So you’re blessedly heading toward the finish line. You’ve put in months of blood, sweat, and tears to wrap up your compliance engagement, your organization has taken their responsibilities seriously, and you’re closing in on your first ever audit. Nervous, yet? Don’t worry — if you’ve taken compliance seriously, your on-site assessment doesn’t have to be a traumatic event. And if you prepare for the audit itself, you can make it a smooth and relatively pain-free experience.
I’ve been through countless on-site audits — both as an auditee and as a compliance consultant. I’ve found when organizations prepare well for the Assessor’s visit, everything goes so much more smoothly and less stressfully.
Here are my top tips for a successful first compliance audit.
Related reading: Don’t Sweat It! How to Master Your First Compliance Certification Project
Communicate Ahead of Time
A successful audit starts long before the audit occurs. Contact and engage with your Assessor well in advance of the assessment, at the time you hire him or her. Become familiar with them and establish lines of communication early on in your compliance process. The more the Assessor knows about your organization and what you’re doing, the better they can provide inputs and direction ahead of time.
Don’t hesitate to ask specific questions about their expectations or inquire about whether a certain type of evidence will pass muster. Assessors want their clients to be well prepared for the audit — otherwise, everyone is dealing with wasted time and effort. The better your relationship with the Assessor before the on-site, the smoother your assessment will go.
Know the Assessor’s Needs
Every Assessor takes their own approach to the on-site audit, so having an up-front to-do list from the Assessor will help keep the visit organized and well-oiled.
- What do they want to have available to them?
- What are the artifacts they need access to?
- Who will they need to talk to?
- What will the schedule look like?
Also ask for any special preparations you should make, or if they have any specific needs or requests.
More tips here: What Does Your Compliance Auditor Expect from You?
Prep Your Audit Team
Based on the agenda the auditor gives you, assign primary internal personnel ahead of time to answer questions from the Assessor, and prepare them for the audit. Also have backup personnel available in case the primary person gets sick or has an emergency.
Organize the evidence for review. Make sure it’s all there and handy. Sit down with your team and help them prepare for the audit. Refresh your memory on the evidence you used to meet requirements (it’s probably been several months since you looked at a lot of it). Make sure security and compliance reminders have been sent to all staff.
Remind your team that the Assessor isn’t a police officer, and no one is going to jail. Help them to relax and not worry about the audit. The auditor has a job to do, and there may be tough questions, but they aren’t there to penalize you — their job is to help you get your organization in top shape.
And remember: they work for you, but they do have a job to do. The auditor is there to serve your company, not the reverse. So breathe and relax.
Prepare employees who aren’t directly involved in the assessment itself. Send a notification to everyone in the facility the week before, the week of, and the day before. By this time, your organization will have gone through security awareness training, but you might want to give some quick reminders along with the notifications. Give staff fair warning that people will be walking around with the Assessor, and the auditor may opt to ask staff a direct question. Your employees should be open, honest, and helpful.
When the Assessor Arrives
Build in opportunities to enjoy some camaraderie with the Assessor. Keep in mind that it can be lonely or boring to come in and do their work with people they don’t know. Depending on your corporate culture, consider planning an evening with the operational team to go out for dinner. Also set up an executive-level dinner with the Assessor.
Take the time to establish a good relationship with the auditor. The assessment is a partnership, and it’s a good idea to nurture that partnership so that you can work well together.
Audit Day
Audit Day is thoroughly exhausting, especially for those who are involved in the process the entire time. Provide a light breakfast to start the day. Some pastries, bagels, juice, and coffee. You might want to take the Assessor out for lunch, but because the audit process usually goes much slower than anticipated, it might be smarter to order in and invite the team to join for some light topics over a meal.
The on-site audit process is long, arduous, and involves a lot of people in many operational areas. It’s really easy to get off-track, no matter how hard you try to keep to the schedule. Somebody should be the timekeeper to make sure things stay on track as much as possible. Find someone who doesn’t mind being the bad cop to do this.
Kickoff and Wrap-up
Plan to start the on-site with a group conversation that includes all the main players. Allow the Assessor to introduce themselves and describe their process to the group. After introductions and an overview, release the lower-level employees and finish the business overview with the executives and department heads.
Schedule time on the backend for a regroup and a recap. This gives the auditor the opportunity to share their thoughts about the onsite and status. How do they feel about the audit? What are the open elements and opportunities for improvement? This gives you a head start for what you’ll need to attend to after the audit (without waiting a few weeks for a post audit report).
What should you do after the audit? Celebrate!
Odds and Ends
If the on-site audit will require visiting multiple locations, be sure to have transportation arranged.
Have all your evidence organized and ready to roll. You should be able to immediately grab evidence as requested, keeping in mind that the requests will range across the breadth of topics subject to audit.
In the agenda, make sure to include buffer time. I recommend dropping a couple slots of 15 minutes in the morning, and two in the afternoon. That will allow you some play in case you fall behind, or need to add topics that come up as requiring additional focus during the day.
Don’t Sweat It — You Got This!
Your first on-site audit is a big deal, but it doesn’t have to be a nerve-racking ordeal. The first one is always the scariest, but you can make the experience a positive one. Be prepared, treat your Assessor as a human who is here to help, and be as helpful to them as you can. If you prepare appropriately, your on-site audit will go smoothly and pleasantly.
Don’t miss a single article! Subscribe to the blog at the bottom of this page.
