The problem with the last-minute scramble
An audit date appears on the calendar. Teams begin searching shared drives, refreshing policies and asking who owns each control. The effort can be substantial, but the resulting evidence may still be inconsistent. The underlying problem is often the absence of a repeatable way to demonstrate how work is performed.
Start with what applies
Before collecting evidence, define the entity, systems, processes and obligations in scope. A clear applicability register helps distinguish relevant requirements from assumptions. Assign a business owner to each obligation and agree the period the evidence must cover. This makes the assessment more focused and reduces unnecessary requests.
Make evidence a by-product of operations
An approved access review, a tested backup, a recorded risk decision and a completed change record can all support assurance when they accurately reflect the activity performed. Define where these records live, who maintains them and how they are reviewed. Avoid creating documents solely to appear ready; the evidence should match actual control operation.
Put management decisions in the open
Some gaps require funding, a change of process or acceptance of residual risk. Maintain an action register with owners, target dates, dependencies and a clear escalation route. Give leadership a concise view of the decisions blocking progress. A finding without an accountable owner is unlikely to become a sustained improvement.
A practical first step
Choose one critical process, such as privileged access or incident response. Map its obligations, control owner, operating records and review cadence. Test whether another person can follow the evidence without a lengthy explanation. Use what you learn to improve the wider programme. The objective is a system that stays understandable and supportable between audits.
This article provides general guidance. Scope and applicable obligations should be confirmed for your organisation.