8 Steps to Prepare for a Security Audit (ISO 27001, SOC 2 or Customer Audit)
How to prepare for an ISO 27001, SOC 2 or customer security audit: scope, control mapping, evidence collection, GRC platforms, mock audits, interviews and managing findings.
A security audit tests whether the controls you describe are the controls you operate. Whether it is an ISO 27001 certification audit, a SOC 2 examination or a customer's on-site review, the organisations that do well are the ones that treat evidence as part of daily operations rather than a scramble in the final month.
These eight steps work for most security audits. Run the free GRC Compliance Readiness Assessment first to find the gaps an auditor is most likely to raise.
1. Confirm Scope, Criteria and Period
Agree with the auditor what is in scope (entities, systems, locations), which criteria apply (ISO 27001 clauses and Annex A, SOC 2 Trust Services Criteria or a customer's questionnaire) and, for SOC 2 Type 2, the observation period. Everything else depends on these decisions.
| Audit type | What is tested | Output |
|---|---|---|
| ISO 27001 certification | The ISMS clauses 4 to 10 and applicable Annex A controls | Certificate valid three years, with surveillance audits |
| SOC 2 Type 1 | Design of controls at a point in time | Attestation report from a CPA firm |
| SOC 2 Type 2 | Design and operating effectiveness over a period, often 3 to 12 months | Attestation report from a CPA firm |
| Customer audit | Contractual security requirements or a questionnaire | Findings and agreed actions |
2. Map Controls to Owners and Evidence
Build a control matrix: each control, the requirement it satisfies, the owner who operates it, how often it runs and the evidence it produces. Map once and reuse: a single access review can satisfy ISO 27001, SOC 2 and several customer questionnaires.
Control,ISO 27001:2022,SOC 2,Owner,Frequency,Evidence
Quarterly access review,A.5.18,CC6.2/CC6.3,IT Manager,Quarterly,"Signed review export + tickets for removals"
MFA enforced,A.8.5,CC6.1,IT Manager,Continuous,"IdP policy screenshot + user MFA report"
Security awareness training,A.6.3,CC1.4/CC2.2,GRC Lead,Yearly,"LMS completion report by team"
Incident response test,A.5.24,CC7.4,Security Lead,Yearly,"Tabletop agenda, attendance, lessons learned"3. Choose How You Will Manage Evidence
GRC platforms centralise controls, policies, risks, evidence requests and audit workflows, and many connect to cloud, identity and HR systems to collect evidence automatically. Common categories include compliance automation platforms aimed at SOC 2 and ISO 27001, enterprise integrated risk management suites and privacy management platforms.
A platform is not a prerequisite. A smaller organisation can pass audits with a structured tracker and a well-organised evidence folder, as long as every control has an owner, a due date and current evidence. Choose based on scope, how many frameworks you track and how much evidence can be automated.
4. Collect Evidence Continuously
Auditors sample evidence across the period, so a control that ran only in the month before the audit will fail. Schedule recurring control activities, such as access reviews, backup restore tests and vulnerability scans, and file the evidence when each one completes.
- Name files consistently: control ID, description and date.
- Capture system-generated reports where possible; they are more reliable than screenshots.
- Show who performed and who approved each review.
- Keep tickets that show follow-up actions were completed.
5. Close the Known Gaps First
Use your readiness assessment, last audit report and risk register to list known weaknesses. Fix what you can before the audit. For what you cannot, document the risk, the compensating controls and a dated plan; an honest, managed gap is far better received than one discovered by the auditor.
6. Run a Mock Audit
Ask someone independent of the control owners to sample evidence the way the auditor will: pick dates, request records and check that they match the policy. For ISO 27001 this is also your internal audit under clause 9.2. Fix what the mock audit finds and re-test.
7. Prepare People for Interviews
Auditors interview control owners and staff. Brief them on the scope, the controls they own and where their evidence lives. Encourage honest, specific answers: describe what you actually do, show the record, and say "I will find out" rather than guessing.
8. Manage Findings to Closure
Log every finding with its severity, root cause, owner, corrective action and due date. For ISO 27001, major nonconformities must be addressed before certification is granted, and corrective actions for minor ones are reviewed at the next audit.
Report progress to management until every finding is closed with evidence. The control ownership playbook shows how to keep teams moving, and the compliance reporting guide shows how to report status.
Frequently Asked Questions
What is the difference between SOC 2 Type 1 and Type 2?+
Type 1 reports on the design of controls at a single point in time. Type 2 reports on both design and operating effectiveness over a period, commonly three to twelve months.
Do you need a GRC platform to pass an audit?+
No. Platforms help with scale and evidence automation, but a structured control matrix, clear owners and a well-organised evidence repository can be enough for smaller scopes.
What is a major nonconformity in ISO 27001?+
A failure that raises significant doubt about the ISMS achieving its intended results, such as a required clause not being addressed at all. It must be corrected before certification can be granted.