Professional and financial services

For professional services firms the two obligations that matter are information security and credible ESG disclosure, and both are driven by clients rather than regulators. Law firms, accountancy practices, consultancies and financial advisers are asked to complete client security questionnaires, evidence ISO 27001 or Cyber Essentials, and publish a sustainability position that withstands scrutiny.

ISO 27001 satisfies most of those questionnaires. Its value is that it is risk-based: you define the scope, assess the risks that actually apply to your client data and cloud estate, and select controls that address them. Implementation is mostly disciplined documentation and behaviour — access reviews, supplier assessment, incident response rehearsal and homeworking rules — rather than heavy technology spend.

ESG reporting for a services firm is usually a first-time exercise, and the material topics are rarely the ones a manufacturing template suggests. Scope 3 sits in purchased services, cloud hosting, business travel and commuting. Social disclosure sits in workforce composition, training and supply chain labour practices. Governance sits in board oversight and how sustainability decisions are actually made.

The common failure is a report written without a data owner behind it. Once a client or lender asks for methodology, the position has to be defensible, which means recognised quantification and retained evidence.

Typical timelines: five to seven months for a first ISO 27001 certification; six to ten weeks for a first ESG report where activity data already exists.