Audit readiness is the one thing every business preparing for an audit claims to be measuring and almost none of them measure honestly. The usual method is a spreadsheet of requirements with a red, amber or green cell against each, filled in by the person who owns the requirement, which reliably produces a wall of green and a surprised face on audit day. There is a better test, and it is brutally simple: can somebody who does not work here be handed the evidence for a requirement and follow it to a conclusion without asking you a question? If not, that requirement is not ready, whatever colour the cell is.
Why self-assessed readiness is nearly always wrong
The person who owns a requirement knows where the evidence is, knows the story that connects the parts, and fills the gaps from memory without noticing they are gaps. An auditor has none of that. So a self-assessment measures the owner's confidence, which is not the thing under test. The fix is not more honesty, it is a different question. Instead of asking whether the requirement is met, ask which document proves it, where that document lives, and whether the date on it falls inside the audit period. Those three answers either exist or they do not, and nobody can shade them green.
The four states a requirement can be in
Evidence exists and is filed where the auditor will be shown it. Evidence exists somewhere but nobody can produce it in the room, which is the same as not existing. Evidence exists but is out of date, unsigned or unapproved, which is worse than nothing because it demonstrates that the control lapsed. And no evidence at all, which is the only honest gap. Sorting a scope into those four buckets takes an afternoon and gives a readiness picture that survives contact with an auditor, because it is the same picture the auditor is going to build.
Readiness is a date problem before it is a content problem
Most requirements a business fails are not requirements it does not understand. They are requirements it satisfied in a burst before the last audit and then stopped satisfying. Reviews with a stated frequency that were not done. Training that expired. A procedure last approved three years ago describing a process that changed. Sorting your evidence by its own date, oldest first, finds more real gaps in an hour than a content review finds in a week, and it is the same sort an auditor does when they ask for the register of controlled documents.
Turning a readiness gap into a plan with hours on it
A readiness gap is only useful once it has an owner, a date and an estimate. The estimate is the part that gets skipped and the part that decides whether the audit date holds. Counting the evidence items still to gather, multiplying by a realistic time to find and file one, and dividing across the people who actually own those records gives hours per person per week between now and the audit. If that number is larger than the time those people have, the date is wrong, and you have found that out while it can still be moved.
Questions people ask about audit readiness
What does audit readiness mean in practice?
That every requirement in scope has evidence, that the evidence is current and approved, and that somebody other than its owner can find and follow it. Anything short of all three is preparation still in progress.
How long before the audit should readiness work start?
Work back from the volume of evidence rather than picking a number of weeks. A scope with a few dozen requirements and three evidence items each is a few working days spread across owners; a large scope with a single coordinator is months.
Is a readiness assessment the same as a pre-audit?
No. A pre-audit is a rehearsal run by an auditor against the full standard. A readiness assessment is your own inventory of evidence and dates, and it should happen first, because paying an auditor to discover that your training records are missing is expensive.
Can we be ready without having done an internal audit?
Rarely, and for schemes that require internal audits the missing internal audit is itself the finding. The internal audit is also the cheapest way to discover that a control is documented but not followed, which is the finding nobody sees coming.