What your group owns online, and who holds it

Why each one sees a part

It follows mechanically from the way suppliers are appointed: one site at a time, one discipline at a time. Each does their work properly within their remit, and the whole falls between the remits.

• The search agency sees pages and positions.
• The developer sees the content management system they installed.
• The host sees servers.
• The registrar sees domains.
• The security supplier sees vulnerabilities.
• The brand agency sees an identity.
• Head office sees invoices, and rarely the map of dependencies.

The result is predictable: a forgotten domain lapses, a migration erases years of accumulated standing, two entities compete for the same brand query, an out-of-date address or legal notice is repeated across twelve sites.

What escapes a website audit

Two levels of problem coexist:

• The flaws in a site: a title that runs too long, a missing description, a slow page, a certificate nearing expiry. Any competent supplier finds them, site by site.
• The mechanics of the whole: an inherited domain still redirecting to a competitor, a single platform nine sites depend on, a departed supplier who still holds access, two of the group’s brands competing against each other in the results. These mechanics appear only when you look at all the sites together: they belong to the estate.

A group can have every one of its sites audited, act on every report, and leave the most expensive problem entirely intact.

Auditing twelve sites one by one and auditing the estate of twelve are two separate jobs.

Where to start, and in what order

The usual reaction is to launch rebuilds. It is the most expensive order to work in: you rebuild before the ground has been mapped, and the estate fragments again within two years. The order that holds starts elsewhere:

• The register. Domains, subdomains, registrars, DNS, certificates, hosting, platforms, email dependencies, suppliers, privileged access, renewal dates.
• Who answers for what. An executive owner and an operational owner per asset, an escalation path, and what happens when something breaks.
• Identity. Which domain carries the parent company, which source is authoritative for corporate information, and where the brands, countries, commerce and specialist subsidiaries sit.
• The migration rules. Address mapping, redirects, preservation of certificates and email, transfer of analytics accounts, post-launch checking, retirement criteria.
• Shared controls. Supported versions, approved extensions, backups, release testing, and the same standard of evidence required of every supplier.

The rebuilds come afterwards, and they cost less, because you finally know what you are rebuilding.

What you are actually buying

• An authoritative view of what you own and of what is publicly attributed to you.
• Early warning when an asset changes, fails, leaks or degrades.
• A means of holding your suppliers to account, former suppliers included.
• The preservation of accumulated standing through migrations.
• A single approved source for corporate, legal and commercial information.
• A legible architecture across parent company, brands, countries and networks.
• A repeatable way to launch, migrate and retire a site.

What we do with a serious finding

A serious exposure is reported straight away, ahead of the final presentation. We commit to a written protocol before we begin:

• Manual verification before any alert: a person checks every report.
• A named confidential recipient, known to both sides.
• Same-working-day notification for anything critical.
• Disclosure to the named recipient only, and passive observation only: findings stay confidential, systems stay untouched.
• A documented procedure for preserving evidence.

In every finding we also separate what is confirmed, what is estimated and what remains open, with what is needed to repeat the check. A report keeps only findings that can be reproduced.