Gap Assessment vs Readiness Assessment vs Audit: Choosing the Right Engagement

Organisations pursuing ISO/IEC 27001 certification, a SOC 2 report or PCI DSS validation often buy the wrong engagement at the wrong time, paying for an audit before they are ready or for a gap assessment when what they needed was a rehearsal. A gap assessment, a readiness assessment and an audit look similar from the outside: someone compares your controls with a standard and writes a report. They differ in purpose, in how independent the assessor must be, in what the output can be used for and in where they sit on the path to a certificate or attestation. This guide compares the three engagements, explains the independence rules that decide who may perform each, sets out timing and cost drivers, and covers the failure modes that follow from skipping a step. It is for compliance leads, CISOs and founders planning a certification or attestation programme. It complements the type-specific checklists such as the ISO 27001 Certification Readiness Checklist and the SOC 2 Readiness Checklist, rather than repeating them.

Key takeaways

• Purpose differs first. A gap assessment tells you what is missing, a readiness assessment tells you whether you would pass now, and an audit produces an independent opinion or certification decision that third parties rely on.
• Independence rises along the path. Anyone competent may run a gap assessment, readiness is best done by someone outside the implementation team, and the audit must be performed by an independent, qualified body that did not help build what it audits.
• Only the audit output is for outsiders. Gap and readiness reports are internal planning documents; customers, regulators and acquirers rely on the certificate, the SOC report or the PCI DSS compliance report.
• Your adviser cannot be your certifier. ISO/IEC 17021-1 bars certification bodies from consultancy and sets a two-year cooling-off period after consultancy or internal audit work for the same management system.
• Skipping readiness is the costliest shortcut. Failing a stage 1 or stage 2 audit, or receiving a qualified SOC 2 opinion, costs more in time and reputation than the readiness work would have.

What each engagement is

Gap assessment

A gap assessment (often called a gap analysis) compares the current state of your controls, policies and processes with a target framework, requirement by requirement, and records where you fall short. It is a planning tool. It is usually performed early, before scope is fixed, and its output is a gap register: each requirement, current state, gap description, risk, owner and effort estimate. It can be done by an internal team, a consultant or a combination, and it can be repeated against more than one framework to find overlaps. Mapping guides such as the NIST CSF to ISO 27001 Mapping Guide are useful inputs.

Readiness assessment

A readiness assessment, sometimes called a pre-assessment or mock audit, tests whether the controls you have built would survive the real audit. It is performed late, after implementation, against the same scope, criteria and evidence standard the auditor will use. Instead of asking "what do we lack?" it asks "could we show an auditor, with evidence, that this works?" Its output is a pass, conditional or not-ready verdict per area, a list of evidence weaknesses and a go or no-go recommendation for booking the audit.

Audit

The audit is the formal, independent engagement whose output third parties rely on. For ISO/IEC 27001 it is the certification audit by a certification body operating under ISO/IEC 17021-1, which the ISO catalogue describes as setting requirements for bodies providing audit and certification of management systems, with a focus on competence, consistency and impartiality. For SOC 2 it is an examination performed by a licensed CPA firm under AICPA standards, resulting in a Type 1 report on control design as of a date or a Type 2 report that adds an opinion on operating effectiveness over a period. For PCI DSS it is validation by a Qualified Security Assessor, which the PCI Security Standards Council describes as an independent security organisation qualified to validate an entity's adherence to PCI DSS.

Side-by-side comparison

Independence: who may do which engagement

Independence is the rule that most often trips up programme plans, because buyers assume the firm that helped them prepare can simply carry on and audit them.

• ISO certification bodies: ISO/IEC 17021-1:2015 clause 5.2.5 says the certification body shall not offer or provide management system consultancy. The European co-operation for Accreditation interprets consultancy as participation in establishing, implementing or maintaining a management system, including preparing manuals or procedures and giving specific advice on developing and implementing it. Clause 5.2.7 says a certification body shall not certify a management system for a minimum of two years following the end of consultancy by a related body, and clause 5.2.6 treats providing internal audits as a significant threat to impartiality, with the same two-year mitigation. Exchange of information between certification body and client is still permitted.
• What this means for gap and readiness work: a gap assessment that tells you how to fix gaps, or a readiness assessment that writes your procedures, is consultancy. Buy it from a consultancy or do it internally, not from the certification body you intend to use. Ask any certification body offering a "pre-assessment" exactly what it includes and how it stays within its impartiality rules.
• SOC 2 auditors: the CPA firm signing the report must be independent of the service organisation under AICPA professional standards. A firm that designs or operates your controls creates a self-review threat. Many organisations use one firm for readiness and another for the examination; if the same firm does both, ask for its written independence analysis. The SOC 2 Auditor Selection guide covers what to ask.
• PCI DSS assessors: the Council publishes a list of qualified QSA companies and advises checking it each time a QSA is engaged; listing is not an endorsement. Treat the same separation principle as good practice: a QSA that built your controls is in a weak position to validate them.
• Internal audit: the IIA's Global Internal Audit Standards include the principles "Maintain Objectivity" and "Positioned Independently". Internal audit can perform an objective readiness assessment for the ISMS, but where it advised on the design it should disclose that and consider an external reviewer. See Internal Audit for Cybersecurity Guide.

