Glossary · Testing and assessment
A readiness assessment is the rehearsal you run before the auditor arrives.
A review shortly before a formal audit that checks whether controls operate and evidence exists, so remaining problems surface while there is still time to fix them.
Back to the glossary01 · In plain words
In plain words
A review shortly before a formal audit that checks whether controls operate and evidence exists, so remaining problems surface while there is still time to fix them.
Someone walks your programme the way the auditor will. They sample evidence, interview control owners and test a few controls end to end. You get a list of what would fail today and what to fix first.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
A failed control during a SOC 2 examination becomes an exception in a report your customers read; a gap found in an ISO 27001 certification audit becomes a nonconformity you must close. Both are cheaper to find in rehearsal. A readiness assessment also settles practical questions: whether the scope is drawn sensibly, whether the evidence trail is complete for the period, and whether people can explain what they do. It cannot replace the audit, and the person who prepares you should not be the auditor who reports on you.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Project plan for a first audit
- The checkpoint between building controls and booking the auditor's fieldwork.
- Engagement letter with the auditor
- Some teams book the audit only after readiness shows the programme is ready.
- Board or leadership update
- A go or wait decision, with the open items listed.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a payroll software company before its first Type 1
A payroll platform has written policies and set up tools over several months. The readiness reviewer samples five joiners and finds two without signed acceptable-use acknowledgements, and an access review that was done but never recorded. Encryption, backups and change approvals hold up. The company fixes the two process gaps, keeps a dated record of the next access review, and books the auditor with a clear list of what will be shown on each control.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Gap assessment
- Usually earlier and broader: it compares where you are with what a framework expects. Readiness comes later and tests whether the built controls actually run.
- Internal audit
- A standing requirement of ISO 27001, run by someone independent of the work being audited, on a planned cycle. Readiness is a one-off preparation step.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Run it once controls have been operating long enough to leave evidence.
- Ask for findings ranked by audit impact, each with the evidence that would close it.
- Fix, then re-check the failed items rather than repeating the whole review.
- Keep the reviewer separate from the auditor who will issue the report.
- GuideThe readiness assessment, step by stepWhat it produces, what it doesn't, and how to use the result.
- GuideSOC 2 audit preparationThe auditor's request list, complete populations, and a dry run before fieldwork.
- GuideAn ISO 27001 implementation roadmapThe order of work from scope to certification audit.
Sources: AICPA guide to SOC 2 examinations and AT-C section 205 (on examination engagements and independence); ISO/IEC 27001:2022 clauses 9.2 and 10 (described, not quoted); ISO/IEC 17021-1 on certification audits.
Questions about Readiness assessment
Is a readiness assessment required?
No framework requires one.
Neither the AICPA nor ISO demands it. It is an optional step that teams use to avoid exceptions and nonconformities. Some audit firms offer a readiness phase themselves, which is fine as long as independence for the actual examination is preserved.
Does passing readiness guarantee a clean report?
No. It lowers the risk; it cannot remove it.
The auditor uses its own samples and judgement, and a Type 2 examination tests how controls ran across the whole period. Readiness tells you what would likely fail today; keeping controls running is still your job.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.