Orion Five EngineeringAssurance services
We provide internal audits and certification readiness for ISO/IEC 27001, ISO/IEC 42001 and SOC 2. Our lead auditors work on site with your team and audit your system the way a certification body would. They stay with you through the external audit.
Programmes
UNIT 01We prepare you for certification, but we do not grant it. An accredited certification body, which you choose and contract, issues ISO certificates. A licensed certified public accountant (CPA) firm issues System and Organization Controls 2 (SOC 2) reports. A certificate has value because the organisation that issues it is independent of the one that prepared you.
Information security management. We cover the scope, the risk assessment, the Statement of Applicability and the 93 Annex A controls, designed around how your organisation actually works. We then test the system as a certification auditor would, and help you close the gaps the test finds.
Outcome Certificate issued by your accredited certification body
AI management systems. We build an AI inventory, carry out AI risk and impact assessments, and set lifecycle and supplier controls for the models you build and the models you buy. We also build AI systems ourselves, so the people who write your controls know where AI systems fail.
Outcome Certificate issued by your accredited certification body
Trust Services Criteria readiness. We prepare you for a Type I or Type II examination. This covers the system boundary, control walkthroughs, evidence and a list of gaps against the criteria in scope. Only a licensed CPA firm can issue a SOC 2 report. We prepare you for the examination and work alongside the CPA firm.
Outcome Report issued by your independent CPA firm
To see how close you are to ISO/IEC 42001, run the readiness check before our first call.
How an engagement runs
UNIT 02Most clients start with the gap assessment. Some already have a management system in place and need only the internal audit. Others come to us after failing a Stage 1 audit. Each phase ends at a gate with a written result, so you know where you stand before you buy the next phase. How these phases map onto our four delivery stages.
We meet on site with the people who own the systems in scope. Together we agree the standard, the boundary of the management system and your target certification date.
Gate A written scope and a realistic certification date.
We check every clause and every applicable Annex A control or criterion against evidence of how it operates. Policy documents alone do not count as evidence. We grade each gap as an external auditor would.
Gate A ranked gap register. Each gap has an owner and a closing date.
We close the gaps on site with your team. This covers the risk assessment, the Statement of Applicability, the policies and, most importantly, the records that prove the controls operate. If a previous audit failed, or a system has drifted since certification, this phase brings it back into order.
Gate Every major gap closed and evidenced.
We carry out a full internal audit to ISO 19011, as clause 9.2 requires, followed by the management review that uses its results. The internal auditor is a lead auditor who did not build the controls under test.
Gate An internal audit report and a minuted management review.
We rehearse the external audit. We review your documentation as a Stage 1 auditor would, and run interviews and sampling as a Stage 2 auditor would. Your staff hear the questions before the auditor asks them.
Gate A written go or no-go decision for the booked audit date.
We work on site alongside your team for Stage 1 and Stage 2. Between the two stages, we turn the Stage 1 findings into a corrective-action plan and close it before Stage 2 begins.
Gate Stage 2 completed, with any findings answered within the certification body's deadline.
During the audit
UNIT 03Our lead auditors are trained to run certification audits, so they know how one works. On audit days they work on site with your team, from the opening meeting to the closing meeting.
Who delivers it
UNIT 04Implementers carry out most readiness work in this field. At Orion Five, lead auditors qualified through the BSI Training Academy do this work. They know what a certification auditor will sample and how auditors grade findings. The same people scope the work, carry it out and attend your audit.
These are personal qualifications, held by individual members of our practice. BSI does not endorse this service, and BSI's certification business has no role in it. Full credentials and biographies.
Personal qualifications of our lead auditors.
After certification
UNIT 05After certification, the certification body carries out a surveillance audit every year and a recertification audit in the third year. Your management system must keep running between these audits. We support that work in three ways.
The internal audit required in each surveillance year, carried out by a lead auditor who is independent of your day-to-day control owners.
The same preparation and on-site support for each annual surveillance audit and for the recertification audit in year three.
ISO/IEC 27001 and ISO/IEC 42001 set up as one management system, with the SOC 2 criteria mapped onto the same controls. One piece of evidence then serves all three.
Standards
UNIT 06These standards also set the rules that your certification body works under.
Requirements for an information security management system. Annex A lists 93 controls, which ISO/IEC 27002 explains.
Requirements for an AI management system. Singapore publishes it as SS ISO/IEC 42001:2024. The Singapore Accreditation Council has accredited certification bodies against it since February 2025.
The Trust Services Criteria used in a SOC 2 examination. They cover security, plus availability, processing integrity, confidentiality and privacy where these are in scope.
Guidelines for auditing management systems. Every internal audit we carry out follows this method.
The rules that certification bodies work under, including the rule that separates auditing from consulting. This is why we prepare you and a different organisation certifies you.
Where they apply to you, we map the Personal Data Protection Act (PDPA), the Model AI Governance Framework and AI Verify, and the Monetary Authority of Singapore (MAS) Technology Risk Management Guidelines onto the same controls.
Singapore grants for automation, AI and robotics projects are set out on our funding page, with links to each published scheme.
Further reading
UNIT 07
ISO/IEC 42001 certification is the only auditable, internationally recognised way to show that an organisation controls its AI. We explain what it proves and how it relates to the EU AI Act.
Assurance is evidence that a system does what it should and continues to do so after handover. Adding assurance to a system already in production costs materially more.
The 2026 Digital Omnibus delayed the EU AI Act's high-risk deadlines, but most duties that affect operators already apply. We set out every date and the Act's reach outside the EU.
