Category
Audit readiness
Preparing for an audit, working with an auditor, and what evidence collection looks like when it is not a spreadsheet.
19 articles
Audit readiness
Running a mock audit
A mock audit tests whether you can produce evidence under audit conditions. Who should play the auditor, what to scope, how to run it, and how to use findings.
6 min read
Audit readiness
An audit readiness checklist
A working checklist for the weeks before an audit: scope, documents, owners, populations, people, vendors and logistics, with what each item must show.
6 min read
Audit readiness
Assigning control owners who stay engaged
Naming a control owner takes a minute; keeping them engaged for an audit period is the real work. How to pick owners, define the role, and survive handovers.
6 min read
Audit readiness
Proving population completeness to an auditor
Before an auditor samples, they test the list you sample from. How completeness and accuracy testing works, and how to get a population accepted first time.
6 min read
Audit readiness
Screenshots vs system-generated evidence
When a screenshot is acceptable audit evidence, what it must show, why exports and system reports usually serve better, and how auditors test the reports.
6 min read
Audit readiness
How long to keep audit evidence
What SOC 2, ISO 27001, HIPAA and PCI DSS say about keeping evidence, what the audit cycle implies, and why privacy law limits how long you should keep it.
6 min read
Audit readiness
Continuous monitoring vs point-in-time audits
What an audit covers that monitoring cannot, what monitoring catches that an audit finds too late, and how auditors treat the output of your monitoring.
6 min read
Audit readiness
What auditors actually ask for
Fieldwork is mostly a request list. Knowing the shape of that list in advance turns a stressful three weeks into a week of sending things you already have.
3 min read
Audit readiness
Running several audits on one calendar
How to fit SOC 2, ISO 27001 and PCI DSS into one year: each audit's fixed dates, aligning or staggering fieldwork, and annual controls that serve all three.
6 min read
Audit readiness
Working well with your auditor
What your SOC 2 auditor or ISO certification body can and cannot help with, what to agree at kickoff, how to disagree with a finding, and what to ask after.
6 min read
Audit readiness
What to do when a control fails mid-period
A control failed partway through your SOC 2 or ISO 27001 audit period. How to contain it, measure the extent, find the cause, and tell your auditor.
6 min read
Audit readiness
Fixing gaps before the observation period starts
How to sort readiness gaps by type, decide which must close before a SOC 2 Type II period starts, prove each fix works, and pick a start date you can hold.
6 min read
Audit readiness
First-audit mistakes, and how to avoid them
The mistakes that make a first SOC 2 or ISO 27001 audit slower and messier: aspirational policies, unknown populations, ignored vendors and the draft report.
6 min read
Audit readiness
The PBC list: handling auditor requests
How to run an audit request list: triage, a tracker with the right fields, file naming, quality checks before you send, and keeping sensitive data out.
6 min read
Audit readiness
Preparing control owners for auditor interviews
Who auditors interview, the questions control owners and staff are asked, a one-page briefing for each owner, and the line between preparing and coaching.
6 min read
Audit readiness
What happens in an audit walkthrough
What an auditor does in a control walkthrough, what they are testing, what to have open on screen, and the mistakes that turn a one-hour session into three.
6 min read
Audit readiness
How auditors sample controls
How SOC 2 auditors set sample sizes, select items from your population and handle a failed sample, and how ISO 27001 certification audits sample instead.
6 min read
Audit readiness
Types of audit evidence, and which is strongest
Inquiry, observation, inspection and reperformance, ranked the way auditing standards rank them, and what that ranking means for the records you keep.
6 min read
Audit readiness
Planning your first audit timeline
Plan a first SOC 2 or ISO 27001 audit backward from the date it is needed: the steps that cannot be compressed, what each waits on, and where plans slip.
6 min read