Readiness assessment
Understand your current certification readiness before entering the formal audit process.
The business problem
Entering a certification audit without knowing where you stand is an expensive way to find out. Major nonconformities at Stage 2 delay certification by months, consume the audit budget twice, and damage credibility with the customers who asked for the certificate in the first place.
The failure points are rarely exotic. A scope that cannot be defended, a Statement of Applicability that contradicts the risk treatment plan, documentation that describes a process nobody follows, and controls with no record proving they operated - these account for the majority of findings.
A FaizZab readiness assessment tells you, with evidence rather than opinion, which of those conditions apply to you and what has to change before the certification body arrives.
Service scope
The assessment is evidence-led. Each area is tested against records and interviews, and rated on how it would be viewed in a formal certification audit.
Stress-test the declared scope against the real technology estate, locations, people and outsourced services. Scope statements that quietly exclude in-scope systems are a common source of major findings.
Assess management-system clauses 4 to 10 individually - context, leadership, planning, support, operation, performance evaluation and improvement - and rate each on demonstrable conformity.
Review the applicable Annex A controls for implementation status and operating maturity, distinguishing controls that are designed, controls that are running, and controls that exist only on paper.
Reconcile the Statement of Applicability against the risk assessment, risk treatment plan and observed control reality. Internal contradictions here are among the fastest ways to lose auditor confidence.
Test whether documented information is present, current, approved, version-controlled and consistent with practice - and whether it would satisfy an auditor asking how a process actually runs.
Sample real records the way an auditor would: pick controls, request the evidence, and assess whether it can be produced within the audit window and whether it proves what it claims.
Evaluate whether the internal audit programme is risk-based, competently staffed, genuinely independent, documented in working papers, and capable of finding real issues.
Check that management review covers the required inputs, produces recorded decisions and demonstrates leadership engagement rather than a signature on a template.
Test the nonconformity process end to end: are findings recorded, is root cause reached, are actions closed, and is effectiveness verified?
Classify every finding by the likely audit consequence - major nonconformity, minor nonconformity, or observation - so effort goes where it changes the certification outcome.
Sequence remediation into a dated plan with owners and dependencies, showing what must close before Stage 1, before Stage 2, and what can follow certification.
Methodology
Agree the assessment boundary and issue a structured request for the ISMS documentation and control evidence set.
Analyse policies, risk artefacts, the SoA and records against clause and Annex A expectations before any interview takes place.
Walk through how each significant control actually runs with the people who run it, rather than with the person who wrote the policy.
Request and test real records under audit-like conditions to establish whether evidence can be produced on demand.
Score each area, classify gaps by likely audit consequence, and identify the small number of issues that carry the most certification risk.
Present findings to leadership and hand over a dated 30/60/90-day remediation roadmap with owners.
What you receive
Outcome
Understand the gaps before formal assessment begins.
Commercial value
Major nonconformities restart the clock and the cost. Finding them beforehand is materially cheaper than finding them in front of an auditor.
Teams cannot audit their own work objectively. An external benchmark gives leadership a defensible basis for the go/no-go decision.
Not every gap matters equally. Prioritization by audit consequence stops teams spending months on findings that would never have been raised.
Questions
Duration depends on scope size, number of locations and the state of the evidence set. The assessment is scoped after an initial discussion so the effort matches the estate rather than a fixed template.
The assessment itself is deliberately independent and diagnostic. Remediation can be delivered separately through our ISO 27001 implementation service if you want support closing the gaps.
No. An internal audit is a required part of your management system and tests conformity against your own ISMS. A readiness assessment benchmarks you against what a certification body is likely to conclude, and prioritizes gaps by audit consequence.
Related
End-to-end implementation of an ISO/IEC 27001:2022 Information Security Management System - governance, risk methodology, Statement of Applicability, controls, evidence and the internal audit and management review cycle that keeps it alive.
Explore this serviceInternal audit programme design and delivery - audit universe and planning, fieldwork, evidence, findings, corrective action and reporting, for management systems and business processes.
Explore this serviceAn evidence-based review of your privacy management system against ISO/IEC 27701:2025 - PIMS boundary, accountability, transparency evidence, controller/processor obligation mapping, rights-handling records and a PIMS assurance heatmap.
Explore this serviceIndependent IT audit covering IT general controls, access controls, change management and IT operations, with structured evidence testing, findings and tracked remediation.
Explore this serviceImportant
Readiness/advisory support only. FaizZab does not issue ISO certification. Certification decisions rest solely with an independent, accredited certification body, and a readiness assessment does not guarantee a certification outcome.
Tell us your obligation, your timeline and where you are today. We will confirm whether this is the right engagement for you.