Free readiness checklists

What a readiness score tells you, and what it does not

A self-assessment is a structured way of finding out what you do not have. It is not an audit and it produces no certificate: nobody has checked your answers, and the score reflects what you believe about your organisation rather than what an auditor would find in it.

That is still worth a great deal at the start. Most organisations beginning certification cannot say which clauses they already satisfy, and a score that separates the parts already in place from the parts that are not is the difference between a plan and a guess.

The three things people confuse

A self-assessment is you, scoring yourself, in minutes. A gap assessment is a consultant, working from your evidence rather than your answers, producing a plan with dates against it. A certification audit is an independent body deciding whether to issue a certificate, and it is the only one of the three that results in one.

They run in that order for a reason. Each one costs more than the last, and each is far cheaper when the one before it has already been done properly.

Why scores come back lower than people expect

Almost always for the same reason: the controls exist and the evidence does not. Access is approved by a manager, the firewall denies by default, visitors sign in — and none of it is written down, approved, dated and retained, so none of it can be shown to anybody.

That is encouraging rather than discouraging. Closing a documentation gap is a matter of weeks and costs little; closing a capability gap is a matter of budget. A low score made up of the first is a far better position than it feels like.

What a gap assessment adds