I've worked at smaller orgs and my advice would be to first ask yourself if it's worth the cost, they are large time-sucks and cost intensive. If this is still

I've worked at smaller orgs and my advice would be to first ask yourself if it's worth the cost, they are large time-sucks and cost intensive. If this is still something you want to pursue, hire experienced help. A majority of time spent in audits is figuring out what the auditors are looking for, and having someone experienced can save you a lot of headache. Be aware that compliance is more than a one time thing, and during this process you will have created either an entirely new department, or at the very least multiple work-streams.