Mang MorganAssurance

How we work

A clear plan. Evidence you can trace.

From scoping to final release, you know what we will do, what your team owns and how conclusions are reached.

Request a quoteView sample outputs
How we assess your ISMSCheck what happens. Explain the result.
AgreeConfirm the scope and requirements to check
ReviewUnderstand your processes and supporting records
SelectChoose records and activities based on risk
TestCheck whether controls work in practice
ReportExplain what works and where requirements are not met
Your report connects each conclusion to the evidence reviewed.

Protecting independence

We do not audit our own work.

Implementation support and independent internal audit are separate engagements. A different name on the proposal is not enough: the people assessing your ISMS must be able to challenge it objectively.

What conflicts do we check?

Before accepting an audit, we identify who designed, implemented or operated the processes in scope. We also assess previous advisory work, employment or management responsibilities, financial interests, close personal relationships, referral arrangements and pressure to reach a particular result. Proposed auditors and reviewers declare relevant interests.

How is a conflict resolved?

We document the threat and the acceptance decision. Where effective separation is possible, we assign competent personnel who were not responsible for the work being assessed and agree reporting arrangements that protect their judgement. Changing personnel or adding a reviewer does not automatically remove a self-review threat. If objectivity cannot be protected, we decline the independent audit or require another independent provider.

What if Mang Morgan built our ISMS?

We can support implementation, but we will not present a review of our own implementation as an independent internal audit. An independent auditor or provider must be selected where our involvement would compromise objectivity. Your organisation retains ownership of the ISMS and appoints the appropriate audit resource.

What is recorded and checked during delivery?

The acceptance record identifies prior involvement, declared conflicts, safeguards, the assigned team and the decision to proceed or decline. Relevant restrictions are agreed with the client before work starts. New conflicts or scope changes are reassessed; work is paused or reassigned if the agreed safeguards no longer hold. Client factual review cannot determine our findings, and fees are not conditional on a favourable audit result.

Engagement lifecycle

Three phases. Six controlled stages.

The path is tailored to the service and risk. Open a stage to see what your team provides and the record we expect to produce.

Define

Agree the work

A defensible engagement starts with the right boundary, criteria and people.

  1. 01

    Qualify and accept

    Confirm purpose, scope, competence, capacity, conflicts and contractual boundaries.

    Your part and the output
    Your responsibility
    Describe the intended outcome, scope, target dates and known constraints; identify an authorised sponsor.
    Expected output
    Acceptance decision, independence record and agreed next steps.
  2. 02

    Plan

    Set criteria, objectives, dates, participants, evidence requests and risk-based samples.

    Your part and the output
    Your responsibility
    Confirm process owners, approve the schedule and provide the initial evidence index through the agreed channel.
    Expected output
    Controlled audit plan, evidence request and interview schedule.
Examine

Follow the evidence

Risk-based review connects interviews, samples and tests to the agreed criteria.

  1. 03

    Review and test

    Use documents, interviews, walkthroughs and samples to evaluate implementation and effectiveness.

    Your part and the output
    Your responsibility
    Make owners and evidence available, demonstrate processes and respond to open items without coaching the conclusion.
    Expected output
    Documented interviews, samples, tests and open-item log.
  2. 04

    Validate and report

    Trace conclusions to criteria and evidence; validate facts without transferring judgement.

    Your part and the output
    Your responsibility
    Check factual accuracy, provide identified missing evidence and acknowledge the findings presented.
    Expected output
    Draft findings, factual-validation record and closing briefing.
Conclude

Release a traceable result

Quality review and controlled release turn fieldwork into a usable record.

  1. 05

    Quality review

    Check scope consistency, evidence sufficiency, finding quality, metadata and release controls.

    Your part and the output
    Your responsibility
    Remain available for factual clarification; audit judgement and release approval stay with Mang Morgan.
    Expected output
    Reviewed findings register and quality-controlled final report.
  2. 06

    Close and retain

    Release controlled outputs, agree follow-up boundaries and securely archive records.

    Your part and the output
    Your responsibility
    Accept delivery, own root-cause analysis and corrective action, and agree any separately commissioned verification.
    Expected output
    Release record, closure checklist and agreed retention or deletion actions.

Practical questions

What happens in practice?

Audit depth follows risk and available evidence. The agreed plan, not a platform score, determines what we do.

Does every applicable control receive the same test?

No. A full-scope audit considers the applicable clauses and controls, but testing depth varies by risk, scope and evidence. Workpapers record the population, selected sample, rationale, test and result; “not tested”, “evidence pending” and “not applicable” remain distinct.

How do you decide which records to sample?

We consider population size, risk, change, prior issues and the audit objective. A sample must support the conclusion it is used for; one process test can inform several related controls only where the evidence genuinely does so.

Where do we share confidential evidence?

Through an agreed restricted channel, with authorised access and retention terms. Client evidence is not placed in the source repository. Do not send passwords or confidential records through the public quote form.

Can you work in our GRC platform?

Yes, with client-authorised access. Vanta, Drata or another platform may help organise evidence; automated status and mappings do not replace interviews, sampling, corroboration or auditor judgement.

How are potential findings confirmed?

We connect the criterion, objective evidence and conformity gap, then ask the client to check factual accuracy. The auditor retains classification and conclusion responsibility; a factual review is not a request for the client to approve audit judgement.

Who fixes a finding, and who verifies it?

Your organisation owns root-cause analysis, correction, corrective action and implementation. If commissioned separately and independent, Mang Morgan can review implementation and effectiveness before recording a closure decision.