Most of the preparation happens in the two weeks before the audit and comes down to five tasks.
- Fix what you already know is broken. If the quarterly access review was skipped over the summer, run it now and record it with today's date. A finding about a problem you already knew of tells you nothing new.
- Send documents and access a week ahead: the scope statement, Statement of Applicability, risk assessment and treatment plan, policies, earlier findings, and read access to the systems where evidence lives. An auditor who has read the documents spends the interviews on how things really work.
- Brief the control owners. Tell them what the audit is for and that findings are expected, then book 30 to 60 minutes with each.
- Know where your records live. The auditor will ask for tickets, logs and reviews. An answer such as "it's in Jira, in the SEC project" saves a lot of time.
- Leave existing records unchanged. A backdated review or a record created the night before is easy to spot, because system timestamps show it. The certification auditor will look at the same evidence a few weeks later, too.
Good preparation often shortens the fieldwork by a full day and leaves more time for fixing the findings.