Pre-audit
A readiness check before the certification audit – we find the non-conformities while there is still time to fix them calmly.
Audit and assessment
Information security audit and assessment – an independent look before someone else takes one
A pre-audit, GAP analysis or internal audit that tells you honestly where you stand. A report both the IT team and the board can understand – with priorities and next steps.
Who it is for
Who this service is for
- Companies that want to know whether they are ready before a certification audit
- Organisations that already have a management system and need the mandatory internal audit
- Managers who want an independent second opinion on their IT partner's or internal team's assessment
- Companies whose client or investor asks for evidence of their security level
What is included
What the service includes
GAP analysis
A systematic comparison against the chosen framework (ISO 27001, ISO 42001, E-ITS), with the impact and priority of each gap.
Internal audit
The independent internal audit the standard requires, carried out by someone outside your management line – as the standard expects.
Management review
We prepare the input and minutes for the management review so it is not a formality but real decision-making information.
A report in two languages
Findings, evidence, risks and recommendations – in Estonian and English where needed, so it can be shared with a parent company or client.
Process
How we work
Agreeing scope and criteria
We decide what to assess against and what the audit covers. Without this the report is not comparable.
Document review
We review policies, procedures, the risk register and evidence before the interviews.
Interviews and evidence gathering
We talk to the people who actually do the work – that is where the gap between paper and practice shows.
Validating the findings
We go through the findings with you before finalising the report, to avoid misunderstandings and factual errors.
Report and presentation
A written report with priorities and, if you wish, a presentation to management or the board.
Outcome
What you end up with
- An audit report with findings, evidence and risk levels
- A priority order – what must be solved before the audit and what can wait
- Concrete improvement recommendations, not generic references to the standard
- Where needed, the internal audit and management review documents the standard requires
FAQ
Frequently asked questions
What is the difference between a GAP analysis and a pre-audit?
A GAP analysis compares the current state with the requirements of the standard and works well at the start of a project. A pre-audit is closer to the real thing – it mirrors the logic of a certification audit and looks at evidence, not just documents.
Can you run our internal audit if you also prepared us?
We always discuss this upfront. An internal audit must be independent of the activity being audited – if we created the documentation in that area ourselves, we bring in another consultant or scope the audit so independence is preserved.
Will the audit disrupt our daily work?
Most of the work is document review on our side. Your people mainly spend time on interviews, typically an hour to an hour and a half each, agreed in advance.
Can the report be shown to a client or investor?
Yes, and we write it with that in mind. Where needed we add a shorter summary alongside the technical report that can be shared without disclosing sensitive detail.
Let's find out where you actually stand
Tell us what you want to be assessed against and what you need the result for – we will propose a suitable format and scope.
See also
Related services
ISO 27001 consulting
Preparing your company for the ISO 27001 audit.
Read more →Cyber-security roadmap
Assessing the current state and a clear roadmap for improving cyber security.
Read more →ISO 9001 quality management system
Building a quality management system and preparing for certification.
Read more →