Who it is for
A proportionate engagement with clear boundaries.
Organisations operating aligned ISMS and PIMS arrangements that want efficient coverage without obscuring either system’s requirements or risks.
Independent assurance
Integrated ISMS and PIMS internal audit
One coordinated audit programme with distinct security and privacy criteria, evidence trails and conclusions.
How we assess your ISMSCheck what happens. Explain the result.
AgreeConfirm the scope and requirements to check
ReviewUnderstand your processes and supporting records
SelectChoose records and activities based on risk
TestCheck whether controls work in practice
ReportExplain what works and where requirements are not met
Acceptance and competence boundary
Acceptance is subject to a documented review of privacy-management competence, capacity, processing context, relevant jurisdictions and any need for legal or specialist input. Mang Morgan does not provide legal advice; an engagement may require an approved specialist or be declined if the required competence or independence cannot be demonstrated.
What is included
- Aligned scope and criteria confirmation
- Integrated audit plan and evidence request
- Shared-governance and specialist process interviews
- Coordinated risk-based sampling
- Separate and cross-system finding evaluation
- Quality review and controlled reporting
Typical outputs
- Integrated audit plan
- Traceable ISMS and PIMS workpapers
- Coordinated findings register
- Report with visible system-level conclusions
What we need from you
- ISMS and PIMS scopes
- Security and privacy risk records
- Statement of Applicability and privacy processing context
- Shared and system-specific operating evidence
Timing
Confirmed after overlap, system boundaries, processing roles, locations, evidence and specialist-review needs are mapped.
Pricing basis
Estimated bottom-up from shared activities plus the security- and privacy-specific work needed for defensible conclusions.
Important exclusions
- Treating overlapping evidence as proof of all criteria
- Certification
- Legal advice
- Auditing implementation work where independence is impaired
Frequently asked questions
Does this service result in certification?
No. Mang Morgan does not issue ISO/IEC 27001 or ISO/IEC 27701 certificates or guarantee a certification outcome. A certification decision remains outside this engagement.
How is the scope confirmed?
We confirm the intended outcome, management-system boundary, criteria, locations, processing context, evidence, stakeholders, dates and limitations before issuing the final proposal.
Can the work use a client platform?
We can work in authorised client-owned GRC or privacy-management platforms where appropriate. Platform status helps organise evidence but does not replace testing or professional judgement, and platform experience does not imply partnership.
What happens if the scope changes?
Additional sites, products, processing activities, jurisdictions, frameworks, interviews, revisions, travel, remediation or accelerated dates are assessed through agreed change control.
Start with a defined scope
A clear plan. An agreed fee.
Tell us your objectives and timing. Your proposal will set out the work, deliverables and responsibilities.