Timing on the certification path

The engagements fit into a sequence. The exact gaps between steps depend on scope and maturity, but the order rarely changes.

1. Scope and gap assessment: agree the scope boundary (systems, locations, services, trust services categories or cardholder data environment), then run the gap assessment against it. Produce a roadmap with owners and dates.
2. Remediation and operation: close gaps, then run the controls long enough to produce evidence. ISO/IEC 27001 expects records such as a completed internal audit and management review; SOC 2 Type 2 needs controls operating throughout the period the auditor will examine.
3. Readiness assessment: test against the auditor's evidence standard. Fix residual findings and re-test the ones that matter.
4. Book the audit: only after a go verdict. For ISO certification this is stage 1, which reviews documentation and readiness, followed by stage 2, which evaluates implementation and effectiveness. For SOC 2, a Type 1 report can be issued as of a date, while a Type 2 report covers a period, so the period start date is set by when controls can be shown to operate. See SOC 2 Type 1 vs Type 2.
5. Maintain: after the first certificate or report, the cycle repeats: annual surveillance audits for ISO certification, recurring SOC 2 periods and annual PCI DSS validation. A light internal readiness check before each cycle replaces the full pre-certification readiness assessment.

Regulated programmes follow the same logic with their own validation step. For CMMC, the DoD CIO page describes Level 2 self-assessments every three years with annual affirmation and a 180-day close-out for plans of action and milestones; as of November 2026 the page shows Phase I began on 10 November 2025 and the Phase II requirements were suspended on 13 July 2026, so check the current status before planning. The CMMC Level 2 Readiness Checklist covers preparation.

Where each engagement fits by framework

For the EU regimes see the NIS2 Readiness Checklist and DORA Readiness Checklist.

Where identity fits

Identity controls are where readiness assessments most often fail on evidence rather than design. Access reviews that happened but left no record, joiner-mover-leaver processes that skip contractors, and service accounts, API keys and automation identities with no owner are common findings. A good readiness assessment samples non-human identities alongside human users: who owns each, when its credential last rotated and whether its privileges match its purpose. The Audit Readiness for AI Agents and NHIs guide sets out the evidence auditors ask for.

Cost drivers and how to budget

Published price lists are rare and quotes vary widely, so budget by driver rather than by headline figure.

• Gap assessment: scales with the number of frameworks, business units and locations, and with how much documentation exists. A single-framework gap assessment for a small, cloud-only company can be largely internal; a multi-framework assessment for a group with several entities usually needs external help.
• Readiness assessment: scales with sampling depth. A desktop review is cheap but weak; a rehearsal that samples evidence the way the auditor will costs more and finds more. Expect to pay for a short re-test of material findings.
• Audit: for ISO certification, audit time is set by the certification body from scope and size; for SOC 2, the number of trust services categories, systems, locations and the length of a Type 2 period drive hours; for PCI DSS, the size and complexity of the cardholder data environment. Remediation found late adds re-audit or extended fieldwork costs.
• Hidden cost: staff time. All three consume interviews, evidence gathering and fixes from the same small team, so schedule them around release freezes and peak trading.

Threat model, failure modes and decision criteria by option

Gap assessment

• Risk it addresses: starting implementation without knowing the size of the job, or building controls the framework does not require.
• How it works in practice: requirement-by-requirement interviews and document review, scored on a simple scale, consolidated into a register and roadmap.
• Failure modes: scored on policy existence rather than operation; scope not fixed so gaps shift later; findings without owners or effort estimates.
• Choose it when: you are starting a framework for the first time, adding a second framework, or the scope has changed materially.

