David Clarke CITP FBCS CCISO

Most organisations buy a compliance automation platform expecting it to remove the pain of ISO 27001 or SOC 2.

And it does remove a lot of pain.

It collects evidence. Tracks tasks. Monitors controls. Keeps everything in one place.

But there is one thing the platform cannot automate: judgement.

A dashboard can show that evidence exists. It cannot explain why a risk matters, why a control was ​‌​‌​‌‌‌​‌​​‌‌​‌​​‌‌​​​‌​​‌‌‌​‌​​‌‌​​‌​‌​‌‌‌‌​​‌​‌​​‌​‌​​‌‌‌​​​​​‌​‌‌​‌​​‌​​​​‌‌​‌​​‌​​‌​​‌‌​‌‌​​‌​​‌​​‌​‌‌​‌‌​‌​‌​​‌‌‌​​‌‌‌​‌‌​​‌‌​​​‌​​‌​‌‌​​​​‌​​​​‌​​‌‌‌​​‌‌​‌‌​​​​‌​‌​‌​‌‌‌​‌​​​‌‌​​‌‌‌​‌​‌​‌​‌‌​​‌​​‌‌​​‌​​‌​‌​‌​‌​‌‌‌​‌​​​‌‌​​​‌‌​‌​​​‌‌‌​‌‌‌‌​​​​‌‌​‌​​​​‌‌​​‌​​​‌​​​‌‌‌​‌​‌‌​‌​​‌‌‌​‌‌​​‌‌​​​‌‌​‌‌​‌‌​‌​​‌‌​​​​​‌‌‌​‌​​​‌‌​​​‌‌​‌​​​‌‌‌​​‌‌‌​​‌​‌‌‌‌​‌​​‌‌​​‌​​​‌​​​​‌‌​​‌‌​​​‌​​‌‌​​‌​​‌​​‌‌​‌​‌​‌​​‌‌​‌​​‌​​‌​‌‌‌​​‌‌​‌​​‌​​‌​‌‌​‌‌​‌​​‌‌​‌​‌​‌‌‌​‌‌​​‌‌​​​‌​​‌‌​‌‌​‌​‌​​‌‌‌​​‌‌​‌‌​​​‌​​‌​​‌​‌‌​‌​‌​​‌‌​‌‌‌‌​‌‌​‌​​‌​‌​​‌‌​‌​‌​‌​‌​​​‌​‌​‌​‌​​‌‌​‌​‌​‌​​‌‌‌​​‌‌‌‌​‌​​‌​​​‌​‌​‌‌‌​‌‌‌​‌​‌‌​‌​​‌‌​‌‌​‌​‌​‌​​‌​​‌‌​‌​​​​‌​‌‌​​‌​‌‌‌‌​‌​​‌​​‌​​‌​‌‌‌​‌‌‌​‌​​‌‌​‌​‌​‌​‌​​​‌‌​‌​‌‌​‌‌‌‌​‌​​‌​​‌‌‌‌​‌​‌​​‌‌​‌​​‌​​‌​‌‌‌​​‌‌​‌​​‌​​‌​‌‌​‌‌‌​​‌​‌​​‌​​‌‌‌‌​‌​​‌​​‌​​‌​‌‌​‌​‌​​‌‌​‌‌‌‌​‌‌‌‌​​​​‌​​‌‌‌​​‌‌‌‌​‌​​‌‌​​‌‌‌​​‌‌​​‌​​‌​​‌‌‌‌​‌​‌​‌​​​‌‌​​​‌‌​‌‌‌​‌‌‌​‌​​‌‌​‌​‌‌​‌​‌​​‌​​​‌​‌​​‌‌​‌​‌​‌​​‌‌​​​‌​​​​‌‌​‌​​‌​‌​​​‌‌​​‌​​‌​​‌​​‌​‌‌​‌​‌​​‌‌​‌‌‌‌​‌‌‌‌​​​​‌‌​​‌‌​​‌​‌​​​‌​​‌‌‌​‌​​‌‌​​‌​‌​‌‌​​‌‌​​‌‌​​​‌​​​‌‌​‌‌​​​‌‌‌​​​​‌‌​​‌​​​​‌‌​​​​​​‌‌​‌​​​​‌‌​​​​​‌‌​​​‌​​​‌‌​‌‌‌​‌‌​​​‌​​‌‌​​‌​​​​‌‌​‌‌​​​‌‌​‌​‌​‌‌​​​‌‌​‌‌​​​​‌​‌‌​​​​‌​​‌‌​‌‌‌​​‌‌​​​​​‌‌​​​‌​​​‌‌​‌‌​​​‌‌​‌‌‌​‌‌​​‌​‌​​‌‌​‌‌‌​​‌‌​‌​​​‌‌​​‌‌​​​‌‌​‌‌‌​​‌‌​​‌​​‌‌​​​​‌​​‌‌‌​​​​‌‌​​‌​‌chosen, whether a policy reflects real working practice, or whether management can defend the system when questioned by an auditor or customer.

