Gap analysis

We examine what you have and compare it with what the standard requires. That covers your existing policies, your controls and how they operate in practice, the evidence available to demonstrate them, your systems and the data behind them, and your suppliers.

Where AI is in scope we inventory the systems, establish which are built and which are bought, and classify each one against the obligations that apply to it.

Scope determines both the cost of the work and whether the resulting report satisfies your buyers. Drawn too wide, you pay for controls nobody asked about. Drawn too narrow, the certificate arrives and the reviewer immediately asks about something outside it.

Setting scope is judgement rather than a checklist, and it is the first thing we do.

• A written assessment of your position against each requirement.
• A recommended scope, with the reasoning behind it.
• A prioritised list of what is missing, separating what must exist before certification from what can follow.
• An estimate of the time and cost to close the gaps.

Days rather than weeks for a single framework and a defined estate. Larger estates and multiple frameworks take longer, and we tell you which applies before you commit.