If we are halfway through implementation and behind plan, then do we move the audit date?

Start

Halfway through, and gates are coming in late

A first certification that runs late is common: the scope takes longer to approve, the Statement of Applicability slips, controls are not yet producing records. Late gates tell you the plan was optimistic. They do not yet tell you whether the audit date fails. Only a fresh forecast does.

• Then: Rescore readiness honestly, and have the blockers checked

Step

Rescore readiness honestly, and have the blockers checked

Score every requirement from 0 (Not started) to 3 (Operating), taking the lower score when in doubt. Have a second person check the blocking items, since owners tend to score their own controls high. Being behind plan is exactly when optimism costs most.

• Then: Give every gap an owner and real weeks of work

Step

Give every gap an owner and real weeks of work

Each gap needs an owner and the weeks of work that owner can actually give it, with blocking items first in every queue. In a small organisation the ISMS manager's queue is nearly always the critical path. An overdue gap on the critical path is the first thing to raise with the executive sponsor.

• Then: Re-forecast the earliest Stage 2 date

Step

Re-forecast the earliest Stage 2 date

Take the latest of three dates: (a) the last gap In place, with owners working one gap at a time; (b) the last blocking item In place plus the operating period, 3 months by the pack's default; (c) the internal audit and management review done. In the pack's worked example, (b) sets the date. That is why a late blocking item matters far more than a late ordinary control.

• Then: Does the forecast fall on or before the booked Stage 2 date?

Decision

Does the forecast fall on or before the booked Stage 2 date?

Compare the forecast with the booked Stage 2 date, not with the original plan. In the pack's worked example the firm is weeks behind at two gates, yet its forecast still falls 18 calendar days inside the booking. If you cannot produce a forecast you trust, answer no.

• Yes: Is the margin under 4 weeks, or a blocker undated?
• No, or not known: Take it to the executive sponsor this month

Decision

Is the margin under 4 weeks, or a blocker undated?

The pack's trigger for taking it to the executive sponsor is a forecast within 4 weeks of the booked Stage 2 date, or any blocking item with no date before Stage 2. A small margin is not a failure, but one slipped gap on the critical path will use it up. If you are unsure, answer yes.

• Yes, or not known: Keep the date: tell the sponsor and watch the critical path weekly
• No: Keep the date; re-date the missed gates and report monthly

Outcome

Keep the date; re-date the missed gates and report monthly

Re-date each missed gate rather than declaring it met. Report the headline measures to top management every month and recompute the forecast each time. Move the date later only if a future forecast says so.

Outcome

Keep the date: tell the sponsor and watch the critical path weekly

This is where the pack's worked example lands: behind plan, but with a forecast 18 calendar days inside the booking. The executive sponsor is told that month, each critical-path gap is reviewed weekly in the gap tracker, and the missed gate is re-dated rather than declared met. If the next forecast slips past the booking, the sponsor decides then.

Step

Take it to the executive sponsor this month

Do not wait for Stage 1 to decide for you. The sponsor chooses between adding resource, narrowing the scope and moving the date. If a customer, tender or regulator set the deadline, say plainly whether the forecast meets it.

• Then: Would more people bring the forecast inside the booking?

Decision

Would more people bring the forecast inside the booking?

More people only shorten the work of putting gaps In place: date (a), and date (b) if they get the last blocking item In place sooner. They cannot shorten the months of records after it. The implement-and-operate phase is the time controls need to run, and adding people does not compress it. If you cannot tell, answer no.

• Yes: Add resource to the critical path and keep the date
• No, or not known: Can the scope narrow and still pass the scope tests?

Outcome

Add resource to the critical path and keep the date

Put the extra effort on the gaps whose slip would move the date: the critical path, starting with the blocking items. Review those gaps weekly in your gap tracker. Release the time from other work: internal effort that is added on top of people's day jobs is why projects slip while controls are being put in place.

Decision

Can the scope narrow and still pass the scope tests?

A narrower scope only works if every exclusion has a real reason, nothing in scope depends on what is excluded, and customers still recognise the service they buy. A service that will not have run for the operating period by Stage 2 can be added later at a surveillance audit. Narrowing after Stage 1 is expensive. Top management must approve any change to the scope.

• Yes: Narrow the scope through top management, before Stage 1
• No, or not known: Move the date now, with the certification body

Outcome

Narrow the scope through top management, before Stage 1

Take the revised scope statement to top management for approval, with what it now leaves out and why. Depending on how you are governed, that is the board or a committee it has delegated to, the management board in a two-tier structure, or executive management where there is no board. Update the risk assessment and the Statement of Applicability to match, then re-run the forecast. Plan to widen the scope at a later surveillance audit.

Outcome

Move the date now, with the certification body

Move early and deliberately. Agree new dates with the certification body, allowing for its lead time, which the pack puts at 8 to 12 weeks. Keep Stage 1 and Stage 2 close enough that Stage 1 stays current. Moving Stage 2 is better than going in expecting a major nonconformity.