Confidence in your controls. Evidence to prove it.
Objective IT audits, control testing and cyber governance reviews for UK organisations, with findings your board, buyers and insurers can rely on.
of UK businesses identified a cyber security breach or attack in the last 12 months.
Cyber Security Breaches Survey 2025/26, DSIT ↗- CISA-certified
- Evidence-based
- Board-ready
We never audit systems we have designed, implemented or operated.
Independent assurance, tailored to your organisation
Single reviews, multi-area assurance, support for your internal audit team or an annual programme, each scoped and priced before work begins.
IT general controls audit
An independent test of the controls that keep your systems and data reliable: who has access, how changes are made and whether day-to-day operations run as described.
Scope
- User access: joiners, movers and leavers
- Privileged and administrator accounts
- Change and release management
- Backup, recovery and scheduled job monitoring
Deliverables
- One-page executive summary
- Findings ranked by risk, each supported by evidence
- Practical, proportionate remediation plan
- Optional re-test to confirm remediation
Cyber security governance review
A structured review of how cyber risk is owned, managed and reported, from documented policies to day-to-day practice.
Scope
- Security policies and how they are applied in practice
- Risk register and risk ownership
- Incident response and business continuity readiness
- Supplier and third-party oversight
Deliverables
- Maturity assessment across key areas
- Gaps against recognised good practice, including NCSC guidance
- Prioritised 90-day improvement plan
- Optional board briefing
Audit and certification readiness
Understand your gaps before an auditor or certification body identifies them. We assess you against your target standard and show you what to address first.
Scope
- Gap assessment against the chosen standard
- Review of policies, records and evidence
- Sample testing of key controls
- Risk assessment and statement of applicability (ISO/IEC 27001)
Deliverables
- Gap report with a prioritised action list
- Evidence checklist for the assessor
- Realistic timetable to readiness
- Follow-up readiness check
Board and buyer assurance
When a board, investor, major customer or insurer needs confidence in your controls, we provide an independent, evidence-based view.
Scope
- Scope agreed around what the stakeholder needs to rely on
- Testing of the controls that matter to that stakeholder
- Review of key supplier and third-party dependencies
- Clear statement of scope and limitations
Deliverables
- Independent assurance summary
- Supporting evidence pack
- Clear statement of scope and limits
- Question-and-answer session with stakeholders
Assess your audit readiness
Answer six short questions and your score will update as you go. The result is an indication only and is not an audit opinion.
A clear, structured method from start to finish
Frequently asked questions
What does CISA mean, and why does it matter?
CISA (Certified Information Systems Auditor) is ISACA's globally recognised certification for IT audit, control and assurance professionals. It means your audit is led by a professional who has been trained and examined in audit methodology and who is bound by ISACA's Code of Professional Ethics.
When, and how often, should we commission an IT audit?
Most organisations benefit from an annual review, with an additional review after significant change: a new core system, a cloud migration, rapid growth, an acquisition or a serious incident.
What is the difference between an IT audit and a cyber security audit?
An IT audit assesses whether the controls over your systems and data are well designed and operating effectively, including governance, access, change and resilience. A cyber security technical review concentrates on defences against attack. Our work focuses on control and governance assurance; for technical testing, we work alongside accredited partners.
Is this the same as a penetration test?
No. An IT audit assesses whether your controls are well designed and operating effectively in practice, whereas a penetration test attempts to break into your systems. If you require both, we can recommend accredited testing partners.
Can you certify us for ISO 27001 or Cyber Essentials?
We prepare you for certification and assess your readiness. Certification itself is issued by an accredited certification body, which keeps the process independent.
Do you work remotely or on site?
Both. Most evidence can be reviewed remotely and securely, and we attend on site where interviews or walkthroughs are better carried out in person.
How do you handle our data?
We request only the minimum evidence required, keep it encrypted, and return or securely delete it at the end of the engagement, as agreed in writing before work begins.
How much does an audit cost?
Each engagement is quoted at a fixed price for an agreed scope before any work begins. Following an initial call, we will send you a written proposal setting out the options.
Arrange a confidential consultation
The initial consultation is free and without obligation. We will reply within one working day with a suggested scope.
Thank you for your enquiry
We will reply from info@risecontrol.co.uk within one working day. If your request is urgent, please call 0161 524 9960.