Audits rarely go badly because the IT is wrong. They go badly because the IT can’t be shown to be right quickly. Four things cause most of the friction: evidence is scattered, permissions haven’t been validated, logs aren’t clearly retained, and policies don’t match reality. The pack below deals with each of them.
Part 1: Audit preparation checklist
Evidence
- One agreed location for IT evidence, with a named owner
- Network and system overview, current and dated
- List of systems that hold client or financial data
- Supplier and third-party list, with who has access to what
- Records of the last backup test, not just the backup schedule
Access
- Full list of user accounts, checked against current staff
- Leaver accounts confirmed disabled, with dates
- Admin accounts listed, each with a named reason
- Access to sensitive folders reviewed in the last 6 to 12 months
- Multi-factor authentication status recorded for each system
Logs and records
- Agreed retention period for each type of log, decided with your compliance lead
- Confirmation the logs exist for that whole period
- Someone who can retrieve them without a scramble
Policies
- Each IT-related policy dated, owned and reviewed
- Each policy compared with what people actually do (see the worksheet)
- Staff know where to find the policies
Part 2: Evidence readiness guide
The aim is to be able to answer an auditor’s question in minutes. For each area, work out four things:
- What will they ask? (For example: “Show us who can access client matter files.”)
- What’s the evidence? (An access report, a dated review sign-off.)
- Where does it live, and who can produce it?
- How old is it? Evidence older than the review period you’ve committed to is evidence that needs refreshing.
A good test: pick one request from your last audit or client due diligence questionnaire and time how long it takes to answer in full. Repeat for three more. The slow ones show you where to start.
Three habits that make this easier:
- Take dated snapshots of access reports on a schedule rather than creating them on demand.
- File review sign-offs next to the thing they reviewed.
- Keep one running log of changes (new systems, new suppliers, leavers’ accounts) so the audit trail builds as you go.
Part 3: Common audit pain points worksheet
Rate each statement Yes / Partly / No. Anything that isn’t a clear yes goes on your action list.
| Statement | Y / P / N | Owner | Action |
| We could produce a current list of everyone with access to client data in under an hour | |||
| Our last access review is dated and signed off | |||
| Leavers’ accounts are removed or disabled within an agreed timeframe | |||
| We know how long each type of log is kept, and why | |||
| Our policies describe what people actually do | |||
| Any exceptions to policy are written down with a reason | |||
| We know which suppliers can reach our systems | |||
| More than one person knows where the evidence lives |
The last row matters more than it looks. If the evidence lives in one person’s head, an audit during their holiday becomes a problem.
Want a hand with this?
We can run through the checklist with you as part of a normal review. Tell us when your next audit or due diligence cycle is, and we’ll work backwards from it.
Call: 01707 378455
Email: hello@tristartechsolutions.co.uk
