It can still work, with a tight plan and no slack.
- Weeks 1 and 2: the internal audit, from planning to closing meeting. Choose an auditor who is available straight away and send the documents on day one.
- Week 3: the report arrives and the management review takes place with the findings on the agenda. Both have to exist before Stage 1.
- Weeks 3 to 6: close the findings, majors first. A major nonconformity is a requirement not met at all, for example no risk assessment for a key system or no access reviews ever. Minors, such as one review done late, can stay open at the certification audit if each has an owner, a deadline and a corrective action plan.
If the internal audit turns up several majors that cannot be fixed in three weeks, ask the certification body to move the date. Moving by a month or two is routine for them. A Stage 2 that ends with open majors usually costs more, because the certificate is delayed anyway and a follow-up visit is billed on top.
Check when Stage 1 falls. If it lies inside these six weeks, the internal audit and management review have to be finished by that earlier date.