Certifications & standards

Standards we are audited against

Three management system standards govern how Innate handles client information, how work is reviewed before it is issued, and what happens when a managed service fails. Each one is a set of obligations the firm is audited against, not a badge.

Certified management systems

01

ISO/IEC 27001:2022

ISO/IEC 27001:2022Information Security Management

Governs how client data is classified, stored, accessed and disposed of, and how security risk is assessed on every engagement.

What it governs in practice

  • Client information is classified on receipt, and the classification determines who may access it, where it may be stored and how long it is retained.
  • Access to engagement systems is granted by role and withdrawn when a person leaves the engagement, not when they leave the firm.
  • Every engagement carries a documented risk assessment covering the data it touches, with treatment decisions recorded and reviewed.
  • Security incidents follow a defined reporting, containment and notification path, including notification to the client.
02

ISO 9001:2015

ISO 9001:2015Quality Management

Defines the delivery process, review gates and corrective action loop behind every deliverable Innate signs off.

What it governs in practice

  • Deliverables pass defined review gates before issue, with the reviewer distinct from the preparer.
  • Scope, assumptions and acceptance criteria are agreed and recorded at the outset, and changes to them are recorded as changes.
  • Non-conformities and client complaints trigger a corrective action loop with a root cause and a verified fix.
  • Supplier and subcontractor work is assessed against the same criteria as work produced in-house.
03

ISO/IEC 20000-1:2018

ISO/IEC 20000-1:2018IT Service Management

Sets the incident, change and service level framework used on managed IT and support engagements.

What it governs in practice

  • Managed services run to agreed service levels, with performance reported to the client on a fixed cycle.
  • Incidents are logged, prioritised and escalated against defined response and resolution targets.
  • Changes to production systems follow an approval, testing and rollback procedure rather than direct intervention.
  • Continuity and capacity requirements are agreed with the client and tested rather than assumed.

Assurance

Why this matters on a procurement

Public bodies and regulated institutions are required to evidence how a supplier handles their data and how service failures are managed. Certification against these standards means those controls exist as documented, audited procedure rather than as assurances given at bid stage.

It also constrains our own advisory work. Where we advise a client on an information security or service management framework, we are recommending controls we operate and are assessed on ourselves.

Certificate numbers, issuing bodies and validity dates can be supplied on request for due diligence and tender documentation.

Need certification evidence for a tender

Tell us what your procurement team requires and we will confirm what can be provided and in what form.

Request documentation