Govern
Management systems that hold up under audit. Evidence, not decks.
Govern is Aegentra’s governance, risk and compliance practice. We implement ISO/IEC 27001, ISO/IEC 42001 and ISO/IEC 27701 management systems and prepare organisations for SOC 2 examinations, with consultants based in Europe working remotely and on site in Germany. Every engagement starts with a written scope and a fixed fee.
Implementation services
Four ways Govern builds your evidence
ISO/IEC 27001
Information security management system: scope, risk assessment, Statement of Applicability, controls and evidence for an accredited certification body.
ISO/IEC 42001
AI management system: AI inventory, risk and impact assessment, controls and evidence for the AI you develop, provide or use.
ISO/IEC 27701
Privacy information management system: processing records, privacy risk, controller and processor controls, and evidence that supports GDPR accountability.
SOC 2
Readiness for a SOC 2 examination: service boundary, gap assessment against the Trust Services Criteria and an evidence pack for the CPA firm.
How an engagement runs
Named stages, one accountable scope
Scoping call
We start with the requirement in front of you: the customer request, regulation or certification goal, the entities and services involved, and your deadline.
Written scope and fixed fee
You receive a proposal that records deliverables, responsibilities, assumptions, exclusions and the fixed fee. Certification-body and CPA-firm fees are separate.
Build
We implement the agreed requirements with your team, starting from your context, risks and existing controls rather than a template pack.
Evidence
Controls are linked to the risks they treat and to records that show they operate, so an auditor can follow the reasoning.
Handover
We prepare management review and hand over an organised evidence pack to the independent certification body or CPA firm you appoint.
Independence
Implementation and internal audit are kept separate
The people who build a management system cannot credibly audit it. The internal audit that ISO management system standards require (Clause 9.2) must be objective and impartial, so the consultant who designed or implemented a system never audits it.
Where Aegentra implemented the system, a different competent Aegentra consultant who had no part in that work can perform the internal audit, after competence, prior involvement and conflicts of interest are documented and checked. If objectivity cannot be protected, a separate provider is required.
Certification is a third, separate step. An independent accredited certification body performs the certification audit and decides certification. Aegentra is not a certification body and does not issue certificates.
Related services
Assurance and security work alongside Govern
Internal audit
Independent internal audits against ISO/IEC 27001, ISO/IEC 42001, ISO/IEC 27701, ISO 9001 and ISO 45001.
Harden
Microsoft 365 security assessment, penetration testing, email security and data protection, with findings ranked by risk.
Planning a certification or answering a customer request?
Tell us the requirement, the scope and the deadline. We will tell you honestly what it takes.