Volta Risk & Response: Five Weeks to Stage 1

What stage 1 actually does

Stage 1 is a readiness evaluation, not a warm-up. The auditor checks that the management system's documented information covers the requirements and the scope, that the organisation has understood its context and the standard's expectations, that internal audit and management review have been performed, and that stage 2 is feasible. It exists so that a certification decision is not based on a system that has never been run.

What the evidence suggests

• Policy signed by a departed director and not re-approved: a leadership and document-control finding.
• Twelve procedures still in draft and four undated: the process descriptions an auditor would audit against are not approved, so conformity cannot be demonstrated.
• Internal audit performed by managers on their own departments, with no competence records: the audit is not independent and its competence is unproven. This is a substantive gap, because internal audit is a prerequisite rather than a nice-to-have.
• No management review in the cycle: another prerequisite unmet.
• A four-year-old risk assessment that predates a new conflict-affected contract: the risk basis for the scope is out of date, which puts the scope itself in question.
• Three open corrective actions with one unowned, from a firearm discharge: a safety-critical follow-up failure.

Likely outcome

Not ready. The auditor may raise findings and recommend postponement of stage 2 until internal audit and management review are performed and the findings are addressed. The report typically states areas of concern and can recommend that stage 2 not proceed.

Why 'fix it during stage 2' fails

Stage 2 verifies implementation and effectiveness through evidence and sampling. It does not accept promises, and an auditor who finds that internal audit and management review still have not happened cannot recommend certification. Attempting it wastes the fee, damages credibility with the client base, and creates a documented history that the next auditor will read.

Sequenced plan

1. Week 1 - leadership and document control. Re-approve the security policy with a current, authorised signatory; confirm the scope statement is accurate for all three countries; move all 41 procedures into a controlled repository, force a decision (approve or withdraw) on the 12 drafts, and date the undated four. Internal audit cannot audit against unapproved procedures, so this must come first.
2. Week 1–2 - the firearm discharge corrective actions. Assign the unowned action, verify whether the other two were effective, and close or re-plan with evidence. This is the highest-severity open item and an auditor will sample it.
3. Week 2 - risk assessment refresh. Update the assessment to include the conflict-affected contract. If the risk controls for that contract are not implemented, either implement them or reconsider the scope; do not carry it in scope on paper only.
4. Week 3 - internal audit. Use competent, independent auditors (trained internal staff from another function, or a contracted auditor under the organisation's control) covering all clauses and all three countries at a sampling level. Two weeks is tight for three countries; prioritise high-risk processes and sites.
5. Week 4 - management review. It must take the audit results and refreshed risk assessment as inputs, so it cannot precede the audit. Record decisions with owners and dates.
6. Week 4–5 - evidence housekeeping. Make training records accessible to those who need them with access control, reconcile any gaps, and brief interviewees so top management can explain the system in their own words.

Where the plan is genuinely at risk

The internal audit and management review are the critical path; if auditor competence or country access slips, the whole sequence fails. A realistic option is to ask the certification body to move stage 1 by three to four weeks, or to narrow the certification scope to the countries that can be evidenced, and add the others at a later surveillance or extension audit.

Why exclusion looks attractive and why it is risky

Excluding the contract would remove the stale risk assessment problem and reduce the audit sampling burden. But scope must reflect what the organisation actually does, and exclusions must be justified and must not mislead clients or other interested parties. A security provider that excludes its most sensitive operation from certification while presenting the certificate commercially is exposed on two fronts: the certificate misrepresents capability, and the excluded activity becomes an uncontrolled risk that no part of the management system is watching.

The better question

Is the contract's control set implemented? If the risk assessment is refreshed and controls for that region are genuinely in place - vetting, use-of-force rules, supervision, incident reporting, grievance channel - the contract should be in scope, and the work is a two-week catch-up rather than an exclusion. If controls are not in place, that is a serious operational finding independent of certification: the answer is to fix the operation, not to shrink the scope around it. A temporary, time-bound exclusion is defensible only where the activity is genuinely separate, the client is informed, and a dated plan exists to bring it in.

Communication

• To top management: present it as a decision with consequences - proceed and risk a failed or postponed stage 1, delay by three to four weeks, or narrow scope with a plan to extend. State the cost and client impact of each, and record the decision and its owner. The auditor should not be asked to make a management decision.
• To the certification body: be explicit and early about the scope, the exclusions and their justification, and about the stage 1 readiness gaps. Transparency lets the body schedule realistically; concealment surfaces at stage 2 as a finding about the integrity of the system and the client relationship.
• To staff: explain that the delay or scope change is about evidence, not blame, and set out what each function must produce - otherwise the readiness work is treated as an audit chore rather than an operating discipline.