ISO/IEC 27001:2022 & ISO/IEC 42001:2023

Governance you can prove, not just promise

Policies, procedures, controls and evidence — designed as one connected management system, not a collection of documents.

Multibiz helps organisations design, review and improve ISMS and AIMS governance, risk treatment, Statements of Applicability, audit readiness and continual improvement — so your operation meets today's requirements and is ready for what's next.

Audit & Assuranceevidence you can stand behind
Design & Documentationpolicies people can follow
Coaching & Improvementcapability that continues
Talk to Jeff → Explore our services →
Governance services built around your organisation
Audit AIMS & ISMS SoA Planning Risk Treatment Policies & Procedures Continual Improvement
Your governance journey
01

Know where you stand

Audit & assurance

02

Build what is missing

Design & documentation

03

Embed it with your people

Coaching & improvement

ISO/IEC 27001:2022 audit scope

Four control themes. One integrated review.

We review the whole operating environment — not only technology — so the controls reflect how your organisation actually works.

Organisational

Roles, policies and accountability.

People

Screening, awareness and behaviour.

Physical

Sites, equipment and access.

Technology

Systems, identity and protection.

Plus assets and asset valuation — included as part of the integrated ISMS review.
Our services

Seven services. One accountable partner.

From first audit to embedded continual improvement, grouped into three stages of the journey.

Stage 1 — Audit & Assurance

Find out exactly where you stand.

Evidence first. We review your current controls, risks and operating practices before recommending change.

01

ISO 42001 & 27001 audits

A clear, independent view of conformity, evidence gaps and priority actions.

AIMSISMSAudit
What you receive
  • ✓ A defensible evidence position
  • ✓ Prioritised gaps and risks
  • ✓ A practical treatment roadmap
02

Compliance, risk assessment & treatment

Risk decisions connected to business context — not a generic checklist.

RiskTreatmentCompliance
Executives reviewing security and compliance evidence together
Stage 2 — Design & Documentation

Turn findings into a system people can use.

We work beside your team to design the management system, documentation and control logic around the organisation you actually run.

03

AIMS & ISMS creation

Architecture, scope, roles and operating model.

AIMSISMS
04

Statement of Applicability

Every control connected to a documented reason.

SoAControls
05

Policies & procedures

Clear operational documents staff can follow.

PoliciesProcedures

Designed with your staff — not handed over as a folder of templates.

Workshops connect governance requirements with real roles, workflows, systems and decisions. That's what turns documentation into an operating capability.

Connected outputs
  • Governance
  • Risk treatment
  • Evidence
  • Improvement
Stage 3 — Coaching & Continual Improvement

Build capability that continues.

Compliance should live in everyday decisions, not appear once a year before an audit.

06

Audit team coaching & mentoring

Practical coaching for auditors, implementers and risk owners.

CoachingMentoring
07

Continual improvement plans

A living review cycle that keeps your AIMS and ISMS aligned as technology, regulation and business priorities change.

Continual ImprovementAIMSISMS
Jeff Neale presenting a resilient-organisation framework to a leadership team
How it works

From first conversation to embedded practice.

One accountable partner across audit, design, documentation, coaching and continual improvement.

Talk to Jeff → Explore services →
Common questions

Frequently asked questions.

Straight answers to the questions we hear most before an engagement starts.

What's the difference between ISO/IEC 27001:2022 and ISO/IEC 42001:2023?
ISO/IEC 27001:2022 governs your Information Security Management System (ISMS) — how you protect information across people, process and technology. ISO/IEC 42001:2023 governs your AI Management System (AIMS) — how you manage the safety, security and governance of AI specifically. Many of our clients need both, since AI systems still run on top of the same information security foundation.
Do we need both standards, or just one?
It depends on whether AI is already part of your operations. If you're deploying or planning to deploy AI, ISO/IEC 42001:2023 is worth pursuing alongside ISO/IEC 27001:2022 — it's designed to sit on top of, not replace, your information security work. We'll help you work out what's actually relevant during the audit stage, rather than selling you both by default.
How long does an ISO/IEC 27001:2022 audit take?
It varies with the size and complexity of your operation, but most engagements move through the audit stage in a matter of weeks, not months. We'll give you a specific timeline once we understand your scope in an initial conversation.
What is a Statement of Applicability (SoA)?
The SoA is the document that lists every control in the ISO/IEC 27001:2022 framework and states whether it applies to your organisation, and why. It's one of the most scrutinised documents in a certification audit, which is why we treat it as its own dedicated service rather than an afterthought.
Can you help maintain certification, not just achieve it?
Yes — that's what our Continual Improvement Plans and Audit Team Coaching services are built for. Certification is a point-in-time achievement; staying certified means your team needs to keep the system alive year-round, which is where ongoing coaching and mentoring makes the difference.
Let's talk

Turn ISO certification into a documented, defensible advantage.

A 30-minute conversation with a specialist — not a salesperson — mapped to audit, documentation and ongoing governance.

✓ A clear read on where your ISMS and AIMS stand today
✓ Straight answers on ISO 27001:2022 & ISO 42001:2023 requirements
✓ A realistic next step, whether that's certification or just a tidy-up

3 + 13 =