Certification readiness: documents to prepare
Certification readiness is the internal work completed before a certification body opens a file: evidence gathering, gap closure and internal sign-off. It is not the audit itself. Four stages recur across most schemes: scoping, evidence assembly, internal review and the readiness decision. Skipping a stage does not save time — it moves the delay into the audit.
What changes once preparation starts
Once a business commits to a readiness date, the file becomes the reference point for every later decision. Auditors compare what was promised at scoping against what the evidence bundle actually shows. A gap discovered during the audit costs more time than the same gap found during internal review, because the audit clock has already started and cannot be paused to fix paperwork.
The point of no return is the readiness sign-off, not the audit booking. After sign-off, most schemes treat a withdrawn or materially changed file as a new submission, with a new queue position and a new fee cycle where one applies.
Stages, documents and timing
| Stage | Core document | Typical duration |
|---|---|---|
| Scoping | Scope statement, asset inventory | 1–3 weeks |
| Evidence assembly | Policy set, control logs, training records | 3–8 weeks |
| Internal review | Gap register, remediation log | 1–4 weeks |
| Readiness decision | Sign-off memo | 1 meeting |
Duration varies with the number of systems in scope and how many people hold evidence-producing roles. A single-system file with one owner tends to sit at the shorter end of each range.
Documents to prepare
- Scope statement naming the systems, data categories and locations covered.
- Asset and processing inventory, kept current up to the readiness date.
- Policy set: access control, incident handling, retention, and supplier oversight.
- Control logs showing the policies were applied, not only written.
- Training and awareness records for staff with access to in-scope systems.
- Gap register with a remediation owner and a date against each entry.
The evidence bundle assembled at this stage often overlaps with the file used in an How acceptance testing regime technology contract documents to prepare track, particularly where the same technology contract underlies both processes.
Who reviews the file and how long it takes
The readiness decision sits with an internal sign-off body — a named owner or committee, not the certification body itself. That owner confirms the gap register is closed or has agreed remediation dates before the file leaves the organisation. The certification body then runs its own timeline, which starts only once it accepts the file as complete.
A file returned as incomplete resets the certification body's clock but does not reset the internal readiness work already done, provided the underlying evidence is still current.
Common scenarios
- If the business added a new system after scoping, the scope statement is amended before evidence assembly closes, not after.
- If a control log shows a gap with no remediation date, the readiness decision is deferred rather than issued with a caveat.
- If the organisation is mid-transaction, ownership change can affect who signs the readiness memo — see Change of control review for the parallel track that applies during a sale or restructuring.
Where readiness intersects other procedures
Readiness files rarely stand alone. Where the certified system supports tokenised assets, the redemption mechanics need their own documentation trail, separate from the certification evidence bundle — see Redemption in token issuance: definition and use for how that mechanism is defined and evidenced.
Where a certification decision is disputed rather than simply delayed, the review path resembles other first-instance challenges in structure, if not in forum — compare the escalation logic in How appeal against a first instance decision patent runs, which sets out how a first-instance outcome is contested elsewhere.
What this page does not cover
This page does not set out the substantive requirements a control set must meet, the specific fee a certification body charges, or the appeal route inside a particular scheme. Those depend on the scheme chosen and the certification body's own rules, which are published separately by that body.
Verified
Last reviewed for procedural accuracy. This page describes an internal process and does not cite external legal instruments; where a specific scheme's rules apply, check that scheme's published procedure directly.
FAQ
How long does certification readiness take in practice?
Most files move from scoping to a readiness decision within six to twelve weeks. Multi-system files, or files with several evidence owners, tend to run longer, mainly because evidence assembly stalls when no single person is accountable for a given control.
Which documents are needed to start?
Scoping needs only two documents: a scope statement and an asset inventory. Everything else — policies, logs, training records — is assembled once the scope is fixed, so starting early does not require the full evidence bundle in hand.
What happens if the other side does not respond?
If the certification body does not respond within its stated review window, the internal readiness owner should escalate through that body's own contact channel rather than resubmit the file. Resubmission restarts the queue; a status enquiry does not.
Related publications
A closely related file-preparation guide covers a different obligation on the same team's desk: How register of incidents data protection documents to prepare.