Ninety days is enough runway to walk into a certification, surveillance or client audit genuinely ready - provided you treat it as a sequenced project: diagnose in the first month, fix in the second, verify and rehearse in the third. The businesses that have bad audits are almost never the ones with imperfect systems; they are the ones that started preparing two weeks out and tried to reprint their way to readiness. Auditors can tell the difference in the first hour.
This is the runway we use. It assumes a system exists and the business roughly follows it. Adjust the intensity to your size, but keep the sequence - it is the sequence that does the work.
Why start 90 days out and not two weeks?
Because the highest-value evidence cannot be manufactured late. An internal audit needs time for its corrective actions to be closed. A management review needs data worth reviewing. Training gaps need sessions scheduled and delivered. Records need weeks of genuine operation to accumulate. Two weeks buys you tidier folders; ninety days buys you a system that is demonstrably working - which is the only thing the auditor is there to test.
There is a confidence dividend too. Teams that have rehearsed answer questions plainly and without fear, and audits go better when the auditor is talking to comfortable people. That composure is built in month three, not on the morning.
The 90-day runway at a glance
| Phase | Weeks | Focus | Key outputs |
|---|---|---|---|
| Diagnose | 1-4 | Find every gap while fixes are still cheap | Scope confirmed, gap register, currency fixes done |
| Fix | 5-9 | Close gaps in priority order, running as a project | Actions closed, documents updated, training delivered |
| Verify and rehearse | 10-13 | Prove it works, then practise showing it | Internal audit, management review, evidence pack, briefed team |
Weeks 1-4: what does the diagnosis phase involve?
Week 1 - set the frame. Confirm the audit scope, standard editions and dates with the certification body or client. Appoint one owner for the runway. Book the internal audit for weeks 10-11 and the management review for week 12 now, while calendars are open - these two events anchor everything.
Week 2 - currency sweep. Check every date-bearing item: insurances, licences, high risk work tickets, VOCs, calibrations, plant registrations, document review dates. Fix what is expired immediately. Currency findings are the most avoidable findings in auditing, and they colour the auditor's view of everything else.
Week 3 - desktop gap check. Walk the standard's requirements against your system: does a current document answer each one, and does a record prove it happened? Flag every gap in a register with an owner and a date. Pay attention to the perennials - objectives without measurement, document control drift, supplier evaluation, and last year's audit findings that quietly reopened.
Week 4 - site reality check. Take your paperwork to a live job and compare, the way an external auditor will. SWMS versus actual method. Training records versus who is actually on the crew. Prestarts versus the plant in use. The document-to-site gap is where audits are lost, so this week tells you where your real risk sits.
By the end of week 4 you hold a complete, prioritised gap register. That register is the plan for the next five weeks.
Weeks 5-9: what does the fix phase involve?
Run the gap register like a project: weekly review, owners chased, dates enforced. Priority order matters -
Weeks 5-6 - kill the compliance risks. Anything that would be a major nonconformity goes first: missing mandatory processes, legal compliance gaps, unclosed actions from previous external audits. A repeat finding from last year's audit is the worst look available.
Weeks 6-7 - close the record gaps. Where a process happens but leaves no trail, fix the capture now so five-plus weeks of genuine records exist by audit day. Inspections, toolbox talks, maintenance, monitoring - whatever your week 3 check flagged as thin. Backfilling is falsification; forward-filling from today is exactly what a functioning system looks like.
Weeks 7-8 - update documents and train the changes. Reissue what needs reissuing through proper document control, then brief the people the changes touch. Toolbox-level is fine; keep the attendance records. An auditor who finds a revised procedure will immediately ask a worker about it - close that loop before they do.
Week 9 - actions housekeeping. Every open corrective action, hazard report and improvement item gets closed with evidence or honestly re-dated with a reason. A genuinely worked actions list is one of the strongest signals of a live system; a stale one is one of the weakest.
Weeks 10-13: what does the verify-and-rehearse phase involve?
Weeks 10-11 - internal audit. Full scope, done properly, by someone with enough independence and enough spine to write real findings. This is your dress rehearsal, and its findings are gifts: every one is something the external auditor now will not discover first. Raise them formally and close them fast.
Week 12 - management review. Bring leadership the full picture required by the standard - performance data, internal audit results, actions status, resources, improvement decisions - and minute the discussion and the decisions. A dated, substantive management review shortly before the audit demonstrates the one thing auditors most want to see: leadership actually engaging with the system.
Week 13 - rehearse and stage. Assemble the evidence pack (certificates, registers, reports, minutes) so nothing is hunted for on the day. Brief everyone the auditor may meet: answer honestly, answer only what is asked, say "I'd have to check" instead of guessing, and know where your own procedures live. Confirm logistics - room, site access, PPE, opening meeting attendees. Then stop. Late cosmetic changes create version confusion and fresh-paint smell; a system that looks slightly lived-in and genuinely operates beats a pristine one every time.
What if we find something big in week 3?
Then the runway has done its job - you found it, the auditor did not. Raise it as a formal corrective action, fix what can be fixed, and have the honest status ready to show. Auditors respond far better to "we identified this, here is the action and its date" than to a gap discovered live. Self-identified and managed is a system working; concealed and discovered is a system failing. The 90 days exists precisely to move findings from the second category to the first.
Start the runway with a fix on your position
Every runway starts with knowing where you stand. Our audit readiness check gives you that fix in minutes - a structured look at the areas above and where your gaps most likely sit - so week 1 starts with a map instead of a blank page. If the audit is closer than 90 days, do it today and compress the phases; the sequence still holds even when the runway is short.
Founder, Hillview Business Services. 15+ years inside civil construction, mining and infrastructure businesses.