Fractional Leadership & GRC
When an organisation answers to several standards and obligations at once, the work is rarely the problem - coordination is. A Kellwick Fractional GRC Lead runs the agreed compliance workstreams across ISO 27001, ISO 9001, ISO 42001, DORA, NIS2 and customer requirements, follows up control owners and reports to management.
It sits between Managed ISMS, which keeps one ISO 27001 system running, and a vCISO, who provides senior security leadership.
Who it is for
The same supplier is assessed three times for three standards, and the same evidence is collected twice.
Findings from audits and reviews sit in different trackers with no one following them up.
Each surveillance audit starts a scramble because nobody tracked the calendar across standards.
Leadership hears about compliance when something fails, not as a regular report it can act on.
Workstreams
Agreed in the proposal. An engagement can start with a few of these and add more as the programme matures.
One list of what applies - standards, customer contract clauses, DORA or NIS2 requirements where relevant - with an owner and status for each.
Open actions chased with the people who own them, and escalated through management when they stall.
Supplier assessments scheduled, results collected and risks recorded, so supplier reviews happen before a customer asks for them.
Internal audit, surveillance and recertification dates for every standard on one calendar, with the evidence each needs prepared in time.
The programme planned and its audits scheduled. The audits themselves are performed by independent auditors, not by the GRC lead.
A monthly report: what moved, what is late, what needs a decision. Input to each standard's management review.
What you receive
What we need from you
Scope and pricing
The proposal lists the workstreams the GRC lead is responsible for. The price depends on:
Monthly retainer, up to three advisory days. Capacity is a guide, not unlimited work: an internal audit or a large supplier assessment round is scheduled across months or scoped separately.
Delivery
Boundaries
Auditors must remain independent of the activities they audit. Where Kellwick has supported implementation or ongoing management, any subsequent internal audit is subject to an independence and conflict-of-interest review. The assigned auditor must not have participated in the work being audited. Where sufficient objectivity and impartiality cannot be assured, Kellwick will decline the affected scope or recommend independent external assurance. The GRC lead plans and tracks the audit programme; independent auditors perform the audits and report to you directly.
Related services
Questions
A vCISO is a security leader: strategy, risk prioritisation, executive and board reporting. A GRC lead coordinates compliance workstreams across standards and obligations and reports to management. Many organisations need the second before - or instead of - the first.
Yes, at the coordination level: calendars, actions, management review input and audit readiness across both. Technical quality work is done by your quality team or through Managed QMS.
No. It plans and coordinates the programme. To keep audits objective and impartial, they are performed by auditors who are not involved in running the system.
Where they apply to you - directly, or through a regulated customer's contract - the GRC lead tracks the obligations and coordinates the work. Applicability is confirmed first, and legal interpretation stays with your counsel.
Tell us which standards and obligations you answer to and where the coordination breaks down. We will propose the workstreams and the capacity.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.