Audits test evidence
Whether the audit is an RBI IS audit, a SEBI CSCRF assessment, an IRDAI review or a certification audit, assessors ask the same underlying question: can you prove the control operated? Organisations that struggle usually have the controls but not the evidence.
Eight weeks before
Confirm scope and criteria
Obtain the audit scope, applicable circulars or standards and the period under review. Ambiguity about scope causes most last-minute panic.
Map controls to evidence
For each requirement, record the control, its owner and the evidence that proves it — reports, tickets, logs, screenshots and approvals. Store everything in one organised location.
Run a mock audit
An internal or independent pre-audit using the same criteria exposes gaps while there is still time to fix them.
Four weeks before
- Close quick-win gaps and document compensating controls for the rest
- Verify previous audit findings are closed with evidence
- Brief control owners on what they will be asked
During the audit
Interviews
Owners should explain how the control works and show evidence. Answer the question asked; do not speculate. If unsure, say you will confirm.
Requests
Track every auditor request with an owner and due date. Fast, complete responses build confidence.
Draft findings
Review draft observations carefully. Provide factual corrections with evidence — but accept genuine gaps.
After the audit
- Agree remediation actions with realistic dates and owners
- Report progress to management and the board
- Retain closure evidence for the next audit
- Analyse root causes to prevent repeat findings
Moving to continuous readiness
The strongest position is never needing to "prepare". Build evidence collection into daily operations — automated reports, ticket workflows and quarterly control self-assessments — so every audit is a review of business as usual.
Key takeaways
- Audits test evidence, not intentions.
- Map every requirement to a control, owner and evidence item.
- Close previous findings with proof and aim for continuous readiness.
Frequently asked questions
How early should audit preparation start?
Ideally continuously; in practice, begin structured preparation at least eight weeks before fieldwork.
What if we disagree with a finding?
Provide factual evidence during the draft-findings stage. If the gap is genuine, agree a realistic remediation plan instead.
Should we run a mock audit?
Yes. An independent pre-audit against the same criteria reveals evidence gaps while there is still time to fix them.
The best audit preparation starts the day after the last audit ends.
Our regulatory compliance practice provides mock audits, evidence reviews and audit support.
