Don't guess your audit readiness. Validate it internally first.

If you fix all critical findings: ~95% pass rate. Internal audit simulates external audit methodology. If you pass internal audit and address findings, you should pass external audit. Rare reasons for external audit issues after clean internal audit: new issues emerged between audits, remediation not fully effective, external auditor interprets requirements differently (unusual but possible), evidence deteriorates or goes missing. We provide audit readiness verdict: 'ready' vs. 'not ready' vs. 'ready with minor fixes.'

Not recommended. Internal audit validates completed implementation. If still implementing: many controls not yet operational, evidence collection incomplete, team not prepared, findings obvious (everything is a gap). Better to complete implementation, then validate through internal audit. Exception: Phased audits (audit completed sections while others still in progress).

Yes, comprehensive audit reports including: executive summary, detailed findings by control, evidence of findings, severity classification, remediation recommendations. Report format similar to external audit findings reports, so your team understands what external audit findings would look like.

Honest conversation about options: Option 1: Postpone external audit until fixed (typical 6-8 weeks). Option 2: Accept risk and proceed (not recommended for critical issues). Option 3: Reduce certification scope temporarily (if applicable). Internal audit purpose is finding issues early when you have time to fix them, not during external audit when options are limited.

Yes, common and efficient: ISO 27001 + SOC 2 (significant overlap in security controls), ISO 27001 + ISO 27701 (privacy builds on security), ISO 27001 + ISO 22301 (business continuity overlaps with security). Combined audits are more efficient than separate audits. We test overlapping controls once, saving time and cost.

Recommended timing: ISO 27001: 6-8 weeks before engaging certification body. SOC 2 Type I: 4-6 weeks before audit. SOC 2 Type II: At end of operating period (before readiness review). ISO 22301: 6-8 weeks before certification. Regulatory readiness: 2-3 months before expected inspection. Allows time for remediation without rushing.

Yes, several models: Annual internal audit: Single comprehensive audit per year (meets ISO 27001 requirement). Quarterly internal audits: Different focus areas each quarter, rotating through controls. Surveillance audit preparation: Before annual surveillance audits (post-certification). Ad hoc audits: Specific areas or frameworks as needed. Some organizations use us as outsourced internal audit function for compliance frameworks.

We discuss and resolve: present evidence and rationale for finding, hear your perspective and additional context, revise finding if we missed information, document disagreement if perspectives differ. Internal audit purpose is improvement, not punishment. Open dialogue is encouraged. If we have differing interpretations of requirements, we document both perspectives and let you decide how to proceed. External auditor will ultimately be arbiter during certification audit.