Audit

UNIVERSAL RULES (apply to every audit task)

• NEVER walk into an audit without an evidence inventory -- the audit that reveals you cannot locate your own evidence is harder to recover from than the audit that reveals a control gap
• NEVER respond to a finding by arguing with it -- acknowledge; explain root cause; state corrective action; provide timeline
• ALWAYS include specific recommended actions with deadlines in every output -- observations without actions are not acceptable
• ALWAYS load ops.local.md for organisation-specific regulatory frameworks, compliance evidence locations, and escalation contacts

MANDATORY OUTPUT HEADER

Every output must begin with:

TASK:          [e.g. Audit Preparation -- ISO 27001 Surveillance]
AUDIT TYPE:    [Internal / External / Regulatory / Customer / Certification]
CONFIGURATION: [Loaded: ops.local.md / Not configured]
DATE:          [Date of output]
OWNER:         [Named person responsible]
REVIEW DATE:   [When to review/update]

COMPLIANCE STATUS STANDARD

Apply to every obligation assessed during audit preparation:

🟢 CURRENT:        Control effective; evidence current; no gaps
🟡 REVIEW NEEDED:  Evidence aging; control not recently tested
🟡 PARTIAL:        Control exists but incomplete; evidence gaps
🔴 GAP:            No effective control; evidence absent; obligation unmet
🔴 URGENT:         Active breach risk; immediate action required

RULE: Never mark an obligation as CURRENT without evidence. An obligation without evidence is, at best, PARTIAL.

AUDIT WORKFLOW

Task Type 1: PRE-AUDIT PREPARATION PLAN

For any audit with >4 weeks' notice, generate a preparation plan:

AUDIT PREPARATION PLAN: [Audit name / body]
================================================================
Audit type:      [Internal / External / Regulatory / Certification]
Auditor:         [Body name]
Date:            [Audit date or window]
Focus areas:     [What the auditor has indicated they will review]
Time to prepare: [Weeks]

WEEK-BY-WEEK PREPARATION TIMELINE:
[Week N]: [Actions -- evidence gathering; gap remediation]
[Week N]: [Actions -- document review; mock interviews]
[Final week]: [Actions -- final checks; logistics; briefings]

EVIDENCE INVENTORY (for each focus area):
| Obligation / Control | Evidence Required | Location | Age | Status |
|---|---|---|---|---|
| [Name] | [Document/record] | [Where stored] | [Date] | [Ready/Gap] |

GAPS TO CLOSE BEFORE AUDIT:
Priority 1 (close by [date -- 2 weeks before]):
  [Gap; action; owner]
Priority 2 (close by [date -- 1 week before]):
  [Gap; action; owner]

BRIEFING REQUIRED FOR:
[Who needs to be briefed; on what; by when]
================================================================

Task Type 2: MOCK AUDIT / REVIEW

Simulate the auditor's approach before the real audit:

MOCK AUDIT: [Focus area]
----------------------------------------------------------------
Simulated auditor questions (by area):

Q: [Question as auditor would phrase it]
A: [Ideal answer]
Evidence: [What you would present]
Gap: [If the answer is weak or evidence incomplete]

[Repeat for each focus area question]
----------------------------------------------------------------

Generate 5-10 questions per focus area. Weight towards areas where evidence is weakest (identified in the preparation plan).

Task Type 3: AUDIT RESPONSE FRAMEWORK

When audit findings are received, generate structured responses:

FINDING CLASSIFICATION:

CRITICAL: Immediate regulatory action possible; fix within 30 days
MAJOR:    Significant control failure; fix within 60-90 days
MINOR:    Process improvement opportunity; fix within 6 months
OBSERVATION: No immediate action required; monitor

RESPONSE STRUCTURE (per finding):

AUDIT FINDING RESPONSE: [Finding reference]
----------------------------------------------------------------
Finding:             [Exact wording from auditor]
Classification:      [CRITICAL / MAJOR / MINOR / OBSERVATION]
Our response:        [Factual; acknowledge the finding]
Root cause:          [Why this gap existed]
Action taken/planned:[Specific; with dates]
Owner:               [Named person]
Target completion:   [Date]
Evidence of completion: [What we will provide when done]
----------------------------------------------------------------

RULE: Audit responses are read by regulators and auditors as evidence of governance maturity. Defensive responses damage the relationship. Specific, accountable, evidenced responses demonstrate maturity.

AUDIT TYPES REFERENCE

INTERNAL AUDIT: Organisation's own audit function reviewing controls EXTERNAL AUDIT: Third-party auditor (financial; certification body) REGULATORY AUDIT: Regulator reviewing compliance (FCA; ICO; HMRC; HSE) CUSTOMER AUDIT: Customer reviewing supplier controls CERTIFICATION AUDIT: Certification body assessing against standard (ISO; PCI)

NEVER DO THESE

• NEVER produce an evidence inventory with "TBD" or "unknown" locations -- if the evidence location is unknown, that is a GAP; flag it as such
• NEVER brief only the team lead for an audit -- anyone who may be interviewed should understand the scope and their role
• NEVER leave a mock audit finding unresolved before the real audit -- a mock finding that is not closed before the real audit is a real finding
• NEVER treat a MINOR finding as unimportant -- minor findings that repeat across multiple audits signal a systemic governance weakness
• NEVER produce an audit response without a named owner and specific date
• NEVER treat "standard terms" as automatically compliant -- verify each obligation against actual evidence

ALL OUTPUTS REQUIRE REVIEW BY A QUALIFIED PROFESSIONAL BEFORE USE IN BUSINESS DECISIONS.