Certification readiness: what the decision maker looks at
A certification decision maker checks four things, not one. Does the stated scope match what is actually operated? Do the controls have dated evidence, not just a policy document? Is every open gap tied to a remediation plan with an owner and a date? Has someone with authority signed off before the file goes anywhere external? Readiness is measured against evidence. It is not asserted in a cover letter, and no reviewer accepts it on that basis.
What changes once the review opens
Before a file is opened, gaps are private. A team can still fix a control, rewrite a procedure, or retire a system that would not survive scrutiny. Once an assessor or an internal approval committee opens the file, every finding becomes part of the record. Withdrawing the application does not erase a noted non-conformity. It resurfaces at the next attempt, often with a question about why it was not closed the first time.
This is the point of no return that scoping calls refer to without naming it directly. It is not a deadline. It is the moment evidence, rather than intention, starts to speak for the file. Teams that delay submission by a few weeks to close a control lose less than teams that submit early and carry a documented gap into the audit.
What to do before you apply
- Confirm the scope in writing. The person accountable for the certification signs a scope statement naming the systems, locations and data flows covered. A vague scope is the most common reason a file stalls.
- Map each control to a piece of evidence. A policy is not evidence. A log, a signed record, a ticket showing the control operated on a given date — that is evidence.
- Run a gap list with owners and dates. Every open item needs a named owner and a target date. An unowned gap is treated by most reviewers as an unmanaged one.
- Collect evidence produced elsewhere. If the certified system was built or delivered by a vendor, testing records already produced under an acceptance testing regime often cover part of the evidence set without extra work.
- Get the internal sign-off before the external one. Whoever approves the file internally should see the same evidence pack the external reviewer will see, not a summary of it.
- Submit only once the gap list is empty or fully dated. A file with three open items and three dates is a stronger submission than a file claiming zero gaps that nobody has checked.
Where the certification decision also touches a separate classification question — for instance, whether a product or instrument falls into a regulated category — that assessment runs on its own document set and its own timeline, distinct from the certification file itself.
Who decides, and on what timeline
Two different people decide two different things, and confusing them is the second most common source of delay after a vague scope.
| Decision point | Who decides | What moves it forward |
|---|---|---|
| Whether the file is ready to submit | Internal approval committee or the accountable owner | A closed or fully dated gap list |
| Whether the file meets the scheme's requirements | The lead assessor or certifying body | Evidence matching each mapped control |
| Whether an ownership change during the cycle affects the file | The certifying body, on notice | A separate change-of-control review |
| Whether a non-conformity is closed | The assessor who raised it | Corrective evidence dated after the finding |
Where the certified entity changes ownership mid-cycle, the certifying body does not simply carry the file forward. A separate check applies, closer in shape to a change of control review than to a routine renewal, and it can reopen questions the original file had already closed.
Two situations that change the answer
If your gap list has one item with no realistic closing date, do not submit. A single unresolved item with no date reads worse to a reviewer than three items each carrying a plan.
If the certified system depends on a feature added after the last review — a new automated decision step, for example — treat that feature as new scope, not as an update to an existing control. Reviewers ask for evidence of the change process itself, not only of the feature's output.
If your organisation has been through this scheme before and the file is a renewal, the assessor still expects fresh evidence for the period since the last certificate. Evidence from the previous cycle does not carry forward on its own.
What this page does not cover
This page describes the readiness review as a process. It does not set out the substantive requirements a control must meet, which vary by scheme and by sector. It does not cover the separate question of whether a given product or feature falls under a security, data protection or artificial intelligence obligation in the first place — that assessment happens earlier, and it changes what belongs in scope. It also does not cover pricing or engagement terms; those are addressed separately once a scope and a gap list exist.
Verified
This overview reflects a generic certification readiness process as commonly applied by certifying and assessment bodies operating in the EU. It does not cite a specific scheme's requirements, because those vary by certification and are set out in the scheme's own published rules, not summarised here.
Related reading
A parallel process, run by the same kind of internal committee, is described in How register of incidents data protection what the decision.
Next steps
If the trigger for this review is a new feature reaching users, start with What to do first in this situation. If an automated feature has changed how data moves through the product, the cost of getting the scope wrong is set out in An AI feature changes the data flow data protection. Where the gap is not in controls but in the processing record itself, see Records of processing are incomplete data protection what it.
FAQ
How long does certification readiness take in practice?
It depends far more on the state of the evidence than on the scheme itself. A file with mapped controls and dated evidence moves in a matter of weeks. A file where evidence has to be produced from scratch — new logs, new sign-off records — takes months, because evidence needs time to accumulate before it can be shown.
Which documents are needed to start?
A signed scope statement, a control-to-evidence map, and a gap list with owners and dates. Everything else — policies, prior audit reports, vendor certificates — supports those three documents but does not replace any of them.
What happens if the certifying body does not respond?
Set a follow-up date at submission and keep a written record of it. A certifying body that goes quiet mid-review is not the same situation as a counterpart in a commercial dispute who stops responding after taking a position, which is covered separately in When the other side moved first in this situation. With a certifying body, escalation usually runs through the scheme's own complaints channel rather than through a legal notice.