Audit preparation

Audit Preparation

Audit Readiness Checklist by Audit Type

SOC 2 Type II

• Trust Service Criteria (TSC) mapped to controls
• Control evidence collected for full audit period (typically 6-12 months)
• Vendor management program documented (SOC reports for critical vendors)
• Logical access reviews conducted at least semi-annually
• Change management process documented with approval evidence
• Incident response policy and incident log maintained
• Vulnerability scanning performed quarterly; penetration test annually
• Business continuity / disaster recovery tested and documented
• Employee background checks and security training documented
• Encryption standards documented for data at rest and in transit

ISO 27001

• Information Security Management System (ISMS) scope defined
• Risk assessment methodology documented and applied
• Statement of Applicability (SoA) completed (114 controls, Annex A)
• Risk treatment plan with residual risk acceptance documented
• Internal audit performed before external certification audit
• Management review meeting held and documented
• All mandatory documented information in place (policies, procedures)
• Corrective actions from prior nonconformities closed

PCI DSS (see also pci-dss.md)

• CDE scope document prepared
• Network diagrams current and accurate
• All 12 requirements assessed with evidence
• Penetration test report current (< 1 year)
• ASV scan reports current (quarterly)
• Patch levels current on all in-scope systems

HIPAA

• Risk analysis completed and documented
• Risk management plan with safeguards implemented
• Workforce training records current (annual)
• Business Associate Agreements in place
• Breach notification procedures documented
• Sanction policy documented and applied

Evidence Collection Strategy

Evidence Repository Structure

audit-evidence/
├── access-control/
│   ├── access-reviews/          # Quarterly access certification records
│   ├── user-provisioning/       # Joiner/mover/leaver records
│   └── privileged-access/       # PAM reports, admin account list
├── change-management/
│   ├── change-tickets/          # Approved change records
│   └── deployment-logs/         # Evidence of change review
├── vulnerability-management/
│   ├── scan-reports/            # Quarterly VA scan results
│   ├── pen-test-reports/        # Annual pen test + remediation
│   └── patch-records/           # Patch application evidence
├── incident-management/
│   ├── incident-log/            # Incident register
│   └── post-mortems/            # Root cause analysis docs
├── training/
│   ├── completion-records/      # Security awareness training completion
│   └── curricula/               # Training content documentation
├── vendor-management/
│   ├── vendor-assessments/      # Third-party risk assessments
│   └── contracts/               # DPAs, BAAs, service agreements
└── policies/
    ├── current/                 # All active policies with review dates
    └── prior-versions/          # Historical versions

Evidence Quality Standards

• Date range: Evidence must cover the full audit period
• Completeness: No gaps in periodic control evidence (e.g., monthly log reviews)
• Authenticity: Screenshots with timestamps; system-generated reports preferred over manual
• Traceability: Evidence links to the control it demonstrates

Control Documentation Standards

Control Template

Control ID: CC6.1-01
Control Name: Logical Access Authorization
Control Description: Access to production systems is authorized by the data owner
  and IT Security prior to provisioning.
Control Type: Preventive
Frequency: Per event (each access request)
Owner: IT Security
Evidence: Approved access request tickets in ITSM system
Testing Procedure: Select sample of access grants; verify approval prior to provisioning
Sample Size: 25 or 100% if population < 25
Last Tested: [Date]
Deficiencies: None / [Description]

Control Frequency Mapping

Frequency	Evidence expectation
Per event	Sample from population (25+ items or 100% if small)
Daily	Evidence for selected days + log summary
Weekly	Evidence for selected weeks
Monthly	All 12 months (or full audit period)
Quarterly	All 4 quarters
Annual	Completed once during period

Auditor Management

Pre-Audit Kickoff Checklist

• Confirm audit scope, period, and objectives
• Introduce key contacts (control owners, IT leads, legal)
• Establish evidence request process (shared folder, naming convention)
• Agree on communication protocol (single point of contact)
• Schedule fieldwork calendar (walkthroughs, interviews, evidence submission)
• Review prior audit findings — status of remediation

Fieldwork Phase

• Designate one internal coordinator per auditor team request
• Respond to evidence requests within agreed SLA (typically 48-72 hours)
• For interview preparation: brief control owners on scope; no coaching on answers
• Keep log of all evidence submitted (filename, control, date submitted)
• Flag any evidence gaps proactively — surprises erode auditor trust

Closeout Phase

• Review draft findings before report is finalized
• For each finding, provide: management response, root cause, remediation plan, target date
• Negotiate finding classification (Major vs Minor vs Observation) with factual evidence
• Track all findings to closure in a remediation register

Evidence Request Response Process

Request Intake Template

Request #: [Auditor ref]
Date received: [Date]
Control(s): [Control IDs]
Evidence requested: [Description]
Period: [Date range]
Assigned to: [Internal owner]
Due date: [Agreed date]
Status: Open / In Progress / Submitted
Date submitted: [Date]
File submitted: [Filename]

Common Evidence Turnaround Times

Evidence type	Typical prep time
System-generated reports	1-2 hours
Access review records	4-8 hours
Policy documents	1 hour
Sampling from ticketing system	2-4 hours
Interview scheduling	1-2 days
Custom queries from DBA	1-2 days

Gap Remediation Tracking

Remediation Register

Finding ID	Description	Severity	Root Cause	Owner	Target Date	Status	Evidence of Closure
F-001	MFA not enforced for VPN	Major	Config gap	IT Sec	[Date]	In progress
F-002	Annual access review not completed	Minor	Process gap	IT	[Date]	Complete	ticket-1234

Severity Definitions

Level	Definition	Remediation timeline
Major / Critical	Control failure creates significant risk of material misstatement or data breach	30-90 days
Minor / Significant	Control weakness, compensating controls exist	90-180 days
Observation	Best practice recommendation	Next planning cycle

Continuous Audit Readiness Program

Monthly Activities

• Review control evidence is being generated and stored
• Check patch levels on critical systems
• Verify access reviews are on schedule
• Review any incidents for control implications

Quarterly Activities

• Run internal control walkthrough (sample 5-10 controls)
• Validate ASV scan completed and results clean
• Update control documentation for any process changes
• Review vendor SOC 2 reports as received

Annual Activities

• Full internal audit against audit framework
• Update risk assessment
• Management review and sign-off on control effectiveness
• Employee security training completion verification
• Penetration test commissioned and completed