01 / THE PATH

From deciding to certify to the surveillance audits.

The path follows the standard in the order a small firm meets it. Each step links to the register or document it needs, and says why it matters, what the auditor looks for and what done looks like. The plan is drawn back from your target certificate date, so each step has a date too.

STAGEWHAT YOU DOWHAT MANDATE KEEPSCLAUSES
GET SET UPAnswer the set-up questions about the businessThe answers that shape every suggestion afterNot audited
DECIDE WHAT'S COVEREDContext, interested parties, legal and contractual duties, scopeThe scope, sealed when an owner approves it4
PUT PEOPLE IN CHARGEPolicy, roles and what top management has doneA dated record of what top management actually did5
UNDERSTAND YOUR RISKSA risk method, your information assets, the risksEach risk with its owner and the residual they accepted6.1, 8.2
DECIDE YOUR CONTROLSTreat the risks, decide on every Annex A control, set objectivesThe Statement of Applicability, versioned and sealed6.1.3, 6.2
PUT THE CONTROLS TO WORKDocuments, owners, people, suppliers and the control calendarWho has read and confirmed each approved policy7, 8, Annex A
RUN ITDo the jobs on the calendar and record each runA sealed record of each run, and the month's completeness8
CHECK AND FIXMeasure, audit yourselves, hold a management review, correct what's foundResults, audits, reviews and corrective action9, 10
GET CERTIFIEDChoose a UKAS-accredited body, then Stage 1 and Stage 2The audit packs, the auditor's link, their findingsCertification
KEEP ITKeep it running between the yearly surveillance auditsThe same calendar and records, year after yearSurveillance

02 / REGISTERS

Every record the standard asks for, and a few an auditor will.

Each register has a guide that asks one question at a time and a plain form, both built from one definition, so they can't disagree. Suggested entries are drawn from your set-up answers and what's already in your other registers. Nothing's added until someone saves it.

  • Every entry keeps its history, and the attestations are an owner's to seal
  • Each register exports to Excel, Word and CSV
  • Every guide works with AI switched off
Where AI fits in
Mandate's registers, grouped by clause, each with the clauses and controls it serves.
Registers, grouped by clause

03 / DOCUMENTS

Bring the policies you already have.

Mandate holds your documents; it doesn't ask you to write them again. Import them, map them to the clauses and controls they cover, edit them in place, approve them and export them.

Only the named approver approves in their own name. Anyone else can record where and when that person approved it, and it says so.

ImportWord, Excel or PDF, one file or a whole folder
MapTo the clauses and controls each one covers
EditEditing the text withdraws the approval
ApproveBy the named approver, and sealed
ExportWord, print, or the original file
An imported policy in Mandate, with its approval, version, owner, approver and the controls it covers.
A policy, mapped and approved

04 / WHO DOES WHAT

Owners attest. Members do the work.

  • OwnersApprove documents and the Statement of Applicability, accept risks, approve suppliers, grant mandates and sign off changes. Each of those is sealed.
  • MembersKeep the registers, import documents and record the runs of control tasks.
  • Everyone elseGets a private link to read and confirm the policies that apply to them, with no account. A new version of a policy asks them again.
  • AuditorsGet one link that expires. What they raise goes into your registers as theirs.
  • LeaversAre switched off, not deleted, so their past acts stay on record. There's always at least one active owner.

05 / LIMITS

What it won't do.

  • It doesn't certify youA UKAS-accredited certification body does that. Readiness is a strict reading of your records, not a prediction of the audit result.
  • It doesn't count a plan as evidenceA decision, a plan or a method isn't a record that a control ran, however firmly it was signed.
  • It doesn't write your management system for youIt imports what you have and suggests entries from your own answers and registers. Every decision and approval is a person's.
  • It doesn't let AI approve anythingAI drafts and suggests where your organisation has it switched on. It never seals, approves or attests.

SEE THE PATH

See the whole path on a working example.

We'll take you through it on our demonstration organisation, and show you where your own documents would go.

Request a walkthrough