What does audit-ready mean?

What audit-ready looks like

For ISO 27001 and ISO 42001 it also means a Statement of Applicability, a completed internal audit and a management review, all done before the certification audit.

• Scope agreed. The systems, locations and services in scope are written down, and for SOC 2 so are the trust service criteria.
• Controls running. Each control has an owner and has operated long enough to produce evidence.
• Policies approved. Policies are signed off, published and acknowledged by staff.
• Risks assessed. A current risk register links each risk to the controls that treat it.
• Evidence findable. For any control an auditor names, the record can be produced quickly.

What it means for each audit

For SOC 2 Type I, controls need to be designed and in place on the report date. For Type II, they need to be in place before the observation period starts and then operate throughout it, so being ready means being ready to start that clock.

For ISO certification, the Stage 1 audit reviews documentation and whether you are ready for Stage 2, and Stage 2 tests whether the management system works in practice. Auditors look for records of the system running over time, such as risk reviews, meeting notes and completed actions, as well as the documents themselves.

How to check you are ready

Work through the framework’s requirements one at a time and attach evidence to each, the way the auditor will. Then run a mock sample: choose a few controls, ask the owners for the evidence, and see how long it takes and whether it covers the whole period.

An outside readiness assessment gives a second view. For ISO certification it has to come from someone other than your certification body, which is not allowed to consult for the organisations it certifies.

Related terms

Gap assessment

A comparison of current controls against a framework’s requirements, producing the list of gaps to close before an audit.

Evidence

Any record that shows a control operated: a configuration export, a ticket, a signed policy, an access review. Auditors sample evidence across the period they are reporting on.

Observation period

The window, usually three to twelve months, over which a SOC 2 Type II auditor tests whether controls operated. It starts once the controls are in place.

Internal audit

A review of the management system by someone independent of the area being audited. ISO 27001 and ISO 42001 require one before certification and at planned intervals after it.

Risk register

The list of identified risks with an owner, likelihood, impact, treatment and review date, linked to the controls that treat each one. Usually the first document an auditor asks to see.