Certification readiness: stages and deadlines
Certification readiness is the internal work that turns a data protection or security programme into something an external certification body can test and approve. It runs through fixed stages: scoping, documentation, internal audit, external audit in two parts, and a certification decision. Miss a stage and the audit either stalls or restarts. The clock that matters is the auditor's, not yours.
What certification readiness actually covers
There is no single scheme that fits every organisation. Some certifications are scheme-specific and run by an accredited body; others sit inside a broader compliance programme and get tested alongside it. What stays constant is the sequence: you cannot skip documentation to reach the audit faster, and you cannot appeal a negative finding by producing evidence after the audit closed.
Readiness work therefore has two audiences. The certification body checks whether controls exist and operate as described. Your own management checks whether the scope you are certifying is the scope you actually run. When those two views diverge, the audit exposes the gap, and closing it after Stage 1 is expensive.
| Stage | Typical duration | Output |
|---|---|---|
| Scoping and gap assessment | 2–4 weeks | List of controls in scope, gaps against the target standard |
| Documentation build | 4–8 weeks | Policy set, risk register, records of processing |
| Internal audit | 1–2 weeks | Findings log with owners and target dates |
| Stage 1 audit (documentation review) | 1–3 days on site or remote | Readiness confirmation or non-conformities |
| Corrective action window | 2–6 weeks | Closed non-conformities, evidence pack |
| Stage 2 audit (operating effectiveness) | 2–5 days | Audit report and recommendation |
| Certification decision | 2–4 weeks after Stage 2 | Certificate issued, refused, or deferred |
Practical consequence
Every stage produces a document the next stage reads. Documentation written for internal use rarely survives Stage 1 unchanged, because auditors ask for evidence, not intent. The same discipline applies where a system change needs sign-off before go-live: see how the Acceptance testing regime: stages and deadlines works, since the acceptance logic and the audit logic ask the same question — does the control work as described, not as intended.
The practical cost of skipping a stage is not a fine. It is a repeated audit, billed again, on a scope the certification body already flagged as unready.
What to do
- Assign an owner. One person tracks the scope, the evidence pack, and the audit calendar. Shared ownership is the most common cause of missed deadlines.
- Freeze the scope before documentation starts. Adding systems mid-way forces a rewrite of the risk register and the control matrix.
- Run the internal audit as if it were the real one. Findings not caught internally surface at Stage 1, where they cost more time to fix.
- Close non-conformities with evidence, not promises. A remediation plan without a completion date is treated as an open finding.
- Book Stage 2 only when corrective actions are closed. Booking early to hold a slot and closing findings later is the most frequent cause of a failed Stage 2.
- Keep the evidence pack live after certification. Surveillance audits use the same file; rebuilding it from scratch each year defeats the point of certifying.
Who decides
The certification body's auditor writes the recommendation; a separate decision panel inside that body issues or refuses the certificate. The panel does not revisit facts the auditor already tested — its role is to check that the audit itself followed the scheme's rules. This split between the person who tests and the person who decides mirrors the structure used in other compliance assessments: see how Classification assessment step by step in detail separates the analysis from the decision maker for a different question.
The decision typically lands two to four weeks after Stage 2 closes. There is no expedited track; asking for a faster decision does not change the panel's calendar.
Forks
If your organisation already holds a related certification, some evidence carries over — but only where the scope genuinely overlaps, and the auditor confirms that in writing before Stage 1, not after.
If a change of control is pending or completed during the readiness window, the certification scope itself may need re-checking before the audit proceeds. That question is handled separately from the audit calendar: see How change of control review IP licence runs in for how that review runs and where it sits against your certification deadline.
If the certification is a contractual requirement with a fixed date, treat the corrective action window as the buffer, not the audit date. Auditors do not compress Stage 2 to meet a client's contract deadline.
Limits
This page does not cover what happens when a client or regulator disputes whether your certified controls actually prevented a specific incident. That is a different procedure, with its own evidence standard: see When damages are demanded without evidence: the deadline that for how that deadline is calculated once a claim is raised.
It also does not cover surveillance audit findings that lead to suspension or withdrawal of an existing certificate — that follows the scheme's own escalation ladder, not the readiness process described here.
Verified
Reviewed by Rasa Tumenaite. This page describes standard certification body practice as generally applied across data protection and security certification schemes; the exact rulebook, fee structure, and decision timeline belong to the scheme and certification body you choose, and should be confirmed directly with that body before you fix an internal deadline.
Related
A closely related procedure, run by the same team internally, is described in How register of incidents data protection runs in practice — many certification schemes expect that register as part of the evidence pack.
FAQ
How long does certification readiness take in practice?
Most organisations need three to five months from scoping to certificate, depending on how much documentation already exists and how many findings surface at Stage 1. Organisations with mature policies move faster; those starting from scratch should plan closer to six months.
Which documents are needed to start?
A current asset and system inventory, an existing risk register if one exists, and a named scope owner. Without these three, the certification body cannot schedule Stage 1, because scoping cannot start on an undefined boundary.
What happens if the certification body does not respond?
Certification bodies work to their own audit calendar and do not guarantee a response window between stages. If a decision is overdue against the timeline you were quoted, escalate in writing to your assigned contact and ask for a revised date; silence beyond the quoted window is a scheduling issue to raise, not a finding to wait out.
What we can help with
If you need a second read of your certification scope, your evidence pack, or the corrective action plan before Stage 2, get in touch. See the wider context in Data, security and AI obligations and its limits.