First-time certification
You have implemented the system, with or without a consultant, and want certainty before the certification body arrives.
The service
Not a gap analysis. A rehearsal.
A gap analysis belongs at the start of an implementation: a document-led review that tells you what to build. A readiness audit belongs at the end: a full simulation of the certification audit itself, with your people interviewed, your evidence sampled and your controls tested exactly as the certification body will do it. The difference matters, because most certification-audit surprises are not missing documents. They are answers people give under questioning, evidence that cannot be found on the day, and controls that exist on paper but not in practice.
We audit ISO/IEC 27001, ISO/IEC 42001 and ISO 22301 readiness, for both Stage 1 (documentation and readiness review) and Stage 2 (the management system in operation).
Deliverables
What an engagement includes
- D1A full mock auditOpening meeting, interviews, evidence sampling, control testing and closing meeting, run to the same plan a certification body would use for your size and scope.
- D2Findings graded the way they will beMajor nonconformities, minor nonconformities and opportunities for improvement, classified as a certification body would classify them, so you know exactly what would have blocked certification.
- D3A corrective action planEvery finding paired with a practical fix, an owner and a date, sequenced so the blocking items close first.
- D4Verification before the real auditWe re-check closed findings so you walk into the certification audit with evidence, not intentions.
- D5A prepared teamYour people experience real audit questioning before it counts. Auditees who have rehearsed answer honestly and confidently instead of guessing at what the auditor wants.
Who this is for
Three situations we see most
Transitioning versions
Standards get revised and certificates must transition. A readiness audit confirms your updated system meets the new requirements before the transition audit.
After a rocky audit
If the last certification or surveillance visit produced findings, a rehearsal proves the fixes hold before the next one.
Independence, always: we only audit. If a consultancy implemented your system, that is no obstacle; what we will never do is audit a system we had any hand in ourselves.
FAQ
Fair questions, straight answers
When should we schedule a readiness audit?
Six to ten weeks before the certification audit. That leaves enough time to close findings properly and verify the fixes, without leaving so much time that the system drifts before the real visit.
Do you guarantee we will pass?
No, and nobody honestly can: the certification decision belongs to the certification body's independent decision-maker. What a readiness audit removes is surprise. If something would have failed you, you will hear it from us first, while it is still fixable quietly.
How is this different from the internal audit the standard requires?
The internal audit is a compliance obligation under Clause 9.2 and part of your ongoing management system. A readiness audit is a one-off rehearsal of the certification audit itself. Many organisations combine them: a readiness audit can be scoped so it also satisfies the internal audit requirement. Ask us at scoping.