FREE 48-HOUR REVIEW · NO COST · NO CALL REQUIRED
Free Statement of Applicability review
They send one document. It comes back inside 48 hours marked up the way a Stage 2 auditor would read it. No call, no obligation, and if nothing is wrong with it we say so.
Stuck on certification?
On a GRC platform and still stuck?
Not sure it survives Stage 1?
- Free Statement of Applicability (SoA) Review
- No strings
One document, by email. No systems access, no meeting.
Choose which document you send.
Statement of Applicability
Every control marked applicable, checked against whether the justification would survive being asked about, and every exclusion checked for a written rationale.
Audit programme
Checked against whether it covers the whole standard across the certification cycle, which is what clause 9.2.2 a) requires and what gets sampled.
Last internal audit report
Checked against whether the findings are classified, whether corrective actions carry owners and dates, and whether the auditor was independent of what they audited.
What comes back
Two pages, written as an auditor would write them.
Findings classified the way an auditor classifies them, each written against the clause it fails.
What closing each finding actually takes, rather than a note that it is open.
A plain statement of whether the document is in a state that would survive Stage 1.
Who reads it
Alfred Obeng
Every Pre-Read is read and marked up personally by Alfred Obeng. There is no review team, no template pass and no handover, which is the reason the reply reads like an auditor wrote it.
- ISO 42001 Lead Implementer and Lead Auditor (PECB)
- ISO 27001 Senior Lead Implementer and Lead Auditor (PECB)
- CISSP
- PMP
Why this is free
Most people asking about a Statement of Applicability are mid-implementation and are not ready to buy anything. Reading one document takes ninety minutes and tells both sides whether there is anything worth doing together. If there is not, we say so.
Where the evidence problem usually is
In most reviews the control set is sound and the problem is the evidence behind it, scattered across drives, inboxes and tickets with nobody owning collection. That is what a GRC platform is for. Goldline works with Drata, Thoropass and Sprinto and will help you choose the right one and get it configured properly.
What happens next, if anything does
- ISO 27001 Readiness Assessment
From £1,950, credited in full against a Sprint
- ISO 27001 Guided
£7,000
- ISO 27001 Internal Audit
From £4,500
The impartiality rule, and why it is a feature
Goldline does not sell implementation and internal audit to the same organisation for the same scope. If Goldline built your management system, someone else audits it, and we will introduce an independent credentialled auditor or brief a competent person inside your own organisation. That restriction is written into the engagement. Goldline is not a certification body.
Frequently asked
Send the document
One document, no cost, no call. It comes back within 48 hours with the findings written against the clause each one fails.
Claim My Free Statement of Applicability (SoA) Review