To prepare for a security audit, confirm the scope and criteria with your auditor, list every control with an owner, collect dated evidence for each, fix gaps, and rehearse the questions. Auditors test what you do against what you wrote, so real controls with records beat polished documents.
Key takeaways
- Start with scope and criteria. Everything else depends on them.
- Evidence must be dated and tied to a control.
- Auditors often sample over a period, so recurring controls need a trail.
- Name one owner per control and one contact for the auditor.
- Fix gaps before the audit. Do not backdate records.
What is a security audit?
It is an independent check of your controls against a standard or a contract, such as SOC 2, ISO 27001, HIPAA or a customer requirement. It differs from a penetration test, which tries to break in, and from a vulnerability scan, which finds known weaknesses.
How do you prepare for a security audit in 30 days?
Week 1: scope and gaps
- Ask the auditor for the criteria, the period and the evidence request list.
- Define which systems, people and locations are in scope.
- Run a gap check against the criteria. A readiness walkthrough shows the idea.
Week 2: owners and policies
- Assign an owner to each control and a lead for auditor questions.
- Confirm that each policy matches what the team does. Change the policy, not the story.
- Check the risk register is current and reviewed.
Week 3: evidence
- Collect dated evidence for each control: access reviews, change tickets, training records, backup tests, vulnerability remediation, incident records, vendor reviews.
- Name files so an auditor can find them.
- Note any control that did not run in a period and explain what you did about it.
Week 4: rehearse
- Hold a mock walkthrough. Have someone outside the control team ask the auditor's questions.
- Fix last gaps, and write down exceptions honestly.
- Brief staff who may be interviewed: answer what you do, do not guess.
What evidence do auditors usually ask for?
| Area | Typical evidence |
|---|---|
| Access | User lists, access reviews, offboarding records, MFA settings |
| Change management | Pull requests, approvals, deployment logs |
| Vulnerability management | Scan results, remediation tickets, patch records |
| People | Background check policy, training completion, signed policies |
| Incidents | Procedure, past incident records, postmortems |
| Vendors | Vendor list, reviews, contracts |
| Resilience | Backup and restore test records |
The exact list comes from your framework and auditor. For HIPAA the Security Rule names items such as a risk analysis, training programs, contingency plans and audit controls.
What mistakes cost the most time?
- Starting evidence collection after the audit begins.
- Policies that nobody follows.
- Evidence with no date or no owner.
- Scope that changed halfway.
- Backdating or editing records, which damages trust in everything else.
How can automation help?
Reminders and connectors reduce the chance that a recurring control slips. You still need owners who act. See how evidence collection can look in practice.
Click through it at your own pace, or open it full screen.
Frequently asked questions
How long before an audit should we start preparing?
Start as early as you can. A 30 day plan fits teams whose controls already run. If controls are new, you may need more time to build a record.
What if we find a gap before the audit?
Fix it, record the date and keep the ticket. Do not backdate evidence.
Who should talk to the auditor?
One named lead, with control owners joining for their areas.
Is a security audit the same as a penetration test?
No. An audit checks controls against criteria. A penetration test attempts to exploit weaknesses.
Sources
- 45 CFR 164.308 administrative safeguards (Cornell LII)
- NIST Risk Management Framework overview
- FTC cybersecurity for small business
Last reviewed: 19 October 2026.
