Policies that are not applied
Documents exist, but ownership, review cycles and operational evidence are unclear.
ICT Advisory, Governance & Risk
Clear accountability. Better technology oversight.
Turn policies and risk registers into working controls. We help organisations improve ICT decision-making, service governance and readiness for assurance reviews.
The problems we help solve
When technology gets in the way.
A governance framework needs to work in everyday operations. Eltrovema helps you understand who approves technology changes, how risks are tracked, what evidence supports control effectiveness and how suppliers are held accountable. We tailor governance improvements to your organisation’s size, operating model and assurance needs.
Limited management visibility
Technology risks, incidents and supplier performance are difficult to present consistently to leadership.
Unprepared assurance reviews
Missing records and inconsistent controls create unnecessary pressure when evidence is requested.
What Eltrovema can doPractical capability.
Practical capability.
Clear deliverables.
Your solution is built around your systems, people and priorities. Explore the work we can scope for your organisation.
Request a tailored proposalGovernance & control assessments
Review decision structures, ICT responsibilities and existing controls. Identify practical gaps and develop a prioritised improvement programme.
Policies, standards & procedures
Develop and review policies for access, acceptable use, changes, assets, backup and security. Connect each document to an owner, approval process and implementation activity.
Technology risk management
Build a usable risk register with business impact, control actions, accountable owners and review dates. Help management track progress and accepted residual risk.
IT service management
Improve incident, problem, change and service-level management practices. Apply relevant ITIL principles in a way that fits your operating environment.
Framework & compliance readiness
Support readiness work against selected requirements and frameworks such as ISO 27001, COBIT and POPIA-related controls. This is advisory support, not certification or a legal opinion.
Vendor & resilience oversight
Review supplier dependencies, support commitments, continuity responsibilities and recovery governance. Define reporting that helps leadership make decisions.
The value for your organisationBetter technology.
01 02 03
Better technology.
A stronger way to operate.
Accountable decisions
Clarify who owns a service, accepts a risk and approves a change.
Evidence of progress
Track control improvements through records, review dates and measurable actions.
More useful management reporting
Connect technical issues to service performance, business impact and next steps.
Illustrative engagement
What this can look like in practice.
An organisation preparing for an ICT review may need access approval records, an updated asset register, a change process and evidence that restores are tested. We can help establish these working practices and organise the evidence. Management retains responsibility for policy approval, risk acceptance and compliance decisions.
How we work
A clear path from need to outcome.
Explore each stage to see what your engagement can look like.
Stage 01
Discover & prioritise
We review your environment, clarify business priorities and agree the scope, responsibilities and acceptance criteria.
What you can expect
- A governance and control gap assessment
- A prioritised risk and improvement register
Stage 02
Design & deliver
We develop the solution, coordinate dependencies and implement through planned changes, testing and communication.
What you can expect
- A prioritised risk and improvement register
- Selected policies, procedures or operating templates
Stage 03
Handover & improve
We document the environment, transfer knowledge and review service performance or improvement priorities under the agreed support scope.
What you can expect
- Selected policies, procedures or operating templates
- A review and reporting structure with named owners
Before we start
Your questions, answered.
We confirm the scope, commercial terms, responsibilities and service commitments before work begins.
Do you certify organisations against ISO 27001?
No. We can support assessments, control improvements and preparation for an independent certification process. Certification is performed by an appropriately accredited certification body.
Will we receive only policy documents?
The scope can include implementation guidance, templates, workshops and review routines. We focus on controls people can apply and evidence they can maintain.
Can the engagement be phased?
Yes. A baseline assessment can identify the highest-priority improvements, followed by separate phases for policy, process implementation and ongoing review.
Connect the bigger picture