I've been through many audits: SOX, SAS70, SixSigma, HIPAA, Security, and other such audits. Can't even recall some of them. (all from an IT/OPs/Sec/Data perspe

I've been through many audits: SOX, SAS70, SixSigma, HIPAA, Security, and other such audits. Can't even recall some of them. (all from an IT/OPs/Sec/Data perspective - not so much on business model/function/whatever the other depts in the company were required to do...) Typically, they will have a very long list of questions of your data, process, systems, staff, access, security handling policies, procedures, finance, etc and complete a gap analysis, and ask for proof/validation, documentation of all such questions. Many times the questions are redundant, many times they are vague - but in all, such audits and the questions are really anything that a sound C-level (cio/cto/cso/blah blah) should know to hire and instill in their employees they put in place to own such areas of the business. The audits are tedious, and the consultants can be annoying. Most of the time, the audits are actually done in order to prove to high-profile potential investors or customers that "yes we are a mature company and we have done the appropriate due diligence in all of these areas in order to gain your faith in our ability to be worthy of your business/investment, Look! even the big auditor says we are good!" There will always be a few things that you may have either missed, were to young a company to yet have needed it, or its already in the pipeline, but you don't have staff on hand yet to take care of it etc. The most important thing is be honest about everything in your org/systems/infra and accept any findings and build a plan to take care of them. Ideally - your leads, managers etc are already thinking about sound practices that mitigate any scary findings. I've never failed an audit. My gripe with all of these companies who do the audits are WAY to overpriced for their stamp of approval - and their recommendations are very high level. Such as "Do you have a security access policy? Can I see it?" "You should have a list of all the people who have access to system X" (when all this information is already available through any given system (AD, SSO, ROLES, whatever) In my experience, C-levels like having these on their belt of accomplishments so they can brag about familiarity with each audit type, when in-fact, all the work is delegated to staff and SMEs for each system. Its also an "whom you network" which really bothers me about it.