Readiness assessment

• Risk it addresses: failing or qualifying the real audit because evidence is missing, inconsistent or does not cover the period.
• How it works in practice: the assessor uses the auditor's criteria and sampling, requests evidence as the auditor would, and grades findings as the auditor would.
• Failure modes: done by the people who built the controls; too early, before controls have operated; treated as a formality and not acted on.
• Choose it when: it is the first audit for this framework, the scope has changed, a prior audit raised major findings, or the cost of a failed audit is high.

Audit

• Risk it addresses: customers, regulators or partners requiring independent assurance.
• How it works in practice: engagement letter or certification contract, planning, fieldwork with sampling and testing, findings, then a certification decision or signed report.
• Failure modes: booked before readiness; scope narrower than what customers believe is covered; an auditor whose independence or accreditation is not checked.
• Choose it when: readiness is confirmed and someone outside the organisation needs the result.

Worked scenarios

• SaaS start-up with a customer deadline: a 60-person company needs SOC 2 within the year for an enterprise deal. It runs an internal gap assessment against the security criteria, remediates, then engages one firm for a readiness assessment and a different CPA firm for a Type 1 report, followed by a Type 2 period. The customer receives the Type 1 report as an interim document.
• Manufacturer seeking ISO/IEC 27001: a consultancy runs the gap assessment and helps build the ISMS. Internal audit then runs the clause 9.2 internal audit, which doubles as a readiness check. The company selects an accredited certification body unconnected to the consultancy, as ISO/IEC 17021-1 requires; see ISO 27001 Certification Body Selection.
• Payment service provider renewing PCI DSS: after a network redesign changed the cardholder data environment, it repeats a scoping-focused gap assessment, then a readiness review of new segmentation evidence before the QSA fieldwork.

Detection and measurement

• Gap closure rate: percentage of gap register items closed by the planned date.
• Readiness findings by severity: count of findings an auditor would grade as major, with a target of zero before booking the audit.
• Audit outcome: number of major and minor nonconformities or exceptions at the formal audit, compared with what readiness predicted.
• Prediction accuracy: share of audit findings that readiness had already identified; a low figure means readiness sampling was too light.
• Evidence lead time: days taken to produce requested evidence during readiness and audit; a falling figure shows controls are becoming routine.

Common failure patterns

• Skipping readiness to save money: the first sign of missing evidence comes from the auditor, the timetable slips and the customer deadline is missed.
• Using the certification body as consultant: the work breaches impartiality rules, and the organisation must either find a new certification body or wait out the two-year period.
• Treating a gap assessment report as assurance: sending it to customers as if it were an audit result misleads them and is easily challenged.
• Readiness by the builders: the team that implemented the controls marks its own work and misses the same blind spots the auditor will find.
• Scope drift between engagements: the gap assessment, readiness and audit each use a different scope, so findings do not carry over.
• Running readiness too early: for a Type 2 report or a stage 2 audit, controls must have operated; a readiness check before that measures design only.

Framework mapping

Practitioner checklist

• Fix the scope in writing before the gap assessment and reuse the same scope for readiness and audit.
• Produce a gap register with owner, risk, effort and due date for every gap.
• Let controls operate long enough to generate the evidence the audit type needs before readiness.
• Have readiness performed by someone who did not build the controls, using the auditor's sampling and evidence standard.
• Book the audit only after a go verdict with no findings an auditor would grade as major.
• Check the auditor's accreditation, licence or qualification and confirm in writing that it provided no consultancy on the scope.
• Never share gap or readiness reports externally as assurance.
• Sample non-human identities and their owners during readiness, not just human access.
• After each audit, compare findings with readiness predictions and adjust the next readiness plan.

Standards and references

• ISO: ISO/IEC 17021-1:2015 Requirements for bodies providing audit and certification of management systems
• European co-operation for Accreditation: FAQ on impartiality, clause 5.2.5 of ISO/IEC 17021-1
• AICPA and CIMA: System and Organization Controls, SOC suite of services
• Journal of Accountancy: The three faces of SOC
• PCI Security Standards Council: Qualified Security Assessors
• NIST: SP 800-53A Rev. 5 Assessing Security and Privacy Controls
• The IIA: Global Internal Audit Standards
• US Department of Defense CIO: About CMMC

Related NHI Mgmt Group resources: ISO 27001 Certification Guide · SOC 2 Guide · How to Read a SOC 2 Report Guide · ISMS Internal Audit and Management Review · Forensic Readiness Guide