Are you ready for an audit or assessment?

Before you pay for an engagement, work through this checklist honestly. Every "no" is a gap to close first — closing it before the auditor arrives is cheaper than discovering it during fieldwork. Framework-specific scored quizzes live on each network directory.

The readiness checklist

• Do you know which framework applies? If not, start with the which-framework guide. Engaging an auditor for the wrong framework wastes the fee.
• Is there a named owner? One person accountable for the engagement, with time actually allocated — not a side-of-desk assignment.
• Are your systems and data flows mapped? You cannot scope what you cannot draw: systems in scope, data types, where they live, who touches them.
• Are policies written and approved? Security, access control, incident response, change management — written, approved, and dated.
• Do controls actually operate? Policies on paper with no evidence of operation will produce exceptions. Evidence must exist for the whole review period.
• Is access managed? Joiner/mover/leaver processes, least privilege, and periodic access reviews — the area that fails most first-timers.
• Can you produce logs? Centralized logging with retention that covers the review period, for the systems in scope.
• Is there an incident response plan — tested? A plan nobody has walked through is a finding waiting to happen.
• Are vendors in scope managed? Subservice organizations, their reports, and your complementary controls documented.
• Do you have 3–6 months of runway? Readiness, evidence collection, and the engagement itself take calendar time. A deal closing next month is not compatible with a first assessment.

Framework-specific scored quizzes with tailored remediation advice are on each network directory — for example SOC 2 readiness on soc2type2.com and GLP readiness on glpcompliance.com.