ESTABLISHED
Multiple entities, overlapping frameworks, and an auditor who will ask who built what.
At this size the question is no longer whether you have a management system. It is whether the evidence holds across entities, whether the internal audit is genuinely independent, and whether anyone can answer a Stage 2 auditor in the room.
- Free 45 minute diagnostic
- Free one-page roadmap
- Fixed fee once agreed
- Works inside your platform, or without one
What this stage looks like
Several entities or regions inside one certification scope.
An internal audit function that needs an independent pair of hands for part of the programme.
A Stage 2 audit approaching with findings still open from the last cycle.
AI systems entering scope and no governance framework yet decided.
The usual shape for a company like yours
Here a certificate is in view or already held, often across more than one entity. The work is closing findings before the auditor sees them and deciding how far AI governance should reach.
The independent risk assessment, to close findings before Stage 2.
Reserved hours to decide the scope of the AI framework.
Then Security & Governance, with scope confirmed before work starts.
The annual penetration test.
The questionnaire desk.
Managed compliance and security
Three packages on a 12-month term, billed monthly, keep the controls running and the evidence current, with independent verification.
See all three packagesThe packages run inside whichever compliance platform you already use, and the licence stays yours, bought direct. If you have no platform, say so on the scope check and we will set out the options.
If you run the management system, you can't audit your own work in it. We do that part, independently, and leave the running of it with you.
The independent internal auditModules
Annual penetration test
What it is
An annual independent penetration test and a retest of the fixes.
What it produces
A test report and a retest report.
Delivered by our security partner, with any commission disclosed on your proposal.
Priced at the diagnostic, fixed once agreed.
Reserved hours
What it is
Blocks of fractional security lead time.
What it produces
Decisions made and recorded, questionnaires reviewed, and audit sessions attended within an agreed scope.
Goldline never audits a system it implemented.
Priced at the diagnostic, fixed once agreed.
Questionnaire desk
What it is
Human review of what your platform drafts, and the answers it can't give, on scope and exceptions.
What it produces
Reviewed answers ready for your sign-off.
Goldline reviews the answers; your organisation approves and sends them.
Priced at the diagnostic, fixed once agreed.
AI system security testing
What it is
Your AI systems tested for security weaknesses, including prompt injection, data leakage and agent misuse.
What it produces
One report, findings mapped to ISO 42001 and ISO 27001 controls, and a retest statement confirming which findings are closed.
Delivered by a specialist tester under Goldline's scope and rules of engagement. Where Goldline implemented your ISO 42001, the report is verification evidence, not an independent audit.
From £4,500 fixed, set at scoping.
Start with the free 45-minute diagnostic
You keep a one-page roadmap either way.