Remote GRC delivery
Governance, risk and compliance specialists in your time zone — wherever you operate.
GRC Department delivers audit-ready governance, risk and compliance work as discrete, scoped services — engaged singly or bundled, priced before work starts, and delivered remotely within your working hours.
- Four-hour working overlap guaranteed
- Single services or bundled programmes
Start with one service
320 in the catalogue- ASMAccess Rights Baseline AnalysisAssessment and Analysis
- BCRAlternate Site and Workspace Recovery PlanningBusiness Continuity and Resilience Planning
- COMBoard-Level Compliance Summary PreparationCommunication and Advisory
- CMPBreach Notification Readiness AssessmentCompliance and Regulatory Management
Know what you need
Pick the exact services from the catalogue.
Select one service or bundle several, answer six scoping questions, and receive a written proposal with scope, duration and price within one business day.
Browse the catalogue →Not sure where to start
Describe the obligation and we will scope it.
Tell us the framework, where you are today and the deadline. A GRC lead turns it into a scoped proposal — or comes back with the questions that decide it.
Submit a brief →Frameworks covered
- SOC 2
- ISO 27001
- ISO 27701
- ISO 42001
- GDPR
- DPDPA
- PCI DSS 4.0
- HIPAA
- HITRUST
- NIST CSF
- NIST AI RMF
- EU AI Act
Service catalogue
320 services across 16 categories, engaged singly or bundled.
Rather than scoping an open-ended consulting engagement, select the discrete units of work you need — a business impact analysis, a supplier tiering model, a retention schedule — and receive a scoped proposal against each.
- ASMAssessment and Analysis
- BCRBusiness Continuity and Resilience Planning
- COMCommunication and Advisory
- CMPCompliance and Regulatory Management
- DSNDesign and Development
- GOVGovernance and Risk Management
- IMPImplementation and Execution
- KNWKnowledge Transfer
- LEGLegal and Regulatory Coordination
- MONMonitoring and Management
- PRJProject Execution
- QUAQuality Assurance
- RSPResponse and Recovery
- STRStrategic Planning and Architecture
- TSTTesting and Validation
- TPRThird-Party Risk Management
How it works
Select the work. Scope it. We deliver it.
You do not have to define a consulting engagement from a blank page. The catalogue breaks GRC delivery into discrete services, each one a scoped unit of work with a named output.
- 01
Choose from the catalogue
Browse 16 delivery categories or search the full catalogue. Select a single service, or add several to a bundle — across categories if the work spans them.
- 02
Complete a short scoping form
Six questions covering boundary, driving framework, timing, your business hours and any existing material. Questions adapt to the category of service selected.
- 03
Receive a written proposal
A GRC lead confirms the deliverable, duration, price and acceptance criteria, and who will deliver the work — within one business day.
- 04
Delivery under a single agreement
Contracting, confidentiality terms and administration run through GRC Department. Bundled services are delivered under one statement of work and one point of contact.
Engagement models
Three ways to take services from the catalogue.
Single service
One catalogue item with a defined output — a business impact analysis, a retention schedule, a supplier tiering model. The narrowest way to start.
- One scoped deliverable
- Defined acceptance criteria
- Suited to a specific gap
Bundled programme
Several services combined into one engagement — commonly a readiness sequence: assessment, then design, then implementation and testing.
- One statement of work
- One point of contact
- Sequenced delivery plan
Continuing support
Recurring catalogue services delivered on a cadence — monitoring cycles, review cycles, questionnaire response and register maintenance.
- Agreed recurring cadence
- Consistent consultant
- Reviewed each quarter
Terms for each model are set out in the proposal returned after scoping. Every engagement begins with a two-week trial period.
Client portal
Your engagements, deliverables and consultants in one place.
Track milestones, accept deliverables, approve your consultant's weekly timesheet, and see what your own teams owe the engagement — the evidence exports and ticket samples that stall an audit when they go missing.
Accept deliverables
Acceptance closes the milestone it belongs to.
Approve timesheets
Hours you approve become payable; a week you do not review within five business days is approved automatically.
See what you owe
Every item your teams owe the consultant, with what is overdue.
Slack
Connect your workspace and your engagement gets a channel in it.
Frequently asked
Common questions.
- How do you work across time zones?
- Tell us your business hours when you scope the work. Every engagement is staffed to give you at least four hours of working overlap with them each day.
- Can you sign our audit opinion?
- No. We prepare organisations for assessment and support the audit; the opinion remains the responsibility of your licensed audit firm.
- What does it cost?
- Each catalogue service is priced in the written proposal you receive after scoping, before any work starts. Briefs and scoping requests are free and carry no obligation.