Service 03 · Compliance readiness
Will we pass the audit?
Compliance readiness is the work between deciding to be audited and the auditor’s first request: the controls mapped to the standard, the gaps found and closed, the evidence gathered, the policies written, and the program reported to the board in its own words. This page says what is true outside, what the question means inside, and how the work is put in order.
Start with a conversation Read the sample WISP report to the board
01 / The world outside
The world outside: what the auditor will ask for
Each standard asks the same question in its own vocabulary: show us that the controls you say you have exist, operate, and are reviewed. SOC 2 asks it through the AICPA’s Trust Services Criteria over a period of months, and a Type II report is the one customers ask for. ISO/IEC 27001:2022 asks it through a management system and ninety-three controls in its Annex A, certified by an accredited body. The HIPAA Security Rule asks it of anyone holding protected health information, beginning with a documented risk analysis. The Gramm-Leach-Bliley Safeguards Rule asks financial institutions for a written information security program and, since 2023, a report on it to the board at least once a year.
The audit itself is rarely where organizations fail. They fail earlier, on evidence: a control that operates but leaves no record, a policy that exists but was never approved or read, a vendor review nobody can find. In the WISP report on this site, a bank accounts to its board for twenty-one independent assessments in one year, each with its rating and its remediation plan. That is what readiness looks like from the outside: not a binder, but a year that can be shown.
02 / The world inside
The world inside: the difference between compliant and ready
Inside most organizations the question "will we pass" is carried by one or two people who know where the gaps are and have not had the standing to say so. Compliance work that begins with them, rather than with a template, goes faster and lands better: the controls that already operate are written down as they are, the ones that do not are named as decisions for the executive, with the cost of each. The purpose is not to produce documents the auditor will like; it is to make the organization able to say, in its own words, what it does to protect what it holds.
There is a quieter benefit the board notices later. A program reported once a year, in a document the directors can read without translation, changes the conversation from "are we compliant" to "what did we assess, what did we find, what did we fix, and what comes next." The audit becomes one event in that year rather than the reason for it, and the finding the auditor makes is one the organization already knew about and had scheduled.
03 / Putting it in order
Putting it in order: how the work is done
The work begins with a map: the standard’s requirements on one side, the organization’s controls on the other, and a line, or a gap, between each pair. The map is built from interviews with the people who operate the controls and from the evidence that already exists; a gap is written up with what would close it, who owns it and what it costs. Policies are then authored or revised to describe what the organization actually does, approved by the people the standard names, and the evidence calendar is set: what is collected, by whom, how often, so the auditor’s request is answered from a folder rather than a scramble.
During the audit, the firm is the liaison: it fields the requests, prepares the people being interviewed, and keeps the auditor’s findings in proportion. After it, the program is reported to the board in the form the Safeguards Rule and good governance ask for: the year’s assessments and their ratings, the maturity reached against a target, the safeguards by critical area, the service providers overseen, and the conclusions and recommendations. The same report, a year later, shows the trend. Readiness for a first SOC 2 or ISO 27001 audit typically takes a quarter; the board report is an annual cycle.
What comes back
- A control map: each requirement of the standard against the control that meets it, or the gap
- Gaps written as decisions: what closes each, who owns it, what it costs
- Policies authored or revised to describe what the organization does, approved as the standard requires
- An evidence calendar and the evidence itself, gathered before the auditor asks
- Audit liaison: requests fielded, interviews prepared, findings kept in proportion
- A written program report to the board, in its language, repeatable each year
The work, as delivered
Pages and screens from the samples on this site. Read the sample WISP report to the board.
The executive summary: the year on one page
The assessment program: 21 assessments rated
Maturity against the target, on NIST CSF 2.0
Conclusions and recommendations to the board
The first step
Tell us the standard and when the audit is expected. We answer within one business day with the shape of the quarter.