IT Risk

Technology risk has become business risk. A ransomware incident, a data breach or a day-long systems outage can now do more damage than most financial risks a board monitors far more closely — and insurers, customers and regulators increasingly demand evidence of control, not reassurance. UK GDPR breaches alone can attract fines of up to £17.5 million or 4% of worldwide turnover.

Our IT risk audits give CFOs, Finance Directors and boards an independent, plain-English assessment of where your technology risks actually sit, how far your current controls close them, and what to fix first — delivered by people with both deep technical knowledge and audit discipline.

Cyber Security Controls, Tested Against Recognised Frameworks

We assess your cyber defences against recognised frameworks, including Cyber Essentials — the UK government-backed certification scheme built around five core control themes: firewalls, secure configuration, security update management, user access control and malware protection. For many organisations, Cyber Essentials is now a commercial requirement as much as a security one: it is demanded in many public sector contracts and increasingly by insurers and large customers.

Our reviews test the controls that defeat the most common attacks: multi-factor authentication coverage, patching discipline, phishing resilience, backup integrity and administrator account control. Where you want certification, we assess your readiness and help you close the gaps before you apply.

Access Controls and Data Protection

Most breaches walk through the front door: an account that should have been closed, a permission nobody reviewed, a privileged login shared for convenience. We audit the full access lifecycle — joiners, movers and leavers, privileged access management, segregation of duties in key systems, and periodic access recertification.

On data protection, we assess UK GDPR compliance in practice: what personal data you hold and where, the lawful bases and retention rules applied to it, how it is secured in transit and at rest, and whether your breach response would meet the 72-hour reporting expectation if the worst happened.

Resilience, Continuity and Disaster Recovery

The question is not whether an incident will happen but whether the business keeps running when it does. We review business continuity and disaster recovery arrangements against how the business actually operates: which systems and data genuinely matter, how quickly they can be restored, whether backups are isolated from the networks an attacker would encrypt, and — critically — whether recovery has ever been tested rather than assumed. Untested recovery plans fail at the worst possible moment; we make sure yours is not one of them.

IT Governance and Third-Party Risk

Technology decisions should be governed like any other material investment. We assess whether IT strategy aligns with business strategy, whether boards receive meaningful technology risk reporting, and whether project governance catches failing initiatives early. Because most organisations now run on cloud platforms and outsourced providers, we also review third-party IT risk: due diligence, contractual security obligations, concentration risk and exit arrangements.

What You Get With Acumon

• Cyber security controls assessed against recognised frameworks, including Cyber Essentials
• Cyber Essentials and Cyber Essentials Plus readiness reviews
• Access lifecycle audits: joiners, movers, leavers and privileged accounts
• UK GDPR and data protection compliance assessed in practice, not just on paper
• Business continuity and disaster recovery reviewed — and tested, not assumed
• Third-party and cloud provider risk management reviews
• Plain-English board reporting with prioritised, costed recommendations

Why Acumon for IT Risk?

• Covers GDPR compliance assessment
• Cross-sector IT risk experience with deep technical and audit expertise
• Flexible engagement models with rapid project mobilisation

Get a Fixed-Fee Quote

Tell us what you need and we'll come back within one business day with a clear scope and a fixed price — no hourly-rate surprises. Call 020 8567 3451 or use the form and we'll be in touch.