The gap between "we have controls" and "we passed" is almost entirely administrative. Fieldwork is a request list, and the requests are more predictable than a first-time team expects.
The five shapes of request
Nearly everything an auditor asks for is one of these:
A policy or a written procedure. The document that says what you intend to do.
A population. A complete list of something: employees, accounts, changes, incidents, vendors, for a stated period.
A sample from that population. They pick; you provide the evidence for each item picked.
A configuration screenshot or export. Proof that a setting is what you said it is, dated.
A walkthrough. A live session where you demonstrate the process end to end.
Item 3 is where unprepared teams lose time, and it is worth understanding why.
Sampling is why partial evidence fails
You do not choose which items to evidence. The auditor selects from the population, which means evidence has to exist for every item, not for the ones you would have picked.
Twenty-five changes sampled from a year of deploys means twenty-five approvals retrieved, each with its ticket, its reviewer and its date. If your process was followed ninety percent of the time, the sample will find the other ten percent, that is what sampling is for.
Population: 1,847 production changes, 2026-01-01 to 2026-12-31Sample: 25 selected by the auditorPer item: change ticket · approval · test evidence · deploy recordDoing the control ninety percent of the time gets you close to zero credit, not ninety percent. A control that is sometimes followed is, for audit purposes, a control that is not reliably operating. ::
The requests that catch people out
Some are predictable and still routinely missed:
Evidence of the review, not the artifact. They have the policy. They want to see it was reviewed and approved this year, by someone with the authority to approve it.
Terminated employee access removal, timed. Not that access was removed: that it was removed within the window your own policy states.
Vendor reviews. Including the ones you decided were low risk. The decision is the evidence.
Backup restoration tests. Not backup success. A restore, actually performed, with a result.
The negative case. "Show us a change that was rejected" or "an incident where the escalation path was used". A process with no exceptions in twelve months is not obviously a working process.
What to do before fieldwork starts
Ask your auditor for the request list in advance, most will share a standard one, and it is the single most useful thing you can obtain from them.
Then, for each item, answer one question honestly: if they asked for this today, could I produce it in an hour? Anything that fails that test is your work list, and it is far cheaper to fix in the weeks before fieldwork than during it.
During fieldwork
Two practical things:
One person owns the request tracker. Requests arriving into several inboxes and being answered inconsistently is the most common cause of avoidable delay.
Answer the question asked. Sending adjacent evidence in the hope it will do generates a follow-up, and follow-ups are what turn three weeks into six.
If something genuinely does not exist, say so early. An auditor who learns about a gap in week one can often discuss scope or a compensating control. One who learns in week five writes it up.