The Month Before the Audit
A breakdown of what typically happens inside companies in the month leading up to an audit.
Four weeks before the audit, the message goes out.
“Let’s start preparing.”
A list is shared.
Controls are reviewed. Evidence requirements are outlined.
At this point, everything appears manageable.
Week three.
Gaps start to surface.
- Access reviews are incomplete
- Logs are missing for certain periods
- Vendor documents are outdated
Owners are identified.
Tasks are assigned.
Follow-ups begin.
Week two.
Execution accelerates.
- Screenshots are taken
- Documents are updated
- Approvals are backfilled
Some controls are completed for the first time.
Others are reconstructed.
Coordination increases.
Slack threads multiply. Calendars fill up.
Week one.
Pressure peaks.
- Evidence is chased aggressively
- Exceptions are explained
- Edge cases are negotiated
Some items are completed just in time.
Some are partially addressed.
Everything is documented.
Audit week.
The system looks complete.
Evidence is organized. Responses are prepared.
Questions are answered.
The audit proceeds.
After the audit:
- Follow-ups stop
- Tasks slow down
- Ownership diffuses
The system returns to baseline.
What changed during those four weeks was not compliance.
It was urgency.
The audit did not fix the system.
It temporarily replaced it.
A month later, the same gaps begin to reappear.
Nothing persisted.