Name one person to coordinate with the auditor, keep a single request tracker, brief control owners in advance and hold a short daily check in during fieldwork. Most audit stress comes from unclear ownership and late answers, and a few simple habits remove much of it.
Pick one point of contact
One person receives requests, assigns owners and sends the answers. That person does not need to know every control. They need to know who does. Name a backup for leave or illness.
Set up the tracker
A shared sheet or the auditor's portal works. For each request track: number, control, owner, date received, due date, status and notes. Review it every day during fieldwork.
Brief the owners
Two weeks before fieldwork, tell each control owner which evidence they will probably be asked for and who to ask for help. Give them the dates. Ask them to look at their own evidence first and flag problems early.
Agree the logistics
Settle these with the auditor before kick off:
- Fieldwork dates and interview slots.
- How evidence is shared and who can see it.
- Expected turnaround for requests.
- How findings and draft wording will be shared.
Daily rhythm
A fifteen minute check in each morning covers new requests, blocked items and interviews that day. Keep a list of open issues. Clear it before the end of the week.
Protect the team
Block calendar time for control owners. If everyone is in meetings, answers slow down and mistakes rise. Tell the rest of the company that audit week is busy.
After fieldwork
Review the draft report carefully for factual accuracy, especially the system description and any exceptions. Hold a short retrospective: what slowed you down, what evidence was hard to find, and what to automate before next time.
Before the kick off call
Send the auditor a short note with your system names, who owns each control, any known gaps and the best time zone for calls. Ask for their request list early. If they send it in batches, ask for the full set so that you can plan.
Prepare a quiet room and a shared view
If fieldwork is remote, set up a screen share for walkthroughs and test it. Have the control owners ready to demonstrate a real example live. A few minutes of live demonstration often replaces a long chain of screenshots.
Common slip ups
Leaving evidence collection until the request arrives, assigning requests to someone on leave, and forgetting time zones. Check the plan against those three.
Plan for the unexpected
Auditors sometimes ask for new evidence late in the week. Keep a small buffer of time for it. If a key person falls ill, the backup contact should know where files are. A written handover note on the first day of fieldwork covers most surprises.
Quick check
How long should we take to answer a request?
Agree this with the auditor. Many teams aim for one to two business days for routine requests and tell the auditor early if one will take longer.
Last reviewed: 19 October 2026.
