The audit process, and where each stage goes wrong
An audit runs in five stages. The sequence is not decorative — each stage can only produce certain kinds of finding, so knowing where you are tells you how much weight to give what turns up.
Each stage also has a characteristic way of going wrong, and in my experience the failures are far more predictable than the findings.
The version below is what an it audit services engagement runs; most standards-driven audits follow a close variant.
Stage one: scope and criteria
Before anything is examined, two documents. What is in scope, and what constitutes a pass.
Criteria are the part that gets skipped. Without them, every observation becomes a matter of opinion, and the review turns into a negotiation about whether something is really a problem. With them, the conversation is whether the evidence meets a bar that was agreed before anyone knew what the evidence would show.
How it fails: scope written as a list of systems rather than a list of questions. “Review the billing platform” produces a survey. “Establish whether a billing change can reach production without review” produces an answer.
Stage two: evidence request
A written list of what is needed, sent in one batch rather than trickled.
Batching matters more than it sounds. A drip of individual requests is impossible for the audited team to plan around, and it is the mechanism by which scope quietly expands.
How it fails: requests phrased as questions rather than as artifacts. “How do you manage access?” invites a description. “Export of all accounts with production access, with last-login date” produces evidence. The first is a conversation, the second is a record.
Stage three: examination
Where the answer comes from. Building the system, reading the exports, checking the sample, restoring the backup.
This is also where verified and reported separate. Anything examined directly is verified. Anything taken from a description is reported, and the report says so.
How it fails: compression. When a deadline moves, this is the stage that shrinks, because it is the one that takes the longest and produces no visible artifact until it is done. A review compressed here still produces a document, which is what makes the compression dangerous rather than merely disappointing.
Stage four: interviews
Deliberately after examination, not before.
Interviews conducted first anchor the review to the team’s account of their own system, and everything afterwards tends to confirm rather than test. Conducted afterwards, they explain findings you already hold, which is more useful and considerably more comfortable, because the questions are specific.
How it fails: scheduling. Calendars are hard and interviews get moved early for convenience, which quietly inverts the method.
Stage five: reporting and follow-up
Findings, each with what was checked, what was found, and what breaks as a result. Prioritised, not enumerated.
How it fails: the report lands and nothing is assigned. An audit whose findings have no owner and no date is a document, not a control, and the next one will find the same things.
What good looks like from outside
Three signals, all visible without technical knowledge.
The scope document contains questions rather than only systems. The evidence request arrives as one list. And the report distinguishes verified from reported throughout, rather than using the two interchangeably.
A review with all three is likely to be worth its fee. One with none of them will produce a document that reads well and settles nothing.
The stage nobody schedules
Re-testing. A finding closed on the strength of somebody saying it is fixed is a finding that was reported, not verified — the same distinction, applied to remediation.
The cheap version is to re-request the same evidence three months later. It takes an hour and it is the difference between an audit that changed something and one that produced a list.
How long each stage takes
Roughly, for an ordinary software business: half a day to two days on scope, a day on the evidence request, three to ten days examining, one to three days of interviews, and two days writing.
Elapsed time is usually double that, and the difference is waiting for access.
What the process cannot fix
It cannot compensate for criteria nobody agreed. If stage one is skipped, the remaining four are executed well against an undefined target, and the report is a set of observations rather than a set of findings.
It also cannot tell you that you have not been breached. The process examines controls and evidence, not forensics, and a clean result is entirely consistent with a compromise nobody has detected.
Related reading: the audit plan covers the stage-one document in detail, the audit experience covers the same five stages from the side being reviewed, and internal audit covers what changes when the reviewer is a colleague.