Your internal audit function is institutionally prevented from finding what's actually broken — finding it creates political problems inside the organisation. The auditor doesn't have that constraint.
By the time sampling expands into a Major Nonconformity, your name is already on the report.
Currency: GBP only
Details: Sort code and account number sent on invoice, emailed within 2 hours of submission.
Reference: Your invoice number — generated on submission below.
Payment is received into an associate account on behalf of this practice. For split payment: first instalment confirms your engagement. Report released on second payment confirmation.
Two documents govern this engagement. Read both. Acceptance is required to proceed.
This Agreement is between Brian Colborne, operating as ISMS Premortem through Audit Premortem Ltd ("Operator"), and the individual or organisation completing this intake form ("Client").
All information exchanged under this engagement — including the Client's identity, the existence of this engagement, all ISMS documentation, audit evidence, risk registers, internal reports, supplier lists, findings, and the Operator's methodology, analysis framework, and pricing — is Confidential Information under this Agreement.
The Operator will not disclose the Client's identity, organisation, ISMS weaknesses, or diagnostic findings to any third party under any circumstances. The Operator will retain no copies of any Client documentation beyond the engagement. All Client files will be permanently deleted within 24 hours of confirmed report delivery. Deletion confirmation is sent by email.
The Client will not disclose the Operator's methodology, the Collapse Vector framework, diagnostic findings, or the Operator's identity or pricing to any third party without prior written consent.
Client documentation is received via an access-controlled file transfer environment. No third parties have access. Files are stored only for the duration of analysis. Permanent deletion occurs within 24 hours of confirmed report delivery. No backups are retained. The Client is advised to download the report immediately on receipt — the Operator is not responsible for files inaccessible after the deletion window has passed.
This Agreement remains in effect for two years from engagement completion. Governed by the laws of England and Wales.
Independent forensic diagnostic analysis of the Client's ISMS using the proprietary 24-vector Collapse Vector methodology. Deliverable is a written Diagnostic Report identifying broken processes and the evidence-chain failures behind them, with binary verdicts per vector, and personal liability exposure mapped under DORA Article 5 and NIS2 Article 20.
This is an independent advisory diagnostic. It is not a formal ISO 27001 audit and does not constitute certification body activity. The Operator does not hold ISO 27001 auditor certification or certification body affiliation. The Report identifies where governance, evidence, or process is broken and what surrounding territory requires examination — it does not constitute remediation, remediation planning, or legal advice, and does not guarantee any audit outcome. This Report is prepared solely for the Client's internal use and is not to be submitted to, or relied upon by, any certification body, regulator, insurer, or third party as evidence of compliance.
The intake submission and first payment confirm the Client's commission. The engagement itself — and the delivery clock — begins only once the Operator has reviewed the Client's uploaded evidence and confirmed the documentation set is sufficient to proceed. The Operator will notify the Client when the engagement is formally initiated.
First instalment (£8,000) confirms the engagement and is due prior to evidence review. Second instalment invoice (£8,000) is issued on report completion. The report is released on confirmed receipt of second instalment. Total: £16,000.
Single payment of £14,400 prior to evidence review.
7 working days from formal engagement initiation, as defined above. Timeline may extend with notification if the evidence set requires clarification mid-engagement.
All Client files are permanently deleted within 24 hours of confirmed report delivery. No copies are retained by the Operator beyond that window. The Client must download the report before deletion. Deletion confirmation is sent by email.
Total liability of the Operator under this engagement, however arising, is capped at the total fees paid by the Client. The Operator accepts no liability for indirect or consequential loss. The service is accepted on an advisory basis only, and the Client retains sole responsibility for interpreting findings and for any decisions made on the basis of the Report.
England and Wales.
Use an address you can access privately — not your work email if that creates a record.
Treated as Confidential Information under the NDA from the moment submitted.
Generated on submission. Quote in all correspondence.
Twenty years finding what breaks before reality does. QA and deployment engineering background — trained to break systems under production conditions with personal accountability for the outcome. The Collapse Vector methodology maps the statistically predictable points where surveillance auditors find systemic failure, and the broken processes behind them.
No certification body affiliations. No remediation services to sell. Pattern recognition, applied to governance — in writing.
"Your Name Is On The Report" — available on Amazon.
Engagements conducted personally. Capacity limited to four per month.
Invoice with bank details will arrive at the email address provided within 2 hours.
Quote this reference in all correspondence.
[email protected] · All communications confidential.
ismspremortem.com · Brian Colborne · Audit Premortem Ltd · Governed by English law · Advisory findings only