Skip to main content
OpsRoadmaps

Checklists / audit-evidence-readiness

Audit Evidence Readiness Checklist

Can you produce evidence for a sampled control today, without a fire drill? Run this a quarter before the audit, not a week before.

8 steps · 7 required · last reviewed (next review 2027-03-20) · updated 2026-09-20

Related focus areas:ComplianceOps

Sign in to run this checklist

The purpose of this checklist is to convert the question "are we compliant?" into the question "can we show it?" — which is answerable. An organisation with good practice and no evidence fails an audit; an organisation that produces evidence continuously mostly stops noticing audits.

Pick three controls at random and actually produce their evidence while running this. A control you cannot evidence in an hour is a control you will scramble for later.

  1. Every control has a named owner who knows they own it

    required

    Ownership recorded in a spreadsheet nobody has read is not ownership. Ask the person.

  2. Each control states what evidence satisfies it, specifically

    required

    "Access is reviewed" is a claim. "The quarterly export from the IdP, approved in ticket X" is evidence.

  3. Evidence is generated by the system that performs the control, not re-typed

    required

    Hand-assembled evidence is expensive, late, and drifts from what the system actually did.

  4. Evidence carries a timestamp and a provenance you can explain to an auditor

    required

    A screenshot with no date and no source proves that someone had a screenshot.

  5. A sampled control can be evidenced end to end within one working day

    required

    This is the real readiness test. Time it.

  6. Control failures are recorded as findings with remediation owners and dates

    required

    A control that failed and was quietly fixed is still a finding. Suppressing it is what turns an audit into a problem.

  7. Scope is written down: which systems, which data, which period

    required

    Most audit pain is scope discovered late. Agreeing scope early is free.

  8. Evidence collection is automated for the controls that repeat monthly or more often

    optional

    Automate by frequency, not by importance — the monthly control is where the manual cost actually lives.

Run it against your real gaps

A checklist is most useful when you know which controls you are actually missing. A free OpsRoadmaps assessment scores your controls with explainable findings and builds a roadmap from the results.

Assess my stack

Checklists document self-reported practice. Items were last reviewed 2026-09-20 — adapt them to your own environment.