Who it is for
A proportionate engagement with clear boundaries.
Organisations with internal-audit or agreed assurance findings ready for objective verification.
Independent assurance
Corrective-action verification
Independent review of correction, root cause, implementation and sustained effectiveness before closure.
Example: approval gap
A fix needs a second look.Root cause
Why could approval be bypassed?
Action
Client strengthens the workflow
Re-test
Review subsequent access changes
Decision
Is the fix effective?
ISMSFollow-up
What is included
- Response and root-cause review
- Implementation-evidence testing
- Effectiveness evaluation
- Closure decision and rationale
Typical outputs
- Corrective-action review record
- Verification evidence log
- Closure conclusion
What we need from you
- Finding and original evidence
- Approved action plan
- Implementation evidence
- Effectiveness evidence
Timing
Commonly 0.5–2 days per group of related findings.
Pricing basis
Hourly or fixed-fee based on finding volume, complexity and verification method.
Important exclusions
- Designing or implementing the client response
- Closure where evidence is insufficient
- Verification where independence is impaired
Frequently asked questions
Does this service result in certification?
No. Mang Morgan does not issue ISO/IEC 27001 or ISO/IEC 27701 certificates or guarantee a certification outcome. A certification decision remains outside this engagement.
How is the scope confirmed?
We confirm the intended outcome, management-system boundary, criteria, locations, processing context, evidence, stakeholders, dates and limitations before issuing the final proposal.
Can the work use a client platform?
We can work in authorised client-owned GRC or privacy-management platforms where appropriate. Platform status helps organise evidence but does not replace testing or professional judgement, and platform experience does not imply partnership.
What happens if the scope changes?
Additional sites, products, processing activities, jurisdictions, frameworks, interviews, revisions, travel, remediation or accelerated dates are assessed through agreed change control.
Start with a defined scope
A clear plan. An agreed fee.
Tell us your objectives and timing. Your proposal will set out the work, deliverables and responsibilities.