Audits
External audit · ISO 37301
until the audit. And you already know what's missing.
The pre-audit is done before the external auditor arrives. You see where you're falling short, fix it calmly and only call the auditor when you hit 100%.
Pre-audit
Readiness for the external auditor
No surprises before. No rush during.
No starting from scratch after.
Before
- Pre-audit ready before the external auditor arrives
- You know where you're falling short and how far you are from ready
- The director tracks readiness without having to call
During
- The auditor finds the controls, evidence and documents for each clause without you hunting for files
- No side spreadsheets or scattered drives
- Opinion recorded right there, clause by clause
After
- Results frozen with a date, no debate over which version counts
- Official record for the board and for the next audit
- Next year, the skeleton is already in place
The nonconformity shows up now.
Not in the final report.
In the internal audit, each clause is assessed with the proof alongside. Whatever is weak or expired becomes a finding while there's still time to fix it, and you don't burn a round with the external auditor.
ISO 37301 · 8.3 Raising concerns
CM Assigned auditorControls
Evidence
Tasks
Opinion
Finding
Q3 channel report not collected yet. It is due before the external audit.
Only the assigned auditor sets the opinion for this clause.
What the auditor saw stays on record.
On completion, the audit becomes a dated snapshot of everything assessed. A year from now, no one depends on the memory of whoever was there: the answer is in the platform.
External audit
ISO 37301 · 2026
58
Conforming
4
Minor NC
2
Observation
Call in the external auditor when you hit 100%.
Pre-audit done before the auditor arrives
You know how long until you're ready
No rounds burned with the auditor or the board