Independent assessment
When public evidence is not enough.
An independent assessment examines internal evidence with the cooperation of the organisation assessed, and ends in a report of findings with its scope and limitations stated. From $15,000, scoped and quoted by enquiry.
Who does the work
Engagements are led by TRUSTYCYBER and delivered with partner auditors trained on the same methodology. Independence and conflicts, including any previous involvement with the organisation, are checked before an engagement is accepted, and we decline or withdraw where they cannot be managed. The scope and criteria are set out in the engagement document before work begins.
Lead auditor credentials
Individual qualifications held by the TRUSTYCYBER lead auditor. They are not accreditations of TRUSTYCYBER, and JASANZ does not accredit or endorse TRUSTYCYBER or its engagements.
What it is not
Clear boundaries.
Not certification
Certification decisions are made by the relevant certification body, not TRUSTYCYBER. The ISO/IEC 27001 and 42001 work is internal audit.
Not a formal attestation opinion by default
A vendor review or AI assurance verification is not a formal attestation opinion unless an appropriate assurance standard is selected and applied for that engagement.
Vendor review
Review a supplier and the service it provides.
An independent review of a supplier and the specific service you rely on, scoped to the decision you need to support. Cyber security and responsible AI are covered where they are material to that decision. Assessing a vendor? Its AI Trust Report in the directory is free and may answer the question first.
Find its AI Trust ReportAt a glance
- Suits: onboarding, procurement, renewal, continued use, or a material supplier or model change
- Needs: vendor and service scope, intended use, business criticality and information sensitivity
- Report of findings: a review conclusion with traceable findings and open questions
AI assurance verification
Verify the assurance behind an AI system.
Tests whether the assurance supporting an AI system is current, scoped to the system actually in use, and supported by available evidence and configuration records. It applies to AI systems your organisation relies on, whether built, bought or embedded.
At a glance
- Suits: AI systems, agents, embedded SaaS AI, managed AI platforms and AI-enabled workflows
- Needs: a defined system, its assurance evidence, responsibility allocations and configuration records
- Report of findings: verification states, an evidence map and exceptions, for board, customer or procurement use
ISO/IEC 27001 internal audit
An internal audit, not certification.
An independent internal audit of your information security management system. It tests the Statement of Applicability, risk treatment and operating controls so your audit programme and certification preparation hold up to scrutiny.
At a glance
- Suits: organisations with an established ISMS preparing for internal audit, certification or management review
- Needs: ISMS scope, Statement of Applicability, risk treatment records and control operating evidence
- Report of findings: findings against clauses 4 to 10 and the Annex A controls applicable under your Statement of Applicability, with limitations and sequenced priorities
ISO/IEC 42001 internal audit
An internal audit, not certification.
An independent internal audit of your AI management system. It tests your AI system inventory, risk and impact assessments, human oversight and accountability so responsible-AI governance holds up to scrutiny.
At a glance
- Suits: organisations governing live AI systems that need assurance over risk, impact and oversight
- Needs: AIMS scope, AI system inventory, AI risk and impact assessments and control operating evidence
- Report of findings: findings against clauses 4 to 10 and the Annex A controls applicable under your Statement of Applicability, with limitations and sequenced priorities
How an assessment runs
From first conversation to report.
Evidence comes first and live interaction second. Questions, demonstrations and interviews focus on what the evidence has not resolved.
Tell us the decision, the scope and the timing. No evidence is needed at this stage.
We check independence and conflicts, then agree the criteria, the evidence needed and the price before work begins.
You share what already exists, once.
Questions, demonstrations and interviews focus only on what the evidence has not resolved.
You receive the report of findings, with its scope and limitations.
Talk to us
Tell us what you need to decide and by when. We reply to confirm whether we can take it on, before any evidence is shared.