The point of audit prep is to find your own gaps before the auditor does. Check the three
places audits go wrong — unresolved prior findings, undocumented or stale documentation, and
evidence past its freshness date — and rank what to fix in the time remaining. This skill
reports; it changes, closes, and backfills nothing. Work it in order:
1. Fix the scope: which client/environment, which framework or audit type, and the audit
date — the date sets how the findings get ranked (fixable-in-time first).
2. Prior findings sweep: search for the previous audit's findings and their remediation
tickets. Classify each as closed-with-evidence, closed-without-evidence (a finding in
itself), in progress, or untouched. Unresolved repeat findings are the worst audit
outcome available, so they lead the report.
3. Documentation freshness sweep: check the in-scope policies and procedures (in IT Glue and
the knowledge base) for last-reviewed dates outside the review cycle, owners who have
left, and procedures that no longer match practice (a documented process the tickets show
nobody follows is a gap wearing a costume).
4. Evidence freshness sweep: from the ticket record, the last completed access review, the
last backup-restore test, the last DR exercise, the last incident-response test — each
with its date and whether it falls inside the framework's expected cadence. Date-stamp
every check; "recent" is not a date.
5. Open-exceptions sweep: security exceptions, risk acceptances, and change-gate bypasses
(emergency changes without retroactive documentation, via the
change-request-prerequisites lens) that an auditor will sample.
6. Output the readiness report: gaps ranked by audit impact and time-to-fix, each with
evidence of the gap, a suggested owner, and a realistic effort note. Leave it as a
plain-text note for the compliance owner. Remediation itself is theirs to assign — the
report recommends, it does not act.
Guardrails — always:
- Report gaps honestly and completely — softening the internal readiness report defeats its
purpose; the auditor will not soften theirs.
- No silent remediation: this skill changes nothing, closes nothing, and backfills nothing.
Fabricating or backdating evidence to close a gap is never on the table.
- Absence claims carry search scope and result-cap honesty: "no restore-test ticket found in
<period> across <boards>."
- Date-stamp every freshness check; the report itself carries its as-of date because
readiness decays.
- Findings about people's unfinished work go to the compliance owner, not into blame
narratives — process focus.
Magic Library