FREE 48-HOUR REVIEW · NO COST · NO CALL REQUIRED

Free Statement of Applicability review

They send one document. It comes back inside 48 hours marked up the way a Stage 2 auditor would read it. No call, no obligation, and if nothing is wrong with it we say so.

Stuck on certification?

On a GRC platform and still stuck?

Not sure it survives Stage 1?

Free Statement of Applicability (SoA) Review
No strings

Claim My Free Statement of Applicability (SoA) Review

Currently accepting Pre-Read documents

One document, by email. No systems access, no meeting.

Send your documentBack within 48 hours

Choose which document you send.

Statement of Applicability

Every control marked applicable, checked against whether the justification would survive being asked about, and every exclusion checked for a written rationale.

Audit programme

Checked against whether it covers the whole standard across the certification cycle, which is what clause 9.2.2 a) requires and what gets sampled.

Last internal audit report

Checked against whether the findings are classified, whether corrective actions carry owners and dates, and whether the auditor was independent of what they audited.

What comes back

Two pages, written as an auditor would write them.
Findings classified the way an auditor classifies them, each written against the clause it fails.
What closing each finding actually takes, rather than a note that it is open.
A plain statement of whether the document is in a state that would survive Stage 1.

Who reads it

The practitioner

Alfred Obeng

Every Pre-Read is read and marked up personally by Alfred Obeng. There is no review team, no template pass and no handover, which is the reason the reply reads like an auditor wrote it.

CISSPVerify on Credly
Project Management Professional (PMP)®Verify on Credly
ISO 27001 Senior Lead Implementer and Lead Auditor (PECB)
ISO 42001 Lead Implementer and Lead Auditor (PECB)

Why this is free

Most people asking about a Statement of Applicability are mid-implementation and are not ready to buy anything. Reading one document takes ninety minutes and tells both sides whether there is anything worth doing together. If there is not, we say so.

Where the evidence problem usually is

In most reviews the control set is sound and the problem is the evidence behind it, scattered across drives, inboxes and tickets with nobody owning collection. That is what a GRC platform is for. Goldline works inside your GRC platform, in our included workspace, or without a platform.

GRC platform implementation

Already bought a platform and not getting value from it?

Sort the evidence problem

What happens next, if anything does

ISO 27001 Readiness Assessment
From £1,950, credited in full against a Sprint
ISO 27001 Sprint
£7,000 fixed
ISO 27001 Internal Audit
£1,950, plus VAT for up to 10 people. A fixed fee for up to two days and a written report, for a single legal entity with up to 10 people in scope, one site or cloud hosted, on an ISMS built by someone else. Extra days are quoted before they start. Anything larger is scoped on the diagnostic and starts from £2,950, plus VAT. Goldline will not audit a management system it implemented.

The impartiality rule, and why it is a feature

If Goldline built your management system, someone else audits it, and we will introduce an independent credentialled auditor or brief a competent person inside your own organisation. That restriction is written into the engagement. Goldline is not a certification body.

Frequently asked

It is the document that records which of the ISO 27001 Annex A controls apply to your management system, why each applicable control was included, whether it is implemented, and the written rationale for anything excluded. It is the document a certification body reads first, because it sets what the rest of the audit samples.

No. You send one document and the review comes back by email. If you would rather talk it through afterwards you can, and if you would rather not, nothing further happens.

That is the ordinary case, and it is the useful case. A document in poor shape tells you more in two pages than a tidy one does. Nothing in the review is written to embarrass anyone, because it is written against the clause rather than against the author.

The review comes back with findings, not a proposal. If the document is sound, the reply says so and that is the end of it. If there is something Goldline could usefully do, it is named once, with the published price, and you decide.

No. One document by email. No platform access, no credentials, no read-only accounts, nothing connected to your environment.

Forty eight hours from receipt of the document. If something in the document means the review will take longer, you are told that rather than left waiting.

Send the document

One document, no cost, no call. It comes back within 48 hours with the findings written against the clause each one fails.