We prepare organizations for internal, external and certification audits by interpreting requirements, closing gaps and organizing the evidence auditors will expect to see.
Executive overview
Readiness assessments, gap analyses, evidence organization and remediation that prepare you for internal, external and certification audits.
Audits and certification assessments rarely fail on intent; they reveal gaps between what is required, what is practised and what can be evidenced. Preparing late concentrates effort on documentation at the expense of genuine implementation, and leaves nonconformities to be discovered by the auditor rather than addressed beforehand.
We assess readiness against the applicable standard or audit scope, including ISO/IEC 27001:2022 and ISO 28000:2022, build a prioritised remediation plan, organize evidence packs and conduct internal management system reviews before the external audit. We are not a certification body: certification audits are conducted by accredited certification bodies, which alone decide whether to grant certification. Our role is to prepare you to meet their requirements.
Business challenges addressed
- 01
Requirements open to interpretation
Standards describe what must be achieved, not how, leaving teams unsure what is sufficient for their context.
- 02
Evidence scattered across functions
Records exist in different systems and inboxes, making it hard to demonstrate that processes operate as described.
- 03
Compressed timelines
Customer, investor or regulatory deadlines leave little time to sequence remediation sensibly.
- 04
Management systems not yet operating
Policies are written, but internal audits, management reviews and corrective action cycles have not yet run.
Services and solutions
- 01
Readiness assessments
An assessment of your current position against the audit scope or standard, giving leadership a clear view of readiness and the effort required.
- 02
Compliance gap analysis
Requirement-by-requirement analysis of gaps between the standard, documented practice and observed practice, rated by significance.
- 03
Audit preparation
Preparation of teams and interviewees, audit logistics and mock interviews ahead of internal, external or certification audits.
- 04
Evidence and documentation organization
Structured evidence packs that link each requirement to the policies, records and control evidence demonstrating compliance.
- 05
Remediation action plans
A sequenced remediation plan with owners and deadlines, prioritising gaps likely to result in major nonconformities.
- 06
Internal management system reviews
Internal audits and support for management reviews that test whether the management system operates as intended before the external audit.
- 07
ISO/IEC 27001 readiness
Preparation for ISO/IEC 27001:2022 certification, from ISMS scope and risk treatment to the Statement of Applicability and Annex A controls, in coordination with our cybersecurity practice.
- 08
ISO 28000:2022 readiness
Preparation for ISO 28000:2022 certification of supply chain security management systems, covering security risk assessment, controls across the supply chain and management system requirements.
- 09
Other applicable certification frameworks
Readiness support for other management system standards or audit frameworks relevant to your sector, scoped after an initial review of requirements.
Typical engagement approach
- 01
Assess readiness
Confirm scope and standard, then perform the gap analysis and readiness assessment.
- 02
Plan remediation
Prioritise gaps, assign owners and align the remediation timeline with the target audit date.
- 03
Implement and evidence
Support implementation of corrective actions and organize evidence packs as processes start operating.
- 04
Review and prepare
Run internal audits and management reviews, prepare teams and support you through the external audit.
Expected deliverables
- Readiness assessment and compliance gap analysis
- Prioritised remediation action plan
- Structured evidence packs mapped to requirements
- Internal audit report and management review inputs
- Audit preparation briefings for teams and interviewees
- Post-audit corrective action plan for any findings
Outcomes you can target
- 01
A clear, shared view of readiness before committing to an audit date
- 02
Significant gaps addressed before the external auditor arrives
- 03
Evidence that is organized, traceable and easy to present
- 04
A management system your teams can sustain after the audit
Related expertise
More in Governance, Risk & Compliance
- Enterprise Risk ManagementRisk frameworks, risk mapping, registers and appetite statements that give leadership a shared, prioritised view of the risks that matter.
- Internal ControlAssessment, design and documentation of internal control frameworks built around key controls, named control owners and testable evidence.
- Organization & ProceduresOrganizational diagnostics, procedures, delegations of authority and governance structures that make roles, decisions and accountabilities explicit.
Frequently asked questions
Can you guarantee that we will be certified?
No. Certification audits are conducted by accredited certification bodies, which alone decide whether certification is granted. We are not a certification body. We prepare you so that your management system and evidence meet the requirements before that audit takes place.
What happens if the auditor raises nonconformities?
Nonconformities are a normal part of the audit process. We help you analyse root causes, define corrective actions and prepare the response within the timeframe set by the certification body.
Can you help us prepare for several standards at once?
Yes. Management system standards share a common structure, so documentation, internal audits and management reviews can often be integrated, for example across ISO/IEC 27001 and ISO 28000.
Talk to an expert about Audit & Certification Readiness
Tell us where you are today and what you need to achieve. We will propose the right scope for a first engagement.