Meridian GRC Consulting

Meridian GRC Consulting is a UK governance, risk and compliance (GRC) consultancy that helps organizations build information security and compliance programs that stand up to audit. The company is registered in England and Wales and is led by Director Marty Carter, an information security consultant and ISO/IEC 27001, 27701, and 42001 lead auditor.

Who they serve

The firm works with growing and mid-sized businesses in technology, SaaS, professional services and regulated industries. Many of its clients have no dedicated security leader, and it supports both organizations preparing for their first certification or audit and those improving or expanding an existing security and compliance program.

Standards and services

- ISO 27001 (information security), ISO 27701 (privacy information management) and ISO 42001 (AI management systems)

- Alignment with other frameworks and regulations, including SOC 2, PCI DSS, NIST, GDPR, the EU AI Act, NIS 2 and DORA

- Governance: ISMS design and implementation, policies and procedures, governance frameworks, and internal audit and management review support

- Risk: risk assessments aligned to ISO 27001, risk registers and reporting, treatment plans and ongoing risk oversight

- Compliance: control implementation, audit readiness, support during auditor engagement and ongoing compliance management

How they work

Meridian GRC Consulting says it does not start from templates. It first learns how a client operates, then designs governance, risk and control systems that fit existing workflows and can grow with the business. Services can be bought separately or combined through five engagement models: Control Architecture, Regulatory Alignment, Dual-Framework Certification, Operational Governance and Organisational Change. Work is planned around the client's priorities, schedule and budget, and the firm publishes indicative starting prices for each service area.

What makes them distinct

The firm gives equal weight to implementation and assurance, so that controls are effective, measurable and defensible to auditors. Its director is a Drata Technical Certified practitioner with experience in SOC 2 Type 2 readiness for SaaS organizations and in dual ISO 27001 and ISO 42001 certification programs, which suits businesses adding AI governance to an existing security program.