COMPLIANCE AND AUDIT READINESS
Prepare the evidence and people for your next assessment
Requests arrive in several systems. Control owners answer inconsistently. Findings lack a single action owner. We help coordinate the preparation and delivery work between your team and the independent auditor, certification body or assessor you engage.
Start with the assessment scope, its request list and the dates already agreed. We help turn those requirements into an organized work plan with named owners, evidence references and visible decisions.
Free 30-minute audit-coordination strategy call. No obligation.
01
EXPERTISE. LED BY TEMI.
Every engagement is led by Temi. Over two decades of security, audit and governance experience, applied to your business.
02
Agree the engagement boundary
Coordination organizes requests, owners, evidence and follow-through. It does not include an independent internal audit, technical control testing, an assurance report or certification. Your organization chooses the independent provider and approves its representations; that provider determines its examination and conclusions.
03
Define each role before the assessment begins
Readiness identifies gaps before an assessment. Coordination organizes requests, interviews, evidence and issue handling around the agreed assessment. An auditor or certification body performs its own examination and reaches its own conclusions.
The written scope names the frameworks, entities, assessment stages and participants. Your organization chooses and contracts with the external provider, owns its controls and approves its representations. That provider decides its assessment method, the evidence it needs and whether a finding can be closed.
For an internal audit, identify competent, objective reviewers and address any self-review risk before assigning the work. If we helped prepare the processes being examined, make that involvement visible when the audit role is agreed. This coordination service does not include an independent internal audit, technical control testing, an assurance report or certification.
04
Resolve the preparation gaps that can delay assessment work
The date is booked but the preparation plan is incomplete. Identify the assessment stages, current request list and decisions still outstanding. Separate a missing document from a control that has not operated or an audit activity that has not taken place.
One person owns both the process and most of the evidence. Name a backup for requests and interviews, identify the actual control owners, and make the auditor arrangement explicit. A request tracker does not resolve an auditor objectivity issue.
Several providers are involved. Agree who prepares information, who authorizes its release, who answers questions and who decides whether evidence is sufficient. Keep those responsibilities visible as the assessment changes.
05
Build an evidence inventory around the agreed assessment
| Evidence area | Coordination work | Decision owner |
|---|---|---|
| ISMS scope and management records | Link requests to current approved documents, owners and versions | Management approves its system and representations; the assessor evaluates them |
| Control applicability | Locate the current Statement of Applicability and identify missing ownership or explanation | The organization owns control selection and rationale; the assessor evaluates adequacy |
| Operating evidence | Identify requested records, time periods, systems and access dependencies | Control owners supply legitimate records; the assessor chooses and evaluates samples |
| Risk work | Connect relevant risk records and treatment actions to the request list | Management accepts risks and approves treatment decisions |
| Management review | Organize existing agendas, records, decisions and follow-up actions for the agreed request | Management performs the review and owns its decisions |
| Corrective actions | Track the finding, response owner, due date and submitted closure evidence | The assigned reviewer decides whether closure has been demonstrated |
Evidence is shared through authorized channels. A missing historical record remains a gap to explain and address; it is never recreated as though it existed at the time.
WHAT YOU GET
06
What you receive
| Deliverable | Contents | Use |
|---|---|---|
| Coordination plan | Milestones, responsibilities, communication authority and escalation points | Give participants one agreed preparation plan |
| Evidence request tracker | Request, scope, owner, period, version, status and reference | Keep submissions traceable to the request |
| Walkthrough preparation record | Actual process, owner explanation and unresolved evidence questions | Prepare accurate discussions with the assessor |
| Issue and response log | Issued finding, supporting facts, approved response and action owner | Track unresolved matters without changing the assessor's conclusion |
| Management status summary | Blockers, overdue items and decisions requiring attention | Help leadership act on delivery risks |
| Handoff archive | Final request status, evidence references and outstanding work | Preserve context for the next review |
These are coordination records. The independent assessor's report, findings classification, competence declarations and assurance conclusions remain the assessor's responsibility.
07
A coordination record you can follow
The following fictional example shows the level of ownership and traceability a request tracker can provide. It contains no customer information and is not an audit report.
| Request | Owner | Current status | Next action |
|---|---|---|---|
| Access review record for the agreed period | Access review owner | Record located; release approval pending | Confirm the approved version and authorized recipient |
| Response to an issued finding | Assigned action owner | Proposed action recorded; review outstanding | Submit the response through the agreed channel and retain the review decision |
A project tracker uses the fields, access controls and record locations agreed for your organization. This illustration does not promise a particular software platform or downloadable assessment report.
08
How the coordination work proceeds
- 01Agree responsibilities and milestones. Confirm the assessment boundary, provider, dates, request list and decision owners. Record any missing audit arrangement or independence concern for management to resolve.
- 02Organize evidence and conversations. Assign requests, check versions and periods, prepare control-owner walkthroughs, and flag gaps before a submission is made. Any system access follows the agreed permissions; coordination does not include live control testing.
- 03Track responses and decisions. Maintain request status and an issue log. Record the assessor's findings accurately, identify the people responsible for responses and escalate questions that need management approval.
