A6 · Advisory
Audit-Ready Review
Five days to find what the auditor will find, before the auditor finds it. For ISO 42001, SOC 2 with AI in scope, or a customer's AI red-team requirement.
A date on the calendar is the only deadline that moves budget
An ISO 42001 certification audit, a SOC 2 renewal that now includes AI in scope, a customer's AI red-team requirement, or a regulator's information request — each creates a fixed date and a real budget.
The failure mode is predictable. Evidence exists but is scattered across six systems and three inboxes. Policies were written for a different technology. Model documentation lives in a repository the compliance team cannot read. None of that is discovered until the auditor is in the room, when the cost of a finding is highest.
This is preparation, not assurance. No opinion is issued and no certification results. The output is the list of findings an auditor would raise, ranked, with the fastest route to closing each one.
What you get
-
Scope agreement
Which audit, which standard, which systems are in scope — agreed on day one so nothing expands mid-engagement.
-
Evidence review against the audit's own criteria
Policies, inventory, training records, vendor contracts, impact assessments, incident logs and model documentation, checked against ISO 42001 clauses, SOC 2 AI-related controls, or the red-team's scope document.
-
Ranked gap list
Every finding an auditor would raise, ordered by severity, each with the fastest fix and an estimate of the effort to close it before the audit date.
-
60-minute readout
With the compliance lead. Optionally, mock auditor interviews with the people who will actually be questioned — usually the highest-value hour of the engagement.
Scope
Fixed on both sides. Anything outside it is a separate engagement, quoted separately.
Included
- One audit or standard in scope
- Evidence review across the named systems
- ISO 42001 or SOC 2 AI-control checklist
- Ranked gap list with remediation routes
- 60-minute readout
- Mock auditor interviews (at the $15,000 tier)
Not included
- The audit itself, or any assurance opinion
- Remediation — we identify, you or your partners fix
- Non-AI scope of a SOC 2 or ISO engagement
- Certification body liaison
- Penetration testing or technical red-teaming
- Legal advice
How it runs
| Day 1 | Scope call. Evidence request list issued. |
|---|---|
| Days 2–3 | Evidence review against the audit's criteria. Gaps logged as found. |
| Day 4 | Gap list assembled and ranked; fastest fix identified for each. |
| Day 5 | 60-minute readout. Optional mock interviews with the people who will be questioned. |
Common questions
Do you also perform the audit?
No — and we will not. NEUBoard does not issue assurance opinions or act as a certification body, so there is no conflict in preparing you for someone else's audit. We are happy to be introduced to your auditor and to say exactly this to them.
What if the gaps are too large to close in time?
Then you will know that 30 to 90 days out instead of on the day, which is the entire point. The gap list separates what must close before the audit from what can be a documented, in-progress remediation plan — auditors treat those very differently.
We're being asked about AI in a SOC 2 renewal. Is that in scope?
Yes, that is one of the two most common triggers. We review the AI-related controls only. If your auditor raises questions across the rest of the SOC 2 scope, we will refer you rather than take the work.
What are mock auditor interviews?
We question the people the auditor will question — the system owner, the compliance lead, whoever signed the policy — in the manner and sequence an auditor would. It surfaces the answers that are true but sound evasive, which is where most findings actually originate.
This is audit preparation, not assurance. NEUBoard issues no audit opinion, certification, or attestation, and is not a certification body. Findings reflect our reading of the applicable criteria as at the engagement date and do not bind any auditor or certification body.
When is your audit?
If it's inside 90 days, this is worth a conversation now. If it's further out, we'll tell you when to come back.