How to prepare for a compliance audit

Few emails land quite like the one telling you an audit is scheduled. Even in a well-run business, the immediate reaction tends to be a mental scramble through everything that might not stand up to scrutiny.

That reaction is worth examining, because it reveals something useful. The anxiety usually isn’t about doing things badly — it’s about not being able to prove you’ve done them well. Most audit stress is an evidence problem, not a competence problem, and that’s a far more solvable thing.

This guide covers what auditors are really looking for, how to gather evidence without a fortnight of panic, the gaps that catch businesses out, how to prepare your team, what to expect on the day and what to do with the findings.

What auditors are actually looking for

An auditor is not trying to catch you out. They’re trying to answer one question: does this business do what it says it does, and can it show me?

That means they’re generally testing three things:

• Do you have the right things in place? The policies, processes and controls appropriate to your business.
• Are they actually being followed? Not just written down — happening, in practice, day to day.
• Can you evidence it? Records showing the process ran, over time, not just once last Tuesday.

The second and third points are where businesses come unstuck. A beautifully written policy that nobody follows is arguably worse than no policy, because you’ve documented the gap between intention and reality. Auditors notice that quickly — and it’s exactly why policies people actually follow matter more than comprehensive ones.

Gathering your evidence

Evidence is anything that shows a process happened. Records, logs, sign-offs, meeting notes, training records, dated approvals, system reports.

The realistic approach is to work backwards. Take each thing you’ll be assessed on and ask: if someone asked me to prove this, what would I hand them? If the answer is “I’d have to go and find out”, you’ve found a gap — and you’ve found it before the auditor did, which is the whole point of preparing.

A few things make this much less painful:

• Collect evidence as you go, not in the fortnight before. Evidence created retrospectively looks exactly like what it is.
• Keep it in one findable place rather than scattered across inboxes and someone’s laptop.
• Make sure it’s dated and attributable — an undated document proves very little.
• Cover a period, not a moment. Auditors want to see a process running consistently.

A lot of this now lives in systems rather than filing cabinets, which cuts both ways. Access logs, backup reports and change records are excellent evidence — but only if they’re retained and retrievable. Sensible IT support makes a real difference here, because the evidence is generated automatically rather than depending on someone remembering.

Common gaps

The same handful of issues come up again and again, and none of them are exotic:

• Policies that don’t match practice. The document describes a process the business abandoned two years ago.
• No record of training. Everyone was trained; nobody wrote it down; so as far as the audit is concerned, it didn’t happen.
• Reviews that never ran. The policy says it’s reviewed annually. The last review was three years ago, and the policy itself proves it.
• Unclear ownership. Asked who’s responsible for something, three people look at each other.
• Evidence that exists but can’t be found. Frustratingly common, and entirely fixable.
• Version confusion. Several copies of a document in circulation and no certainty which is current.

Notice the pattern: almost none of these are about the business doing the wrong thing. They’re about not being able to demonstrate the right thing. That’s good news, because it means preparation genuinely helps.

Preparing your team

Your team will probably be spoken to, and how they respond shapes the auditor’s impression more than any binder.

The single most important thing to tell them is this: answer honestly, and if you don’t know, say so. A confident guess that turns out to be wrong is far more damaging than “I’m not sure — the person who handles that is Sarah.” Auditors deal in accuracy, and they’re entirely comfortable being pointed elsewhere.

Beyond that:

• Make sure people know what they’re responsible for and where to find the relevant procedure.
• Explain what the audit is for — anxious staff give worse answers than informed ones.
• Be clear that it isn’t a test of them personally. It’s a check on the system they work within.
• Don’t script anyone. It’s obvious, it reads as evasive, and it invites more questions.

If your team’s honest answers would worry you, that’s worth knowing well before the auditor arrives — and it’s a signal about compliance culture rather than a briefing problem.

What happens on the day

The specifics vary a lot depending on who’s auditing and why, but the shape is usually familiar: an opening conversation about scope, a period of reviewing documents and asking questions, sometimes observing work or speaking to staff, then a closing summary of what they’ve found.

A few practical points. Give the auditor somewhere sensible to work and someone who can find things quickly — hours get lost to hunting for documents. Answer what’s asked rather than volunteering tours of adjacent topics. And if something is genuinely wrong, say so and explain what you’re doing about it. Auditors have seen everything; what they respond to is a business that knows its own weaknesses. Trying to conceal a gap tends to turn a minor finding into a serious one about honesty.

Acting on the findings

Findings are the point of the exercise. An audit that surfaces nothing has usually just told you the auditor didn’t look very hard.

When the report arrives, resist the urge to file it. Instead:

• Understand each finding properly before you fix anything — ask if it’s unclear.
• Look for the cause, not the symptom. A missing record is rarely just a missing record; usually the process doesn’t fit how people actually work.
• Give every action an owner and a date. Findings without both don’t get fixed.
• Prioritise honestly — deal with what matters rather than what’s easy.
• Check it stuck a few months later. Fixes decay.

The businesses that find audits easiest are the ones that treat them as a periodic health check rather than an exam. If your processes are genuinely working and generating evidence as they go, an audit is mostly an administrative morning.

What you’ll be audited against depends entirely on your sector, size and obligations, so this is general guidance rather than legal or regulated advice — the specifics really do vary. If you’d like help getting ready, get in touch and we’ll introduce a vetted compliance and governance specialist. We’re an independent introducer, so the guidance you get is theirs and there’s no obligation either way.