- 04Hand over an accurate record. Consolidate evidence references, open actions and the latest review decisions. Keep an item open when closure has not been confirmed by the responsible reviewer. Agree any continued support separately in the written scope.
09
When coordination is useful
This service fits a team that has an assessor or assessment plan and needs a clear way to manage the work around it. Typical starting points include a first certification assessment, a recurring review, several entities sharing evidence, or more than one framework with overlapping requests.
Where ISO 27001 and ISO 42001 work run together, the coordination plan can distinguish shared records from framework-specific requests. Each management system still needs its own applicable scope, responsibilities and assessment decisions.
If you need someone to conduct the internal audit, test technical controls or issue a formal report, identify that provider before treating the coordination plan as complete.
10
Compare the responsibilities you need covered
| Decision | Your organization | Cyvelle coordination | Independent assessor |
|---|---|---|---|
| Who owns the system? | Owns controls, policies, risks and operational records | Tracks preparation responsibilities | Evaluates the agreed subject matter |
| Who chooses the audit approach? | Agrees the engagement and provides relevant context | Records scope and dependencies in the work plan | Defines its method, criteria and evidence requirements |
| Who obtains evidence? | Supplies accurate records and approves disclosure | Organizes requests and evidence references | Chooses samples and judges sufficiency |
| Who resolves a finding? | Implements and documents the agreed response | Tracks ownership, submissions and review status | Makes the applicable finding and closure decisions |
| Who sets fees and timing? | Approves the separate engagements | Confirms its coordination scope in writing | Confirms its own scope, fees and schedule |
The matrix describes responsibilities. It makes no claim about another provider's competence, service quality or price.
11
Confirm scope, fees and delivery before work starts
A useful scoping discussion covers the framework, entities and sites, assessment stages, target dates, expected request volume, control-owner availability and the support you need after the first handoff. It also identifies work outside coordination, including remediation implementation, audit fieldwork and certification-body services.
| Scope and fee | Your written proposal confirms the coordination activities, deliverables, schedule, communication authority, fees and any agreed follow-up. External assessment fees are separate. The delivery arrangement depends on evidence access, participant availability and any site-specific requirements. No fixed duration, audit frequency or remote-only delivery model is implied. |
|---|
12
Questions about coordination
Does coordination satisfy the internal audit requirement?
No. An internal audit is a separate activity with its own scope, criteria, competent reviewers, documented work and reported results. Coordination can organize the requests and records around it. It does not replace the audit or establish that the requirement has been met.
Can someone in our own team conduct the internal audit?
The arrangement must address competence, objectivity and the risk of reviewing one's own work. Your organization needs to establish an appropriate audit arrangement for its circumstances. Coordination can record the role and its dependencies; it does not qualify or approve the auditor.
What if Cyvelle helped prepare the ISMS?
Make that involvement explicit when assigning the audit work and resolve the self-review risk. This service coordinates preparation and evidence. It does not turn readiness work into an independent audit or provide a signed auditor independence opinion.
How often should we plan the work?
Start from your organization's audit programme and the assessment dates agreed with its providers. The coordination cadence follows those requirements, the volume of requests and the agreed scope. A recurring coordination engagement does not establish the required frequency or coverage of internal audits.
Can the plan cover ISO 27001 and ISO 42001 together?
The written scope can coordinate shared owners and evidence alongside the separate requests for each management system. It must name both frameworks and the relevant assessment stages. Integrated coordination does not include conducting either management system's internal audit.
What will we have at the end?
The agreed coordination records identify requests, evidence references, decisions and unresolved actions. The handoff shows what has been submitted and what still needs attention. The independent assessor supplies its own audit report and other formal assessment records.
How much does it cost?
The proposal confirms the fee for the coordination scope you agree. The number of entities, assessment stages, requests and follow-up needs affects that scope. Auditor and certification-body fees are separate; no public fixed coordination price is specified here.
Can the work be done remotely?
The delivery plan is agreed around permitted access, participant availability and the assessment requirements. Any on-site work and associated costs need to be stated in the proposal. Coordinating a remote walkthrough does not include technical testing or physical security inspection.
Will you choose the auditor for us?
Selection support is discussed within scope. Your organization contracts with the independent provider and retains its choice.
Will you create missing evidence?
We identify missing records and help plan legitimate remediation. We do not fabricate historical evidence or backdate operating records.
Do you respond directly to the assessor?
The agreement defines communication authority. External submissions and messages require explicit authorization; preparation alone does not grant it.
Does the service include remediation?
Remediation implementation is a separate activity unless included in the written scope. The coordination log records responsibility and closure evidence.
13
Bring order to the next assessment
Share the framework, provider request list and target dates. We will discuss the ownership and evidence work needing coordination and identify the decisions required before a work plan can be agreed.
Free 30-minute audit-coordination strategy call. No obligation.
14
Discuss your coordination scope
Use the booking page to discuss the assessment, the people involved and the support you need. If available times cannot be loaded, use the contact page to share your requirement and target date.
Free 30-minute audit-coordination strategy call. No obligation.
16
Scope and fee
Fixed fee confirmed after scoping.