Four pillars, each delivered as a fixed-scope engagement with a fixed term including the ongoing ones. Every engagement below lists what it is for, roughly how long it runs, and exactly what you receive at the end of it.
Most businesses are being sold AI before anyone has worked out which problem it solves. The result is a pilot nobody owns and a subscription nobody cancels.
We start by finding out where AI actually helps and, just as importantly, where it does not. Then we build one system properly and measure it against your own data rather than a vendor benchmark. If the numbers do not hold up, we say so.
Evaluation scorecard
Delivered at the end of week two.
| Process | Effort | Impact | Verdict |
|---|---|---|---|
| Ticket triage | Low | High | Build first |
| Invoice coding | Medium | High | Build second |
| Contract review | High | Low | Do not build |
Illustrative format — not client data.
Work out which processes are worth automating with AI, and which are not, before committing to a build.
Put one AI-assisted process into production, with a way of telling whether it is working.
Work that runs on copy-paste, spreadsheets and reminder emails is slow, and it fails quietly. The cost rarely appears on a budget line, which is why it survives for years.
We map the process as it actually runs, not as the documentation claims, and put a time and cost figure against it. Then we automate the steps worth automating and leave the rest alone. Everything we build is documented so your team can change it without calling us back.
Process map
The workflow as it runs today, and what it becomes.
Today — 6 steps, 5 handoffs
Automated — 3 steps, exceptions only
Illustrative format — not client data.
Establish what a target workflow really costs today, and what could be removed from it.
Put the agreed automation into production and hand it over.
ISO 27001 usually arrives as a customer requirement with a deadline attached. The standard is not the hard part; keeping the business running while you meet it is.
We assess where you stand against the controls, then sequence the remediation so the work fits around delivery. We write the documentation with you rather than handing over a template pack, because your certification auditor will ask your team about it, not us. We prepare you for that audit; we do not conduct it.
Gap register
Mapped to Annex A, with an owner against every gap.
| Control | Description | Status |
|---|---|---|
| A.5.1 | Policies for information security | In place |
| A.5.15 | Access control | Partial |
| A.8.16 | Monitoring activities | Gap |
| A.5.19 | Supplier relationships | Gap |
Illustrative format — not client data.
Establish the real distance between where you are and a successful certification audit.
Close the gaps and take you through to a certification audit.
Systems decay quietly. An upstream field changes, a model starts drifting, an access review gets skipped for two quarters. Nobody notices until something fails in front of a customer or an auditor.
For the work we have delivered, we can keep watching it. Fixed term, fixed price, a named contact and a scheduled review at the end — not a retainer that renews while nobody looks at it. If a term ends and there is nothing useful left for us to do, we will say so.
Evidence calendar
Run on schedule, so the audit is not a scramble.
| Activity | Q1 | Q2 | Q3 | Q4 |
|---|---|---|---|---|
| Access review | Scheduled in Q1 | Scheduled in Q2 | Scheduled in Q3 | Scheduled in Q4 |
| Risk review | Scheduled in Q1 | Not scheduled in Q2 | Scheduled in Q3 | Not scheduled in Q4 |
| Supplier check | Not scheduled in Q1 | Scheduled in Q2 | Not scheduled in Q3 | Scheduled in Q4 |
| Internal audit | Not scheduled in Q1 | Not scheduled in Q2 | Scheduled in Q3 | Not scheduled in Q4 |
Illustrative format — not client data.
Keep automations and AI-assisted processes working as the systems around them change.
Keep an ISO 27001 management system running between certification audits, rather than rebuilding it each year.
Keep your onprem/cloud infrastructure patched, monitored and running, without carrying the overhead of a dedicated ops hire.
If yours is not here, ask it directly — we would rather answer it before you commit to anything.
Each engagement above is fixed scope, quoted as a fixed price after a scoping call. You get the figure before the work starts, and it does not move unless the scope does. We do not bill by the hour, because that charges you for our learning curve.
No. We work alongside your team and hand the work over to them. If an engagement finishes and nobody in your business can maintain what we built, we have failed regardless of whether the system works.
That is a reasonable position and often the correct one. The AI opportunity review exists partly to say no. If the honest answer is that a process should be simplified or automated conventionally rather than handed to a model, that is what the recommendation will say.
Yes. The gap assessment works just as well on a part-finished implementation, and it is usually faster because some of the evidence already exists. We will tell you what is reusable and what needs redoing.
No. We are based in Melbourne and work with businesses across Australia. Most delivery is remote, with on-site time where it genuinely helps, such as process mapping and audit preparation.
Small and mid-market Australian businesses, typically those large enough to feel the cost of manual process or a compliance requirement, but without a dedicated internal team to absorb it.
Most conversations start with a problem rather than a service. Describe what is going wrong and we will tell you which engagement fits, or whether none of them do.
Start a conversation