Compliance

Compliance & Audit Readiness

We work on the technical foundations an auditor can verify: documentation, controls and recovery evidence. Readiness and remediation are technical work; the judgement in an audit belongs to auditors and legal advisers.

What SETORD can assess

SETORD reviews the operational and control side of your estate that an audit typically relies on. This is technical readiness work, not a legal opinion.

• • Documentation and control ownership
• • Asset and inventory visibility
• • Access control and privileged access
• • Offboarding control
• • Backup and restore evidence
• • Recovery testing
• • Logging and retention
• • Change and process evidence

Typical control gaps we find

Most gaps are operational rather than exotic. A few examples of what we find in a typical estate:

• • No up-to-date inventory of servers, services and access
• • Shared or broadly privileged accounts without oversight
• • Access not revoked promptly when someone leaves
• • Backups exist but restores are never tested
• • Logs are collected but not retained to policy
• • Changes happen without records an auditor can follow
• • No named owner for important controls
• • Evidence for an audit would take days to assemble

What evidence should exist

An auditor checks records, not verbal explanations. The estate should be able to show, simply and repeatably:

• • An inventory of systems and what runs on them
• • Who has access, and at what level
• • How privileged access is controlled
• • That backups run and restores have been proven
• • That recovery has been tested
• • How changes are requested, reviewed and applied
• • Retention policy for logs and records
• • Evidence of security monitoring

How remediation works

We close technical gaps step by step and leave written evidence behind, so the next assessment is faster and cheaper.

• • Prioritise by risk and effort
• • Fix the control, not just the symptom
• • Document the new steady state
• • Support you in preparing evidence for an audit

What belongs to customer management

Compliance in a business is a management responsibility. Decisions on policy, ownership of controls and internal procedures remain with you; we implement and document the technical side.

What belongs to auditors and legal advisers

Certification, the scope of an audit and its final conclusion belong to the auditor. Legal and regulatory interpretation is the domain of legal advisers. SETORD provides the technical groundwork and evidence they review.

What SETORD explicitly does not certify

SETORD does not certify compliance, does not issue certificates and does not guarantee a specific audit outcome. We make the estate ready to be assessed and keep it that way.

Audit readiness means the controls and evidence are in place and demonstrable. It is not a certification and carries no automatic compliance status.