Certification & Audit Readiness

A customer just made the certificate a condition of the contract.

Certification has quietly become a revenue gate. No certificate, no contract, no tender — and increasingly no place on a larger company’s supplier list, because their own obligations now flow down to you. Non the less the requirement arrives with a hard deadline as well.

So someone buys a policy template pack, and it describes a company that does not look like yours does. Auditors interview staff; a system nobody follows fails at Stage 2, or survives as an annual emergency that costs the same every year and protects nothing. The certification body quoted for the audit only. The consultant quoted for "an ISMS" with no end date, but the two stories never meet this way.

And if your ISO 27001 certificate is still on the 2013 edition, it expired in October 2025 — which means you are uncertified while believing you are certified.

In seven steps, through fourteen to eighteen weeks.

1. Intake Duration: One week, starting with a hour long meeting. We start with a sponsor kick-off, to get the requirements confirmed, and start collecting data based on that.
2. Readiness assessment Duration: One to two weeks. We rate collected data against every requirement and control of the chosen standard, triggering questionnaire or supplier audit.
3. Scope Statement Duration: One meeting for one and a half hours. During this session we sit together with all relevant stakeholders to agree on the final scope based on the requirements. The scope clears what gaps and processes we are going to work with, and agree on the deadlines to keep. From this point on, the scope changes only through written orders.
4. Risk and control design Duration: Four weeks. During these four weeks we create a risk register, put together the Statement of Applicability (or equivalent control set) with a responsibility matrix, and an inventory of the security requierments that you need to pass on to your suppliers.
5. Control embedding and evidence Duration: Four to six weeks. Mapping controls into your policies and processes as actionable steps together with owners and responsibles. Throughout this phase, our main aim is to understand the reasons behind the current ways of working and determine how the required controls can support them rather than simply adding another layer of process.
6. Internal audit Duration: Two weeks. We audit you to the same method the certification body will use, and use the findings to prepare corrective actions to bridge any gaps uncovered.
7. Management review and hand-over Presentation of the findings, the indexed evidence pack and a written verdict whether you are ready for Stage 1.

• Entry — certification readiness assessment This package includes a gap analysis against the standard, or questionaire chosen, that is preceeded by a scope workshop. As an outcome, you will receive the full results of the analysis, a meeting on which we will discuss the findings, and explain a potential timeplan for reaching audit readiness.
• Standard — built to readiness Everything on this page, up to and including the internal audit and management review.
• Premium Everything that is in standard, plus implementation support for the remediations for the items uncovered by the readiness assessment, and our presence at the certification audit with nonconformity responses.
• Custom Where more than on standards need to be addressed in one programme, or for companies with multi-site scopes, or involved in regulated-product development, or require assistance during their audit examination.