CASE STUDY
ÉTUDE DE CAS
How Carter Newell Lawyers unblocked 80% of revenue and streamlined 7 frameworks with Vanta
ISO 27001 and ISO 9001, ISO 42001, SOC 2, GDPR, CPS 234, Essential Eight
"You don't need to be a compliance expert to run Vanta, unlike other options. I don't want to be a compliance person, but I do need to maintain a compliant system."
TL;DR
- Challenge: Carter Newell's manual compliance processes couldn't scale to meet escalating client security needs, which were tied to about 80% of firm revenue.
- Solution: The firm consolidated ISO 27001, ISO 9001, ISO 42001, CPS 234, GDPR, Essential Eight and SOC 2 into Vanta, using the Vanta MCP alongside an internal AI system to rebuild their entire integrated management system.
- ROI: Carter Newell cut face-to-face audit time by 80%, completed a full IMS rebuild in a week and a half, and eliminated weeks of annual security questionnaire work. Now the firm can differentiate itself from other firms by being compliant across multiple frameworks, especially ISO 42001.
The company
An award-winning law firm protecting clients across insurance, litigation, and commercial law
Carter Newell Lawyers is an award-winning specialist law firm based in Brisbane, Australia, providing both commercial and corporate legal services nationally and internationally. The firm specializes in insurance across a wide range of industries, including aviation, healthcare, hospitality, and shipping.
The challenge
Compliance complexity threatened client retention and took months of staff time each year
With about 80% of revenue dependent on clients who required ISO 27001 or equivalent security compliance, falling short was a direct threat to Carter Newell’s business. However, security requirements were changing too fast for Carter Newell’s manual compliance processes to keep pace.
What Carter Newell tried first: Before Vanta, the firm ran ISO 27001 and ISO 9001 manually, which required building most of its policies and procedures from scratch and maintaining them by hand. And because policies and procedures weren't cleanly separated, auditors lost time assessing entire documents rather than just the parts relevant to the standard.
Carter Newell’s pivot point: The firm’s manual processes already struggled with ISO 27001 and ISO 9001 compliance, so when the team determined ISO 42001 compliance was next, they knew they needed a better approach.
Why Carter Newell chose Vanta: Carter Newell decided scalability needed to come first—they needed a platform an IT leader could operate without becoming a full-time compliance professional or needing to hire one.
Thanks to Vanta’s integrations, Carter Newell could integrate it across its tech stack to consolidate seven frameworks into a single platform. With an internal system working alongside Vanta’s MCP, they were even able to build their entire integrated management system—including MS, QMS, ISMS systems—from the ground up.
{{quote-2}}
The Vanta impact
From months of manual work to a week and a half
Today, Carter Newell Lawyers uses Vanta to build and maintain frameworks before clients formally require them. For example, the firm already has SOC 2 controls in place and monitored in Vanta, so if a client makes a Type II report a condition of doing business, Carter Newell can move straight to audit rather than starting a program from scratch.
Here’s how Carter Newell deployed Vanta:
The pace of Carter Newell’s work hasn’t slowed down: Just recently, the firm migrated to Vanta's Australian data center, meaning it can now meet CPS 234 data sovereignty requirements.
Looking ahead, the firm is also positioning itself to be one of the first smaller Australian law firms to achieve ISO 42001 certification for AI governance. With credentials like these, and the systems that now underpin them, Carter Newell can signal security maturity no matter how risk and regulations change in the future.
{{quote-3}}
