What your group owns online — and who holds it

In a group with several brands, several countries or several subsidiaries, the difficulties blamed on a website are rarely website problems. They are symptoms of one shortcoming: nobody holds the whole view of what exists, who answers for it, and what depends on what.

Why no one sees the whole

This is not negligence. It follows mechanically from the way suppliers are appointed: one site at a time, one discipline at a time. Each does their work properly within their remit, and no one’s remit covers the whole.

• The search agency sees pages and positions.
• The developer sees the content management system they installed.
• The host sees servers.
• The registrar sees domains.
• The security supplier sees vulnerabilities.
• The brand agency sees an identity.
• Head office sees invoices, and rarely the map of dependencies.

The result is predictable: a forgotten domain lapses, a migration erases years of accumulated standing, two entities compete for the same brand query, an out-of-date address or legal notice is repeated across twelve sites.

What a website audit cannot see

This is the distinction that matters, and it is a simple one:

• The flaws in a site — a title that runs too long, a missing description, a slow page, a certificate nearing expiry. Any competent supplier finds them, site by site.
• The mechanics of the whole — an inherited domain still redirecting to a competitor, a single platform nine sites depend on, a departed supplier who still holds access, two of the group’s brands competing against each other in the results. None of it shows up when you look at one site at a time, because none of it is a property of a site.

A group can have every one of its sites audited, act on every report, and leave the most expensive problem entirely intact.

Where to start — and where not to

The usual reaction is to launch rebuilds. It is the most expensive order to work in: you rebuild on ground you have no plan of, and the estate fragments again within two years.

• The register. Domains, subdomains, registrars, DNS, certificates, hosting, platforms, email dependencies, suppliers, privileged access, renewal dates.
• Who answers for what. An executive owner and an operational owner per asset, an escalation path, and what happens when something breaks.
• Identity. Which domain carries the parent company, which source is authoritative for corporate information, and where the brands, countries, commerce and specialist subsidiaries sit.
• The migration rules. Address mapping, redirects, preservation of certificates and email, transfer of analytics accounts, post-launch checking, retirement criteria.
• Shared controls. Supported versions, approved extensions, backups, release testing, and the same standard of evidence required of every supplier.

The rebuilds come afterwards, and they cost less, because you finally know what you are rebuilding.

What you are actually buying

• An authoritative view of what you own and of what is publicly attributed to you.
• Early warning when an asset changes, fails, leaks or degrades.
• A means of holding your suppliers to account — and your former suppliers.
• The preservation of accumulated standing through migrations.
• A single approved source for corporate, legal and commercial information.
• A legible architecture across parent company, brands, countries and networks.
• A repeatable way to launch, migrate and retire a site.

What we do with a serious finding

A serious exposure must not wait for the final presentation. We commit to a written protocol before we begin:

• Manual verification before any alert — no unchecked automated reporting.
• A named confidential recipient, known to both sides.
• Same-working-day notification for anything critical.
• No public disclosure, no exploitation, no intrusive testing.
• A documented procedure for preserving evidence.

In every finding we also separate what is confirmed, what is estimated and what remains unresolved, with what is needed to repeat the check. A finding that cannot be reproduced has no place in a report.