SCALING
Two frameworks, one management system, and an internal audit nobody owns.
Somewhere past a hundred people the questionnaires stop being occasional. A second framework appears, the platform is running, and clause 9.2 becomes due on a management system your own team built.
- Free 45 minute diagnostic
- Free one-page roadmap
- Fixed fee once agreed
- Works inside your platform, or without one
What this stage looks like
More than one framework is live or planned, and the control sets overlap.
There is a security or compliance lead, but no separate audit function.
The platform shows green and the certification date has not moved.
Surveillance is due, or Stage 1 is booked, and the internal audit has not run this cycle.
The usual shape for a company like yours
By now a compliance platform is usually in place and one framework is held or close. The next customer asks for a second, and the team that built the system can't be the one that audits it.
SOC 2 readiness, or the second framework built inside the platform you already run. The SOC 2 report itself is issued by a licensed CPA firm, not by Goldline.
Secure Compliance keeps the controls running and the evidence current.
The clause 9.2 internal audit on a system your own team built.
An annual penetration test.
Managed compliance and security
Three packages on a 12-month term, billed monthly, keep the controls running and the evidence current, with independent verification.
See all three packagesThe packages run inside whichever compliance platform you already use, and the licence stays yours, bought direct. If you have no platform, say so on the scope check and we will set out the options.
If you run the management system, you can't audit your own work in it. We do that part, independently, and leave the running of it with you.
The independent internal auditModules
Annual penetration test
What it is
An annual independent penetration test and a retest of the fixes.
What it produces
A test report and a retest report.
Delivered by our security partner, with any commission disclosed on your proposal.
Priced at the diagnostic, fixed once agreed.
Reserved hours
What it is
Blocks of fractional security lead time.
What it produces
Decisions made and recorded, questionnaires reviewed, and audit sessions attended within an agreed scope.
Goldline never audits a system it implemented.
Priced at the diagnostic, fixed once agreed.
Questionnaire desk
What it is
Human review of what your platform drafts, and the answers it can't give, on scope and exceptions.
What it produces
Reviewed answers ready for your sign-off.
Goldline reviews the answers; your organisation approves and sends them.
Priced at the diagnostic, fixed once agreed.
AI system security testing
What it is
Your AI systems tested for security weaknesses, including prompt injection, data leakage and agent misuse.
What it produces
One report, findings mapped to ISO 42001 and ISO 27001 controls, and a retest statement confirming which findings are closed.
Delivered by a specialist tester under Goldline's scope and rules of engagement. Where Goldline implemented your ISO 42001, the report is verification evidence, not an independent audit.
From £4,500 fixed, set at scoping.
Start with the free 45-minute diagnostic
You keep a one-page roadmap either way.