# Audit Preparation

> When to activate: audit preparation, audit readiness, evidence collection, control documentation, auditor management, compliance audit, SOC audit, ISO audit, external audit

- Skill: `mattakushi432/audit-preparation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add mattakushi432/audit-preparation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mattakushi432/audit-preparation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Mattakushi432 (https://skillmd.com/u/mattakushi432)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mattakushi432/audit-preparation

---


# Audit Preparation

## Audit Readiness Checklist by Audit Type

### SOC 2 Type II
- [ ] Trust Service Criteria (TSC) mapped to controls
- [ ] Control evidence collected for full audit period (typically 6-12 months)
- [ ] Vendor management program documented (SOC reports for critical vendors)
- [ ] Logical access reviews conducted at least semi-annually
- [ ] Change management process documented with approval evidence
- [ ] Incident response policy and incident log maintained
- [ ] Vulnerability scanning performed quarterly; penetration test annually
- [ ] Business continuity / disaster recovery tested and documented
- [ ] Employee background checks and security training documented
- [ ] Encryption standards documented for data at rest and in transit

### ISO 27001
- [ ] Information Security Management System (ISMS) scope defined
- [ ] Risk assessment methodology documented and applied
- [ ] Statement of Applicability (SoA) completed (114 controls, Annex A)
- [ ] Risk treatment plan with residual risk acceptance documented
- [ ] Internal audit performed before external certification audit
- [ ] Management review meeting held and documented
- [ ] All mandatory documented information in place (policies, procedures)
- [ ] Corrective actions from prior nonconformities closed

### PCI DSS (see also pci-dss.md)
- [ ] CDE scope document prepared
- [ ] Network diagrams current and accurate
- [ ] All 12 requirements assessed with evidence
- [ ] Penetration test report current (< 1 year)
- [ ] ASV scan reports current (quarterly)
- [ ] Patch levels current on all in-scope systems

### HIPAA
- [ ] Risk analysis completed and documented
- [ ] Risk management plan with safeguards implemented
- [ ] Workforce training records current (annual)
- [ ] Business Associate Agreements in place
- [ ] Breach notification procedures documented
- [ ] Sanction policy documented and applied

## Evidence Collection Strategy

### Evidence Repository Structure
```
audit-evidence/
├── access-control/
│   ├── access-reviews/          # Quarterly access certification records
│   ├── user-provisioning/       # Joiner/mover/leaver records
│   └── privileged-access/       # PAM reports, admin account list
├── change-management/
│   ├── change-tickets/          # Approved change records
│   └── deployment-logs/         # Evidence of change review
├── vulnerability-management/
│   ├── scan-reports/            # Quarterly VA scan results
│   ├── pen-test-reports/        # Annual pen test + remediation
│   └── patch-records/           # Patch application evidence
├── incident-management/
│   ├── incident-log/            # Incident register
│   └── post-mortems/            # Root cause analysis docs
├── training/
│   ├── completion-records/      # Security awareness training completion
│   └── curricula/               # Training content documentation
├── vendor-management/
│   ├── vendor-assessments/      # Third-party risk assessments
│   └── contracts/               # DPAs, BAAs, service agreements
└── policies/
    ├── current/                 # All active policies with review dates
    └── prior-versions/          # Historical versions
```

### Evidence Quality Standards
- **Date range**: Evidence must cover the full audit period
- **Completeness**: No gaps in periodic control evidence (e.g., monthly log reviews)
- **Authenticity**: Screenshots with timestamps; system-generated reports preferred over manual
- **Traceability**: Evidence links to the control it demonstrates

## Control Documentation Standards

### Control Template
```
Control ID: CC6.1-01
Control Name: Logical Access Authorization
Control Description: Access to production systems is authorized by the data owner
  and IT Security prior to provisioning.
Control Type: Preventive
Frequency: Per event (each access request)
Owner: IT Security
Evidence: Approved access request tickets in ITSM system
Testing Procedure: Select sample of access grants; verify approval prior to provisioning
Sample Size: 25 or 100% if population < 25
Last Tested: [Date]
Deficiencies: None / [Description]
```

### Control Frequency Mapping
| Frequency | Evidence expectation |
|-----------|---------------------|
| Per event | Sample from population (25+ items or 100% if small) |
| Daily | Evidence for selected days + log summary |
| Weekly | Evidence for selected weeks |
| Monthly | All 12 months (or full audit period) |
| Quarterly | All 4 quarters |
| Annual | Completed once during period |

## Auditor Management

### Pre-Audit Kickoff Checklist
- [ ] Confirm audit scope, period, and objectives
- [ ] Introduce key contacts (control owners, IT leads, legal)
- [ ] Establish evidence request process (shared folder, naming convention)
- [ ] Agree on communication protocol (single point of contact)
- [ ] Schedule fieldwork calendar (walkthroughs, interviews, evidence submission)
- [ ] Review prior audit findings — status of remediation

### Fieldwork Phase
- Designate one internal coordinator per auditor team request
- Respond to evidence requests within agreed SLA (typically 48-72 hours)
- For interview preparation: brief control owners on scope; no coaching on answers
- Keep log of all evidence submitted (filename, control, date submitted)
- Flag any evidence gaps proactively — surprises erode auditor trust

### Closeout Phase
- Review draft findings before report is finalized
- For each finding, provide: management response, root cause, remediation plan, target date
- Negotiate finding classification (Major vs Minor vs Observation) with factual evidence
- Track all findings to closure in a remediation register

## Evidence Request Response Process

### Request Intake Template
```
Request #: [Auditor ref]
Date received: [Date]
Control(s): [Control IDs]
Evidence requested: [Description]
Period: [Date range]
Assigned to: [Internal owner]
Due date: [Agreed date]
Status: Open / In Progress / Submitted
Date submitted: [Date]
File submitted: [Filename]
```

### Common Evidence Turnaround Times
| Evidence type | Typical prep time |
|---------------|------------------|
| System-generated reports | 1-2 hours |
| Access review records | 4-8 hours |
| Policy documents | 1 hour |
| Sampling from ticketing system | 2-4 hours |
| Interview scheduling | 1-2 days |
| Custom queries from DBA | 1-2 days |

## Gap Remediation Tracking

### Remediation Register
| Finding ID | Description | Severity | Root Cause | Owner | Target Date | Status | Evidence of Closure |
|-----------|-------------|----------|-----------|-------|-------------|--------|---------------------|
| F-001 | MFA not enforced for VPN | Major | Config gap | IT Sec | [Date] | In progress | |
| F-002 | Annual access review not completed | Minor | Process gap | IT | [Date] | Complete | ticket-1234 |

### Severity Definitions
| Level | Definition | Remediation timeline |
|-------|-----------|---------------------|
| Major / Critical | Control failure creates significant risk of material misstatement or data breach | 30-90 days |
| Minor / Significant | Control weakness, compensating controls exist | 90-180 days |
| Observation | Best practice recommendation | Next planning cycle |

## Continuous Audit Readiness Program

### Monthly Activities
- [ ] Review control evidence is being generated and stored
- [ ] Check patch levels on critical systems
- [ ] Verify access reviews are on schedule
- [ ] Review any incidents for control implications

### Quarterly Activities
- [ ] Run internal control walkthrough (sample 5-10 controls)
- [ ] Validate ASV scan completed and results clean
- [ ] Update control documentation for any process changes
- [ ] Review vendor SOC 2 reports as received

### Annual Activities
- [ ] Full internal audit against audit framework
- [ ] Update risk assessment
- [ ] Management review and sign-off on control effectiveness
- [ ] Employee security training completion verification
- [ ] Penetration test commissioned and completed