A9 AdvisoryISO Certification Readiness
ISO 27001, 22301, 42001, 27701, 20000 and 9001. We build management systems that work in practice and prepare you thoroughly for certification: scope, risk assessment, Statement of Applicability, internal audit and management review.
The Challenge
Certification projects often stall because the management system is built as a document exercise rather than a way of working. Audits then expose gaps in evidence, ownership and internal audit.
How We Help
We build management systems that work in practice and prepare you thoroughly for certification: scope, risk assessment, Statement of Applicability, internal audit and management review.
Our GRC specialists have more than 15 years of experience with UAE government entities and private sector organisations across the region, and hold certifications including CISA, CRISC, ISO 27001, ISO 22301, ISO 42001 and ISO 27701. We also build Arbor GRC, our own platform for running these programmes.
What We Deliver
Readiness Assessment
Where you stand against the standard and what it will take.
Management System Design
Scope, policies, processes and records that fit your organisation.
Risk Assessment and SoA
A defensible risk assessment and Statement of Applicability.
Internal Audit
Independent internal audits that meet the standard's requirements.
Certification Support
Preparation for and support during the certification audit.
What You Can Expect
- Certification achieved first time
- A management system people actually use
- Surveillance audits without the scramble
How We Work
Assess
Understand your obligations, risks and current state.
Design
Build the framework, policies, controls and governance.
Embed
Train owners and run the first cycle alongside them.
Assure
Audit, report and prepare for regulators and certification.
Standards and Frameworks
Frequently Asked Questions
Do you certify organisations?
No. Certification is issued by independent certification bodies. We prepare you and support you through the audit.
How long does ISO 27001 take?
Typically four to nine months, depending on scope and how much is already in place.
Often Combined with
Regulatory Compliance
UAE IA, Dubai ISR, ADHICS, NCEMA 7000 and sector regulations.
Governance, Risk and ComplianceEnterprise Risk Management
Link risk to strategy and make better decisions.
Governance, Risk and ComplianceBusiness Continuity and Resilience
Business impact analysis, recovery plans and crisis readiness.
Talk to an Adviser
Tell us what you are working on and we will bring the right specialists to the conversation. We reply within one working day.