TY Audit Ready

Know your gaps before the auditor does.

The audit date is in the diary. The evidence exists, somewhere: in the change tool, on the local share, in someone's mailbox. Most of it is fine. Some of it you're not so sure about.

TY Audit Ready finds what is missing before the auditor or inspector does. You then decide what to do about each gap, and raise it yourself. The conversation with the auditor starts from "we're in control: we know our gaps and this is what we decided", not from "we don't know where we stand".

For internal audits, external audits and regulatory inspections. Gert Taeymans has been the accountable lead in 11 regulatory inspections and audits, with zero critical findings.

The domains we cover

ITIL core

Incident, problem, change and configuration management, with the DORA or NIS2 questions your audit asks.

DR

Disaster recovery.

BCM

Business continuity management.

When an audit needs a speciality outside these, such as legal or cybersecurity, we can introduce a partner who covers it. If it isn't our field, we'll say so.

What is missing before the audit?

That is the one question the pre-audit check answers.

You share the evidence you have through a secure exchange. We review it control by control, grouped by domain. We don't judge it on paper alone: we check it with the people who produce it, in one contact day with your control owners, mainly where the evidence is partial or missing.

What you get:

  • A findings register: per control, the evidence found, its status, a risk rating in your own risk scale, and our recommendation.
  • A one-page management summary, with the decision needed for each finding.
  • A findings presentation to your sponsor and control owners.
  • A decision session, where you respond to each finding: mitigate it, accept the risk, or disagree with the finding.
  • Draft risk register entries for the findings at or above the level you set. You enter them.
  • A draft position statement for the auditor: your known gaps, and what you decided. It is yours; we never sign it.

Priced per domain, excluding VAT:

ITIL core

from €14,500

DR

from €6,500

BCM

from €11,500

The domains add up: a check of all 3 domains starts from €32,500. Too much for this year? Start with the subdomains you need most; the price follows the scope. Book it at least six weeks before the audit.

The check is a check. It doesn't include remediation, or a remediation plan. It is a readiness review, not assurance: we don't attest or certify compliance.

Pre-audit diagnostic

The check asks what is missing. The diagnostic asks why it is like this. We interview your control owners on the reasoning behind the evidence, or behind its absence, and find the root causes in policy, process and people.

Book it at least eight weeks before the audit. Fee in the proposal.

Post-audit diagnostic

The audit went badly. We work out what the findings really mean, the account you give your board and your regulator, and what a Build must cover to close them.

Fee in the proposal.

Audit coaching

An audit can still go wrong in the room. Coaching prepares your people for the talks with the auditors: answer what is asked, present known gaps with the decision you took, and don't speculate. Truthful, controlled communication. It is never about handling the auditor.

€4,500 per half-day, for up to six people, excluding VAT. With a check, or on its own.

Closing the gaps

Remediation is not part of the check. When you want us to fix what the check found, that is a Build, scoped to the findings. How long it takes depends on what we find, so the fee is set in the proposal. After the Build, the check can run again.

What you are probably thinking

"Our auditor will find it anyway."

Yes, if it is there. The difference is who finds it first. A gap you raise yourself, with the decision you took, shows control. A gap the auditor finds has to be explained.

"We can check our own evidence."

You can, and you should keep doing it. But the people who produce the evidence know what it means; the auditor doesn't. Only an outside view is truly neutral. And because we are not your auditor, we stay on your side: what we find is yours to decide on.

"Six weeks is not enough to fix everything."

It isn't meant to be. The check gives you a decision on every gap, not a fix for every gap. Known gaps with a decision behind them read very differently from gaps nobody knew about.

"Will you tell the auditor we're compliant?"

No. The check is a readiness review, not assurance. The position statement is yours, in your words; we draft it, we never sign it.

On the roadmap: a home for your audit evidence

Today, evidence goes to and from us through a secure exchange. We are building TY Audit Ready into a place where your audit evidence stays, year after year, and is found quickly when an auditor asks. Not yet available:

Evidence by domain

A structure set up by us, hosted in the EU and backed up. Nothing is deleted without your consent; retention follows your own policy.

Validity reminders

A validity date on each document, reminders well before it passes, and one list of everything past due.

Auditor access

Auditor accounts on the folders you choose, so you show exactly what was asked for, nothing more.

Yearly tidiness check

We check the store is in order once a year. A check of the structure and access rights, not a review of the evidence.

Also planned: with each pre-audit check, the evidence store until 60 days after your audit, so you can see how it works before you decide to keep it.

Start with your audit date

Tell us when the audit is and which domains it covers. In the form below, choose "TY Audit Ready: pre-audit check", or "TY Audit Ready: pre- or post-audit diagnostic". For coaching on its own, choose "Something else".

 

All fields are mandatory

Turnstile *

This site and all contents is © 2026 Tymans Group BV