Five findings come up again and again in first internal audits.
- Risk treatment that does not match the risks. Controls were picked from a template, so the treatment plan covers risks the company does not have and misses some it does.
- Access reviews that did not happen. The policy says quarterly, and the records show one review in the last twelve months.
- Backups that were never restored. Backups run every night, but nobody has tested whether a restore works.
- Missing supplier checks. The three or four providers that hold your data, such as the cloud host, the CRM and the payroll tool, were never assessed.
- No management review, or one that skipped the required topics. Leadership met, but the minutes do not cover audit results, risks or objectives.
Remote companies often have a sixth: policies that were approved but never shared, so employees cannot say where they are or what they contain.
Each of these takes a few days to a few weeks to fix. Found in your internal audit, they are tasks. Found at Stage 2, the same issues can be graded as major nonconformities and delay the certificate.