The Assurance Desk
What URM Consulting offers, and what it publishes
URM offers a virtual DPO who handles subject access requests, DPIAs, records of processing, breaches and dealings with the UK regulator, the ICO. Much of its work is security: it lists CREST accreditation, PCI DSS QSA status and BSI certification to ISO 27001 and ISO 22301. It says its team is 35+ strong.
URM Consulting does not publish a price. The virtual DPO page offers a free 30-minute consultation but no fees or rates. It does not publish professional indemnity cover or an ICO registration number. It names five consultants but lists their qualifications for the team as a whole, not person by person.
URM sells its own risk-management software, Abriska, and says it has been used in every ISO 27001 certification project its consultants have worked on, over 400. Its DPO page says there is no conflict of interest; the site does not say how it keeps software and advice apart. URM joined the Cooper Parry group on 1 October 2025.
Strengths
- 20-year operating history (incorporated 2005 as Ultima Risk Management) with a stated 35+ strong consultancy team
- Broad accreditation base: CREST-accredited, PCI DSS QSA company, BSI-certified for ISO 27001 and ISO 22301, Cyber Essentials Plus accredited
- Virtual DPO service explicitly states there is no conflict of interest between the DPO role and other business activities
- Joined the Cooper Parry professional services group in October 2025, adding wider audit/advisory backing
Things to check
- Sells its own Abriska risk-management software as part of its consultancy engagements
- Does not publish pricing
- No professional indemnity insurance disclosure found on the public site
Common questions
Does URM publish its DPO prices?
No. The virtual DPO page offers a free 30-minute consultation and a free compliance review, but states no fees, rates or worked examples.
Does URM sell its own software?
Yes. It sells Abriska, risk-management software with modules for ISO 27001, 22301, 27036, 31000 and 19011. URM says it has been used in every ISO 27001 certification project its consultants have worked on, over 400 at the last count.
How long has URM been operating?
Since 2005. It was incorporated that year as Ultima Risk Management and renamed in 2019. It joined the Cooper Parry professional services group on 1 October 2025.
Does URM disclose professional indemnity insurance?
No. We found no mention of professional indemnity cover on its About or virtual DPO pages.
Evidence for each URM Consulting score
Show our working
Notes behind each thing to check
- Sells its own Abriska risk-management software as part of its consultancy engagements (URM states Abriska has been 'used in every ISO 27001 certification project URM's consultants have been involved in', a commercial product tied to its own advisory recommendations (urmconsulting.com/products/abriska-27001, checked 2026-07-17).)
- Does not publish pricing (The Virtual DPO service page offers a free consultation but states no fees or rate card (urmconsulting.com/data-protection/gdpr/virtual-dpo, checked 2026-07-17).)
- No professional indemnity insurance disclosure found on the public site (PI insurance was not mentioned on the About page or Virtual DPO service page as checked (urmconsulting.com/about, checked 2026-07-17).)
| Criterion | Score | Evidence |
|---|---|---|
| Help when things go wrong | Virtual DPO page states support for 'managing personal data breaches' and 'dealing with...the ICO' but names no staff or outcomes for specific cases (urmconsulting.com/data-protection/gdpr/virtual-dpo). | |
| Qualifications of the people who do the work | About page names five consultants but attributes CISM/CISSP/CISA/lead-auditor qualifications to the team collectively rather than to each named person (urmconsulting.com/about). | |
| What it publishes about fees | No prices, rate card or worked examples appear on the Virtual DPO page or About page checked; only a free consultation is offered (urmconsulting.com/data-protection/gdpr/virtual-dpo). | |
| Knowledge of your sector | Only generic testimonials (an energy provider, a housing association) were found; no dedicated named sector-specialist staff or pages were located in the pages checked (urmconsulting.com/data-protection/gdpr/virtual-dpo). | |
| Independence from what it sells | URM sells Abriska software used in 'every ISO 27001 certification project' while separately claiming the DPO service avoids conflicts of interest, with no disclosed policy reconciling the two (urmconsulting.com/products/abriska-27001). | |
| Who carries the risk if the advice is wrong | No professional indemnity insurance or liability terms are disclosed on the About page or Virtual DPO service page checked (urmconsulting.com/about). |
Sources for URM Consulting
- Registered at Companies House as URM Consulting Services Ltd (Company number 05488337, incorporated 22 June 2005 (previous name Ultima Risk Management Limited, held until 15 August 2019), status: Active, registered office Sky View, Argosy Road, East Midlands Airport, Castle Donington, Derby, DE74 2SA) (Companies House, checked 17 July 2026)
- No firm-level ICO registration number found published (Not stated on the homepage, About page or Virtual DPO service page checked) (urmconsulting.com, checked 17 July 2026)
- Publishes a Virtual DPO service alongside a broad ISO/cyber security consultancy (Virtual DPO covers SARs, DPIAs, ROPAs, breach management, ICO liaison and annual GDPR audit; wider services cover ISO 27001/22301/42001, PCI DSS, penetration testing and Cyber Essentials certification) (urmconsulting.com, checked 17 July 2026)
- Does not publish pricing (Virtual DPO page offers a free 30-minute consultation and a free GDPR compliance review, but states no fees, rates or worked cost examples) (urmconsulting.com, checked 17 July 2026)
- Publishes team size and named consultants with team-wide credential list ('35+ strong team'; named consultants include Wayne Armstrong, Stuart Moran, Alastair Stewart, Neil Jones and Phillip Knight, with qualifications (CISM, CISSP, CISA, ISO 27001 Lead Auditor/Implementer, CREST Registered Tester, OSCP) listed for the team collectively rather than attributed individually) (urmconsulting.com, checked 17 July 2026)
- Sells its own risk-management software alongside advisory services (Abriska (modules for ISO 27001, 22301, 27036, 31000, 19011) is described as having been 'used in every ISO 27001 certification project URM's consultants have been involved in, with over 400 at the last count') (urmconsulting.com, checked 17 July 2026)
- Recently joined a larger professional services group (URM joined the Cooper Parry professional services group on 1 October 2025) (urmconsulting.com, checked 17 July 2026)
CREST-accredited penetration testing provider (stated on urmconsulting.com) PCI DSS Qualified Security Assessor (QSA) Company (stated on urmconsulting.com) BSI-certified for ISO 27001:2022 and ISO 22301:2019 (stated on urmconsulting.com/about) Cyber Essentials and Cyber Essentials Plus accredited; NCSC Cyber Advisor scheme participant (stated on urmconsulting.com/about) Consultant team holds CISM, CISSP, CISA, ISO 27001 Lead Auditor/Lead Implementer, CREST Registered Tester and OSCP qualifications collectively (stated on urmconsulting.com/about)
First DPO or AI policySeeking ISO 42001 certificationRegulated sectorsExposed to the EU AI ActAfter a ransomware or security incident
Where this firm appears
- Do you need a data protection officer?
- Can the firm that prepares you also certify you?
- Does the EU AI Act apply to a UK firm?
- Your sector adds its own rules to UK data protection law
- After a cyber attack: what to report, and to whom
- Compare providers
If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.
This is an independent editorial guide, not legal advice.