Audit Preparation Checklist

Phase 1 — ~8 weeks out: confirm scope & gaps

1. 1
   Lock scope

   Confirm in-scope systems, criteria/controls, and the observation window with the auditor.
2. 2
   Close readiness gaps

   Resolve every Partial/Not started item from your readiness assessment.
3. 3
   Assign owners

   Map each control area to an owner responsible for its evidence.

Phase 2 — ~6 weeks out: evidence & access

1. 1
   Build the evidence index

   Create a control-to-evidence map; identify the system of record for each artifact.
2. 2
   Run access reviews

   Perform and document access reviews for corporate and production systems; remediate exceptions.
3. 3
   Verify logging & backups

   Confirm logging, alerting, and restore-tested backups are operating and produce evidence.

Phase 3 — ~3 weeks out: dry run

1. 1
   Sample-test yourself

   Pull the same samples an auditor would (changes, access grants, incidents) and check the evidence holds up.
2. 2
   Tidy policies

   Confirm every policy is current, versioned, approved, and acknowledged.
3. 3
   Prep interviewees

   Brief control owners on likely questions and where their evidence lives.

Phase 4 — fieldwork week: logistics

1. 1
   Provision auditor access

   Set up read-only/observed access or a secure evidence share ahead of time.
2. 2
   Single point of contact

   Route all requests through the audit owner to avoid duplicate/conflicting answers.
3. 3
   Track requests to close

   Log every auditor request (PBC list) and its status; respond promptly to avoid drift.

Common last-mile misses

• Offboarded users still have access somewhere.
• Evidence screenshots without a timestamp or a source system.
• A policy that references a control you don't actually operate.
• Access reviews performed but not documented/retained.
• Backups configured but never restore-tested.