Direct answer: the easiest place to get TISAX wrong is before the assessment, not on assessment day. A mis-defined assessment scope or objective, or a poor-quality self-assessment, both stretch the timeline and the cost. When choosing a consultant, first confirm that they can get these two things right before you sign the audit-provider contract, and that they are clear that the audit provider and the consultant are two different roles.
Eight criteria
| Criterion | A question you can put to any consultant |
|---|---|
| Assessment scope and objectives | Which labels do my customers require? Which sites must be in scope? |
| AL2 versus AL3 | Is AL2 or AL3 right for me? How much internal effort does each take? |
| Self-assessment quality against VDA ISA | Who performs the self-assessment? How far must the evidence go? |
| Reuse of the management system | I already have ISO 27001: how much of it carries over? |
| Overlap with the CRA | Does my automotive product also have to comply with the CRA? |
| Who leads, and is it outsourced | Who actually runs the engagement? What are their qualifications? |
| Named cases and reference customers | Can you provide named cases or reference contacts in my industry and at my scale? |
| Clarity of the quote | Which deliverables are included? Which are not? How are extras charged? |
How Winners addresses these criteria
What follows is Winners' own account. Use the questions above to test us in exactly the same way you test any other consultant.
- Assessment scope and objectives: confirm the labels your customers require first, then define the scope and assessment objectives
- AL2 versus AL3: compare the audit fee and the internal effort together, not the assessment fee alone
- Self-assessment quality against VDA ISA: prepare evidence item by item against VDA ISA and run a rehearsal before the assessment
- Reuse of the management system: build on your existing ISMS and add the TISAX-specific requirements
- Overlap with the CRA: determine whether the product is an automotive digital product sold on its own; both sets of evidence share one management system
- Who leads, and is it outsourced: VP- and director-level consultants guide the whole engagement and nothing is outsourced; consultants hold ISO 27001 lead-auditor credentials
When you may not need a consultant
If you already run a mature ISO 27001 covering the same sites and your team knows the VDA ISA questions well, you can prepare on your own and go directly to an ENX-approved audit provider.
Related questions
- How do I estimate a TISAX budget? TISAX budget
- How long does TISAX take? ENX states that the overall timeline cannot be predicted; what you can control is the order of the three steps. TISAX timeline
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.