Audit preparation has a recognisable shape. A date is confirmed, a spreadsheet is circulated, and for several weeks a group of people who have other jobs reconstruct what happened over the past year from tickets, chat history and memory. It works, usually. It also tells you something important about the control environment, which is that nobody was watching it.
The Scramble Is a Symptom
Reconstruction is expensive in a way that rarely appears in a budget, because the cost is paid in the time of senior engineers and managers rather than in fees. But the more serious cost is what reconstruction cannot do: it cannot tell you a control failed in March. It can only tell you what evidence you can find in September about March.
A control that failed for two quarters and was tidied up before the audit passes the audit. It did not protect anything. The certificate is then accurate about the evidence and misleading about the organization, which is the outcome everyone involved would say they did not want.
What a Cadence Looks Like
Scheduled control checks: each control reviewed on a defined frequency appropriate to its risk, with the result recorded whether or not it passed.
Findings raised when found: a failed check becomes a tracked item immediately, with an owner and a date, rather than a note to revisit before the audit.
Evidence captured at the time: the artefact is produced as part of the check, dated then, rather than recreated later from whatever remains.
A standing readiness view: at any point in the year, someone can say where the organization stands without starting a project to find out.
“The goal is not to pass the audit. It is to already be in the state the audit is checking for, on a day nobody is checking.”
The Side Effect Worth Having
Organizations that move to a cadence usually report that the audit itself becomes uneventful, which is the intended result. The unintended one is more useful: they start finding control failures in the quarter they happen, when the cause is still known and the fix is still small. That is assurance doing the job it was supposed to do, rather than certifying a version of the organization that existed for six weeks.
