QULDEXResources · Glossary
What is an audit readiness score? How it is calculated
What does a readiness score tell you?
Readiness is about whether the audit can go ahead and what it is likely to find. A score compresses many items into one number so progress can be tracked week by week.
Treat it as a guide. An auditor does not use your score; they test controls and evidence. A high score with weak evidence review behind it gives false comfort.
What usually goes into a readiness score?
The share of in-scope controls that are implemented and have an owner.
The share of required evidence that is collected, in period and accepted by a reviewer.
Open findings and overdue corrective actions, weighted by severity.
How might a readiness score be built?
An illustrative calculation. The weights are an example, not a standard.
| Input | Example |
|---|---|
| Controls implemented | 81 of 93 in scope: 87% |
| Evidence accepted | 210 of 280 required items: 75% |
| Critical findings open | 1, which caps the score until closed |
| How to read it | Evidence is the weakest area; focus there before the audit |
This is an illustration written for this page, not a customer record.
What do frameworks say about measuring readiness?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Clause 9.1 | The organisation decides what to monitor and measure, how, and when, and keeps the results. |
| ISO 27001 | Clause 9.3 | Management reviews performance, including trends in nonconformities and audit results. |
| SOC 2 | CC4.1 | Evaluations are performed to confirm that controls are present and functioning. |
| NIST CSF 2.0 | Tiers and profiles | Current and target profiles are compared to identify and prioritise gaps. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
How do readiness scores mislead?
Counting uploads as evidence
A file attached counts as done, whatever it shows.
Instead: count only evidence a reviewer has accepted.
Averages that hide gaps
A high overall score hides one failing area.
Instead: show the score by control area and by framework.
Treated as a pass mark
A target of 90% becomes the goal.
Instead: use the score to find gaps; the audit decides the result.
How does QULDEX handle this?
Readiness by framework and by audit, built from the controls, evidence and findings recorded in the platform.
Readiness Score: common questions
Is there a standard formula for audit readiness?
No. Standards require you to monitor and measure, but leave the measures to you. Document how your score is calculated.
Does a high readiness score mean we will pass?
No. It means your own records show few gaps. The auditor tests independently and may find issues your score does not capture.
How often should readiness be measured?
Continuously if your tooling allows, and reviewed at each governance meeting in the months before an audit.
Sources
- ISO/IEC 27001:2022, Information security management systems: Requirements
- NIST Cybersecurity Framework (CSF) 2.0
- ISO 19011:2018, Guidelines for auditing management systems
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
Readiness built from accepted evidence, not uploads
Controls, evidence, findings and corrective actions in one audit workspace.