Free Tools
Choose your pre-audit check.
1. 7-Question Audit Risk Triage
Fast. Browser-based. No spreadsheet.
2. Offline Pre-Audit Self-Check
Private XLSX. More deliberate. Operator-grade.
If either check flags a break:
Read the Diagnostic Verdict.
01. THE 7-QUESTION AUDIT RISK TRIAGE
Use this first if you want a fast signal.
No spreadsheet.
No upload.
No evidence submission.
No consultant.
Seven questions. Browser-based. Built to detect obvious audit-risk pressure points before you spend time in the XLSX.
It does not review artifacts.
It does not prove compliance.
It tells you whether the visible ownership, evidence, and governance signals are already weak enough to justify deeper checking.
If the triage flags risk, read the Diagnostic Verdict.
If you want to inspect the chain privately, use the XLSX self-check.
Your next surveillance audit will not test whether your documents exist.
It will test whether your evidence chain survives sampling, owner interviews, timestamp checks, and silence.
One traceability snap — stale records, unowned CAPAs, verbal risk acceptance, or evidence that needs explanation — can turn a certified ISMS into a named finding.
Run the check before the auditor creates the record.
02. THE OFFLINE PRE-AUDIT SELF-CHECK (.XLSX)
A binary diagnostic for CISOs and Operators. This sheet identifies the 5 highest-probability “Traceability Snaps” currently used by auditors to trigger Major Nonconformities.
A 5-minute binary (Yes/No) diagnostic for UK CISOs, Compliance Leads, and Operators in regulated sectors.
Tests six structural governance and traceability layers surveillance auditors routinely sample first — before accountability is formalised in a report.
The six exposure vectors assessed:
1. Management Direction & Decisions
Are decisions real, assigned, followed up, and evidenced — or just recorded as “discussed”?
2. Problem Correction & Recurrence Control
Are root causes fixed and verified — or do issues reappear after being marked closed?
3. Records & Evidence Integrity
Can evidence stand on its own under sampling — or does it require explanation, backfilling, or context?
4. Risk Treatment Reality
Are risks actively treated and evidenced — or documented as intention without execution?
5. Monitoring & Improvement
Is the ISMS demonstrably improving — or merely being maintained?
6. People, Access & Exposure Controls
Are access, insider risk, and operational exposures actively controlled — or assumed to be working?
No Partial Credit
The auditor will not average the section.
If one required link is missing, that chain becomes the issue.
- A policy may exist.
- A register may exist.
- A review may exist.
But if the decision, owner, evidence, and follow-through do not connect, the chain does not hold.
Mark it honestly.
Private Execution
Download the XLSX.
Run it inside your own environment.
Do not send evidence anywhere.
- No portal.
- No account.
- No file submission.
- No external visibility.
You see the warning signals before anyone else does.
Immediate Verdict
All Yes (0 No)
No obvious break flagged across the six self-check vectors.
That does not prove audit readiness.
It means nothing obvious snapped at the first 6 Collapse Vectors.
Any No
Warning signal flagged.
That vector may become a sampling expansion point if the auditor follows the chain.
Do not explain it from memory.
Verify the evidence path before the audit window tightens.No sign-up. No calls. <5 min to reality.
After You Run It
[READ DIAGNOSTIC VERDICT PAGE]