Compliance by design.
Continuous assurance your business can rely on.
Risk X Data Assurance is Risk X Group's dedicated governance, risk and compliance practice. We assess, build and maintain the control environments that regulators, card brands, auditors and your customers expect, from PCI DSS and ISO/IEC 27001 to SOC 2 and AI governance.
Audit and advisory, across every framework you answer to
Each discipline is delivered through two separate practices. Our audit practice gives you independent assurance. Our advisory practice helps you design and implement the controls that assurance depends on.
Payment security
Payment card security is where Risk X built its reputation. We assess merchants, service providers, processors and banks against PCI Security Standards Council requirements, and we investigate when cardholder data may have been compromised.
Audit
PCI DSS assessments
Reports on Compliance and Attestations of Compliance, delivered by our Qualified Security Assessors.
PCI PIN assessments
Validation of PIN processing and key management against PCI PIN Security Requirements.
PCI P2PE assessments
Assessment of point-to-point encryption solutions, components and applications.
PCI forensic investigations
South Africa's only PCI Forensic Investigator company, ready to respond if you suspect a breach of payment data.
Advisory
Readiness and gap assessments
A clear view of where you stand before your formal assessment.
Scope reduction
Segmentation, tokenisation and architecture guidance that shrinks your cardholder data environment.
Remediation support
Hands-on help closing gaps across policy, process and technology.
PIN and P2PE advisory
Guidance on key management, HSM operations and encryption solution design.
Information security
ISO/IEC 27001 gives your customers and partners an internationally recognised signal that you manage information security systematically. We help you build an information security management system that works in practice, not just on paper.
Audit
Certification readiness assessments
An independent check of your ISMS against ISO/IEC 27001:2022 before your certification body arrives.
Internal audits
Clause 9.2 internal audits, delivered once-off or as a recurring service.
Supplier assessments
Evaluation of key suppliers against ISO/IEC 27001 controls.
Advisory
ISMS design and implementation
Scope, context, leadership, risk methodology and the full management system.
Risk assessment and Statement of Applicability
Risk treatment tied directly to Annex A controls.
Policies and procedures
Documentation written for your organisation, not a template.
2022 transition
Moving your existing ISMS onto the current version of the standard.
AI governance
Customers, regulators and procurement teams increasingly want evidence that AI is governed. We work with ISO/IEC 42001 for management-system governance, the CSA AI Controls Matrix (AICM) for technical and operational controls, and CSA TAISE for workforce competency.
Audit
AICM conformance and gap audit
An independent, scored assessment against the CSA AI Controls Matrix, scoped to your role in the AI value chain.
ISO/IEC 42001 readiness and internal audit
Pre-certification and recurring internal audits of your AI management system.
CSA STAR for AI assessment support
Preparation for assessment under the Cloud Security Alliance's STAR for AI programme.
AI vendor validation
Independent validation of suppliers' AI-CAIQ self-assessments for your due diligence.
Continuous monitoring and attestation
Quarterly or biannual reassessment with attestation letters.
Advisory
AI governance gap analysis
Benchmarking against AICM and ISO/IEC 42001, with a single-framework option for a first step.
AI management system design and build
Policies, governance committee, AI risk register and Annex A documentation.
AICM control implementation
Focused sprints on domains such as model security, data lifecycle and supply chain.
Safe AI deployment consulting
Pre-deployment risk assessment, human oversight design and a go or no-go recommendation.
TAISE upskilling and AI literacy
Credential preparation for your teams and briefings for boards and risk committees.
Managed AI governance retainer
Ongoing support as regulation such as the EU AI Act evolves.
Certification pathway. For ISO/IEC 42001 certification, Risk X prepares you and runs your readiness and internal audits. The accredited certification audit and certificate are delivered by our accredited certification body partner.
Service assurance
SOC 2 is increasingly a condition of doing business with North American and global customers. We prepare service organisations for a successful examination against the AICPA Trust Services Criteria.
Audit
SOC 2 readiness assessments
Independent testing of control design against the Trust Services Criteria you plan to report on.
Pre-examination control testing
A dry run of operating effectiveness before your Type 2 period begins.
Advisory
Scoping and criteria selection
Choosing the right systems, boundaries and Trust Services Criteria.
Control design and implementation
Building controls that satisfy SOC 2 and your other frameworks at the same time.
Evidence programme
Processes that make evidence collection routine rather than a scramble.
Reporting. SOC 2 reports are issued by licensed CPA firms. Risk X prepares you for that examination and can coordinate with your chosen auditor.
Data protection
The Protection of Personal Information Act places clear accountability on every organisation that processes personal information in South Africa. We help you meet those obligations and show that you have.
Audit
POPIA compliance assessments
An independent view of your compliance with the conditions for lawful processing.
Operator and supplier reviews
Assessment of third parties that process personal information on your behalf.
Advisory
Privacy programme design
Roles, policies, records of processing and data subject request handling.
Personal information impact assessments
Identifying and treating privacy risk in new systems and processes.
Automated decision-making
Aligning AI and automated processing with POPIA requirements.
We help you build it. We assure it independently.
Our audit and advisory practices operate under a formal independence policy, so you can work with one partner across your compliance journey without compromising the objectivity of your assurance.
A 12-month separation
We do not audit any scope we have advised on within the previous 12 months.
Named independence sign-off
Every audit engagement is approved by an independence officer before it begins.
Senior-led assurance
Audit opinions are signed off by lead auditors and principal consultants.
How an engagement runs
Whether you start with a gap analysis or go straight to a formal assessment, the path is the same.
Scope
Agree what is in scope, which frameworks apply and what evidence you need.
Assess
Establish your current state against each requirement.
Remediate
Close gaps with our advisory team or your own.
Validate
Independent assessment, attestation or certification readiness.
Maintain
Continuous monitoring and internal audit to keep compliance current.
Where we work
Based in South Africa, delivering engagements across the United Kingdom, Europe and southern and West Africa.
- South AfricaHead office
- United Kingdom
- Europe
- Ghana
- Namibia
- Botswana
- Lesotho
- Eswatini
Part of Risk X Group
When your compliance programme needs technical validation or round-the-clock monitoring, our sister divisions work alongside us.
