HITRUST does not publish a ranked list of common audit findings, and we did not find one. Its own documents show where scores tend to slip: unwritten policies, controls that have not run for the required incubation period, coverage that stops short of the full scope, and no measurement. Plan around those and you avoid most surprises.
Safeguard does not hold a HITRUST certification. This is an explainer drawn from HITRUST's handbook and maturity paper, and the points are our reading, not statistics.
How does HITRUST score a control?
HITRUST evaluates each requirement across five maturity levels. Policy asks whether current documented policies fully address the requirement and apply to all in-scope units. Procedure asks whether written procedures exist and apply. Implemented asks whether the control is actually in place across the scope. Measured asks whether you test or track the control with metrics. Managed asks whether you act on those metrics, including root cause analysis and corrective action.
The paper notes that testing a control once for an annual audit will likely not satisfy the measured level for most controls. It expects periodic tracking over time.
Where do scores slip?
Unwritten practice. The scoring guidance distinguishes "no policy" from "unwritten policy", and its steps ask you to find relevant policies even when unwritten. A team that does the right thing but has nothing on paper still loses the policy and procedure levels.
Incubation periods. The handbook says controls must be implemented for a minimum of 90 days before testing, and this includes a newly implemented control or one remediated after a deficiency. Policies and procedures must be in place for at least 60 days before an assessor considers them, and the maximum fieldwork length is 90 days. A control rolled out the month before fieldwork starts will not count as implemented.
Partial coverage. Policy, procedure and implemented all ask about the organisational units and systems in scope. A control that works for production but not for a shared service or an acquired team scores lower.
No measurement. Many teams stop at implemented. Without metrics, such as the share of devices with current updates, the control cannot reach measured.
Reliance on providers. The handbook allows use of a service provider's control if you can show it has been implemented for 90 days, and inheritance from a provider's HITRUST certification or other third party report. You still need to confirm that the provider covers the requirement in your scope.
What does the timeline look like after certification?
HITRUST lists three assessment types with different validity: e1 for one year, i1 for one year and r2 for two years. For an r2, the handbook says an interim assessment must be submitted in the 90 day window leading up to the first anniversary to keep the certification for the full period. A bridge assessment can extend r2 status by 90 days after the recertification date has passed.
What to do
- Write policies and procedures first and give them 60 days before fieldwork.
- Start any new or remediated control at least 90 days before testing.
- Check that every requirement covers every unit and system in scope, not only the main one.
- Pick one metric per important control and record it monthly.
- Map each requirement to the provider that performs it and collect their evidence.
- Put the interim assessment window on the calendar when certification issues.
Quick check
How long must a control run before testing?
The handbook states a minimum of 90 days for controls and 60 days for policies and procedures before the assessor considers them.
Does an annual test count as measurement?
HITRUST's maturity paper says testing to support an annual audit will likely not satisfy the measured level for many controls. It expects periodic tracking over time.
Sources
- HITRUST: Assessment Handbook v1.2
- HITRUST: Evaluating Control Maturity Using the HITRUST Approach
- HITRUST: assessments and certifications
Last reviewed: 18 October 2026.
