crisis management framework design
• BCM plan testing and exercising

Cyber Governance & Risk

WHO THIS IS FOR

Boards and leadership teams who need confidence that cyber risk is being governed effectively — without necessarily having in-house security leadership to provide that assurance.

WHAT WE DELIVER

• Cyber governance advisory — helping boards understand and oversee cyber risk exposure
• Cyber risk framework development — appetite statements, risk classification and reporting lines
• Cyber maturity assessments — benchmarked against recognised frameworks such as NIST and ISO 27001
• Board and committee cyber reporting — translating technical risk into board-ready insight
• Incident response governance — readiness reviews and post-incident governance support