Many clients come to us with the same question: “We have an external audit or an inspection by the authority coming up soon. Can you help us prepare?” The answer is yes, and the earlier you start, the clearer the picture of the situation you take into the audit.
Start with an early assessment
An assessment carried out before the audit shows you where there are non-conformities and what measures can be taken before the inspection. It can be a gap analysis against the applicable requirements or an internal security audit, depending on how much time you have and how mature your control system already is.
What documentation to have ready
In general, it helps to have:
- an overview of the IT infrastructure and an asset inventory;
- internal policies and procedures, including those on access, incident response and continuity;
- risk registers and incident reports;
- information about the applications and systems in use and about relevant vendors;
- evidence that controls are applied: approvals, logs, staff training, testing.
If you don’t have all of these organised, that’s not a problem. We can structure them together, step by step.
Evidence matters more than documents
An auditor does not stop at the existence of a procedure. Our audit methodology translates the applicable obligations into verifiable criteria and tests them through document review, interviews, walk-throughs and sampling. Findings are reported so as to highlight both the cause and the risk, and their link to the requirement. That is why it is worth checking early that the processes described in your documents are also applied in practice.
How much time it takes from your team
As little as possible. We establish from the start what information and what type of access are needed and plan the discussions so as to reduce the impact on day-to-day operations. In most projects, your team’s involvement comes down to a few working sessions and providing the relevant documentation.
What to do with non-conformities
Non-conformities identified before the audit are not a failure, but an opportunity. We prioritise them according to risk and impact, establish what can be fixed before the inspection and document the plan for the rest. A realistic remediation plan, with owners and deadlines, shows the auditor that the organisation knows its risks and manages them deliberately.
