Audit preparation guide: a 90-day plan

Audits are won or lost in preparation, not in the audit room. The organisations that pass cleanly are rarely the most secure - they are the ones that can produce the right evidence quickly and answer questions consistently. This is a 90-day plan that works for ISO 27001, SOC 2, NCA ECC, SAMA CSF and most regulatory reviews.

Days 1-30: establish the baseline

• Confirm scope and criteria in writing with the auditor - what is in, what is out, which version of the standard, and the audit period.
• Assign a single audit coordinator. One person owns the evidence queue and all auditor communication.
• Run a gap assessment against every applicable control and score honestly. Optimism here becomes a finding later.
• Build the evidence index: one row per control, naming the artefact, its owner, its location and its date.
• Fix the structural gaps first - missing policies, no risk assessment, no internal audit. These take longest.

Days 31-60: generate and organise evidence

• Collect evidence from the audit period, not from today. Auditors sample across the window.
• Name files consistently: control reference, artefact, date. An auditor who can find things asks fewer questions.
• Complete the recurring activities that are easy to forget: access reviews, vulnerability scans, backup restore tests, incident response exercises, awareness training.
• Run your internal audit and management review - mandatory for ISO 27001, valuable everywhere else.
• Raise corrective actions for what you find, and evidence their closure. Self-identified and closed is a strength, not a weakness.

Days 61-90: rehearse and tighten

• Prepare the people who will be interviewed. Control owners should be able to describe what they do and show where it is recorded.
• Run a mock interview for each major control area. The goal is consistency - contradictory answers from two owners is a finding in itself.
• Pre-answer the predictable requests: org chart, asset inventory, policy set, risk register, access review records, change tickets, incident log, vendor list, training records.
• Verify sample integrity. Pull a random sample yourself and test whether the evidence holds up.
• Confirm logistics - dates, attendees, access, and how evidence will be shared securely.

During fieldwork

• Answer the question asked. Do not volunteer scope, systems or problems beyond it.
• Never guess. "I will confirm and come back to you within the hour" is a professional answer; a wrong answer becomes a finding.
• Log every request with the time received and time fulfilled.
• Ask for potential findings early so you can supply clarifying evidence before the report is drafted.
• Stay factual. Arguing with an auditor rarely removes a finding; better evidence sometimes does.

After the audit

1. Review the draft report for factual errors and challenge those with evidence.
2. Classify each finding and agree remediation dates you can actually meet.
3. Perform root cause analysis - auditors return to check whether the cause was addressed, not just the symptom.
4. Feed the findings into your risk register and next internal audit plan.

Key takeaways

• Appoint one coordinator and maintain one evidence index.
• Collect evidence from the audit period, not the audit week.
• Rehearse interviews - inconsistency between owners creates findings.
• Self-identified and remediated issues strengthen your position.