The stages: definition of in-scope companies and processes, process mapping, risk and control assessments, issue/review of procedures, self-assessment to check that the controls are designed adequately and that they are effectively operational, independent tests, assessment of weaknesses and definition of action plans and attestations.