How we take you from gap to audit-ready
Every readiness engagement follows the same four stages, so you always know what happens next and what you will have at the end.
Four stages
Timelines depend on your size and how many controls already exist. These are typical for a mid-sized organization.
Scope
We agree which systems, locations and criteria are in play, and who owns each control.
1–2 weeks
Assess
We interview owners, inspect evidence and test design. You get a gap report ranked by audit risk.
2–4 weeks
Remediate
Your team closes the gaps with our policies, templates and weekly check-ins.
4–12 weeks
Rehearse
We run a mock audit, then support you through the real one.
1–2 weeks
What you receive
Everything is yours to keep and reuse at the next audit cycle.
- Scoping memo
- Systems, locations, criteria and control owners in scope, agreed in writing.
- Gap assessment report
- Each control rated ready, partial or gap, ranked by the risk of an audit exception.
- Remediation plan
- Owners, due dates and the evidence your auditor will ask for, item by item.
- Policy and evidence templates
- Access review, change ticket, risk register and vendor review templates adapted to your tools.
- Mock audit results
- Walkthrough notes and sample testing that mirror your auditor's request list.
Choose how involved we are
Pick one model or combine them as your needs change through the year.
Project
A defined-scope engagement, such as a readiness assessment or implementation review, with a set end date.
Readiness · ReviewsRetainer
Ongoing support between audits, with quarterly check-ins and renewal preparation.
Ongoing complianceCo-source or outsource
We work beside your internal audit staff, or run the IT audit program and report to your audit committee.
Internal audit · SOXSecondment
Our people join your team under your direction for a set period.
Staffing