That is the gap we help close.

Our company works alongside your existing compliance platform to turn activity into a coherent, defensible management system:

Risk -> control -> policy -> evidence -> owner -> management sign-off.

We help organisations ​‌​‌​‌‌‌​‌​​‌‌​‌​​‌‌​​​‌​​‌‌‌​‌​​‌‌​​‌​‌​‌‌‌‌​​‌​‌​​‌​‌​​‌‌‌​​​​​‌​‌‌​‌​​‌​​​​‌‌​‌​​‌​​‌​​‌‌​‌‌​​‌​​‌​​‌​‌‌​‌‌​‌​‌​​‌‌‌​​‌‌‌​‌‌​​‌‌​​​‌​​‌​‌‌​​​​‌​​​​‌​​‌‌‌​​‌‌​‌‌​​​​‌​‌​‌​‌‌‌​‌​​​‌‌​​‌‌‌​‌​‌​‌​‌‌​​‌​​‌‌​​‌​​‌​‌​‌​‌​‌‌‌​‌​​​‌‌​​​‌‌​‌​​​‌‌‌​‌‌‌‌​​​​‌‌​‌​​​​‌‌​​‌​​​‌​​​‌‌‌​‌​‌‌​‌​​‌‌‌​‌‌​​‌‌​​​‌‌​‌‌​‌‌​‌​​‌‌​​​​​‌‌‌​‌​​​‌‌​​​‌‌​‌​​​‌‌‌​​‌‌‌​​‌​‌‌‌‌​‌​​‌‌​​‌​​​‌​​​​‌‌​​‌‌​​​‌​​‌‌​​‌​​‌​​‌‌​‌​‌​‌​​‌‌​‌​​‌​​‌​‌‌‌​​‌‌​‌​​‌​​‌​‌‌​‌‌​‌​​‌‌​‌​‌​‌‌‌​‌‌​​‌‌​​​‌​​‌‌​‌‌​‌​‌​​‌‌‌​​‌‌​‌‌​​​‌​​‌​​‌​‌‌​‌​‌​​‌‌​‌‌‌‌​‌‌​‌​​‌​‌​​‌‌​‌​‌​‌​‌​​​‌​‌​‌​‌​​‌‌​‌​‌​‌​​‌‌‌​​‌‌‌‌​‌​​‌​​​‌​‌​‌‌‌​‌‌‌​‌​‌‌​‌​​‌‌​‌‌​‌​‌​‌​​‌​​‌‌​‌​​​​‌​‌‌​​‌​‌‌‌‌​‌​​‌​​‌​​‌​‌‌‌​‌‌‌​‌​​‌‌​‌​‌​‌​‌​​​‌‌​‌​‌‌​‌‌‌‌​‌​​‌​​‌‌‌‌​‌​‌​​‌‌​‌​​‌​​‌​‌‌‌​​‌‌​‌​​‌​​‌​‌‌​‌‌‌​​‌​‌​​‌​​‌‌‌‌​‌​​‌​​‌​​‌​‌‌​‌​‌​​‌‌​‌‌‌‌​‌‌‌‌​​​​‌​​‌‌‌​​‌‌‌‌​‌​​‌‌​​‌‌‌​​‌‌​​‌​​‌​​‌‌‌‌​‌​‌​‌​​​‌‌​​​‌‌​‌‌‌​‌‌‌​‌​​‌‌​‌​‌‌​‌​‌​​‌​​​‌​‌​​‌‌​‌​‌​‌​​‌‌​​​‌​​​​‌‌​‌​​‌​‌​​​‌‌​​‌​​‌​​‌​​‌​‌‌​‌​‌​​‌‌​‌‌‌‌​‌‌‌‌​​​​‌‌​​‌‌​​‌​‌​​​‌​​‌‌‌​‌​​‌‌​​‌​‌​‌‌​​‌‌​​‌‌​​​‌​​​‌‌​‌‌​​​‌‌‌​​​​‌‌​​‌​​​​‌‌​​​​​​‌‌​‌​​​​‌‌​​​​​‌‌​​​‌​​​‌‌​‌‌‌​‌‌​​​‌​​‌‌​​‌​​​​‌‌​‌‌​​​‌‌​‌​‌​‌‌​​​‌‌​‌‌​​​​‌​‌‌​​​​‌​​‌‌​‌‌‌​​‌‌​​​​​‌‌​​​‌​​​‌‌​‌‌​​​‌‌​‌‌‌​‌‌​​‌​‌​​‌‌​‌‌‌​​‌‌​‌​​​‌‌​​‌‌​​​‌‌​‌‌‌​​‌‌​​‌​​‌‌​​​​‌​​‌‌‌​​​​‌‌​​‌​‌review their risk method, strengthen control mappings, refine the Statement of Applicability, tailor policies, remove ISO 27001 and SOC 2 duplication, clarify ownership, and prepare teams for audit conversations.

The point is not to replace the platform.

It is to make the platform more valuable.

Because compliance should not feel like a populated dashboard. It should feel like a business capability: ​‌​‌​‌‌‌​‌​​‌‌​‌​​‌‌​​​‌​​‌‌‌​‌​​‌‌​​‌​‌​‌‌‌‌​​‌​‌​​‌​‌​​‌‌‌​​​​​‌​‌‌​‌​​‌​​​​‌‌​‌​​‌​​‌​​‌‌​‌‌​​‌​​‌​​‌​‌‌​‌‌​‌​‌​​‌‌‌​​‌‌‌​‌‌​​‌‌​​​‌​​‌​‌‌​​​​‌​​​​‌​​‌‌‌​​‌‌​‌‌​​​​‌​‌​‌​‌‌‌​‌​​​‌‌​​‌‌‌​‌​‌​‌​‌‌​​‌​​‌‌​​‌​​‌​‌​‌​‌​‌‌‌​‌​​​‌‌​​​‌‌​‌​​​‌‌‌​‌‌‌‌​​​​‌‌​‌​​​​‌‌​​‌​​​‌​​​‌‌‌​‌​‌‌​‌​​‌‌‌​‌‌​​‌‌​​​‌‌​‌‌​‌‌​‌​​‌‌​​​​​‌‌‌​‌​​​‌‌​​​‌‌​‌​​​‌‌‌​​‌‌‌​​‌​‌‌‌‌​‌​​‌‌​​‌​​​‌​​​​‌‌​​‌‌​​​‌​​‌‌​​‌​​‌​​‌‌​‌​‌​‌​​‌‌​‌​​‌​​‌​‌‌‌​​‌‌​‌​​‌​​‌​‌‌​‌‌​‌​​‌‌​‌​‌​‌‌‌​‌‌​​‌‌​​​‌​​‌‌​‌‌​‌​‌​​‌‌‌​​‌‌​‌‌​​​‌​​‌​​‌​‌‌​‌​‌​​‌‌​‌‌‌‌​‌‌​‌​​‌​‌​​‌‌​‌​‌​‌​‌​​​‌​‌​‌​‌​​‌‌​‌​‌​‌​​‌‌‌​​‌‌‌‌​‌​​‌​​​‌​‌​‌‌‌​‌‌‌​‌​‌‌​‌​​‌‌​‌‌​‌​‌​‌​​‌​​‌‌​‌​​​​‌​‌‌​​‌​‌‌‌‌​‌​​‌​​‌​​‌​‌‌‌​‌‌‌​‌​​‌‌​‌​‌​‌​‌​​​‌‌​‌​‌‌​‌‌‌‌​‌​​‌​​‌‌‌‌​‌​‌​​‌‌​‌​​‌​​‌​‌‌‌​​‌‌​‌​​‌​​‌​‌‌​‌‌‌​​‌​‌​​‌​​‌‌‌‌​‌​​‌​​‌​​‌​‌‌​‌​‌​​‌‌​‌‌‌‌​‌‌‌‌​​​​‌​​‌‌‌​​‌‌‌‌​‌​​‌‌​​‌‌‌​​‌‌​​‌​​‌​​‌‌‌‌​‌​‌​‌​​​‌‌​​​‌‌​‌‌‌​‌‌‌​‌​​‌‌​‌​‌‌​‌​‌​​‌​​​‌​‌​​‌‌​‌​‌​‌​​‌‌​​​‌​​​​‌‌​‌​​‌​‌​​​‌‌​​‌​​‌​​‌​​‌​‌‌​‌​‌​​‌‌​‌‌‌‌​‌‌‌‌​​​​‌‌​​‌‌​​‌​‌​​​‌​​‌‌‌​‌​​‌‌​​‌​‌​‌‌​​‌‌​​‌‌​​​‌​​​‌‌​‌‌​​​‌‌‌​​​​‌‌​​‌​​​​‌‌​​​​​​‌‌​‌​​​​‌‌​​​​​‌‌​​​‌​​​‌‌​‌‌‌​‌‌​​​‌​​‌‌​​‌​​​​‌‌​‌‌​​​‌‌​‌​‌​‌‌​​​‌‌​‌‌​​​​‌​‌‌​​​​‌​​‌‌​‌‌‌​​‌‌​​​​​‌‌​​​‌​​​‌‌​‌‌​​​‌‌​‌‌‌​‌‌​​‌​‌​​‌‌​‌‌‌​​‌‌​‌​​​‌‌​​‌‌​​​‌‌​‌‌‌​​‌‌​​‌​​‌‌​​​​‌​​‌‌‌​​​​‌‌​​‌​‌easier audits, clearer risk decisions, stronger customer assurance, and a system people can actually explain.

If you have invested in a compliance automation platform but still feel the underlying model is unclear, we can provide a focused review of what is working, what is weak, and what should be fixed before the next audit.

Automation gives you the evidence.

We help make it defensible.

Question for DPOs, GDPR practitioners, lawyers and compliance teams.

Are you seeing more pressure to use AI on sensitive documents, while still needing to protect client identities, employee details, DSAR material, investigation records or confidential business information?

Three quick questions:

Are you currently avoiding AI for this kind of work because the disclosure risk feels too high?

Would a safer preparation step before using AI make a practical difference?

If you could test an early workflow for this, would you be willing to give blunt feedback?

Comment below or message me privately if this is a live problem for you.

Investors don’t only buy upside.

They buy a reduced chance of looking stupid later.

That’s where trust comes in.

I’m looking for AI, SaaS, cyber, data and privacy founders for a few “Investor Trust Readiness” podcast episodes.

We’ll talk about the questions buyers, investors and legal teams ask before they believe the deck.

DM me what you’re building.

@EnergyOmbudsman Hi any chance of a reply to emails please?

If you measure compliance by certificates held, you get a business full of certificates.

If you measure it by "can we prove we're in control right now" — you get a different business entirely.

Most boards are measuring the wrong thing.

And finding out too late.