Audit-ready every day, not once a year

You are ready for an audit when you can produce any record, in its approved version, with a trail showing who changed it and when, within hours instead of weeks. That comes from everyday document management, not from a scramble after the notice arrives.

Audits do not come on a schedule

Most organizations think of one audit a year. In practice, requests for evidence arrive from many directions and often on short notice:

• A financial auditor asking for support behind a number
• A regulator or grant funder checking that you followed the rules
• An insurer or a customer asking to see your security and records practices
• A public records request, for a city or county
• A lawyer asking you to preserve everything on a matter

Each one asks a version of the same four questions. Where is the policy? Where is the proof it was followed? Who had access to it? Did you keep it as long as you were supposed to, and delete it when you were allowed to?

If the answers live in someone’s inbox or memory, you pay for it in staff hours, stress, and sometimes findings.

Six habits that keep you ready

1. One home for each kind of document. Contracts live in one place, board or council materials in another, personnel files in a third. When people do not have to guess, auditors do not wait.

2. A named owner for every site and library. The owner decides what belongs, who gets access, and what gets retired. A site with no owner is where the old drafts and the oddly shared files collect.

3. One official version. Mark drafts as drafts. When a document is approved, make that version the one people find first, and keep the history behind it. You may be asked what a policy said on a particular date.

4. Access by group, reviewed on a schedule. Give access to roles, not to a long list of individuals. Review who can open the sensitive sites, such as HR, finance, and legal, at least twice a year and after anyone leaves.

5. A retention schedule you actually follow. Decide how long each kind of record is kept, then set your systems to match. In Microsoft 365, retention policies apply a setting to a whole site or mailbox, while retention labels apply it to an individual document, and a label can mark an item as a record. Microsoft documents both. The schedule itself, meaning the periods, comes from your attorney, your regulator, or your records officer. It does not come from the software.

6. A practice drill. Once a quarter, pick five documents an auditor would plausibly ask for. Ask someone who did not create them to find each one and note the time. Where the hunt is slow or the versions disagree, fix the structure, not just the one file.

What a good drill looks like

Pick the current policy, last quarter’s approval record, a signed contract, a sensitive file’s access list, and a record that is past its retention date. Time how long each takes to produce.

A good result is a few minutes each, one version, and a clear record of who touched it. If the last item, the expired record, sits in a drawer with no plan to dispose of it, that is a finding too. Keeping everything forever is also a risk.

This is also AI readiness

The same habits that get you through an audit get you ready for an AI assistant. It reads what you have and cannot tell which version is official, who owns it, or whether it should still exist. If you can find, trust, and secure your documents, you can also describe to an auditor how an assistant uses them.

New records raise new questions as well. The prompts and outputs of an AI tool may be records, depending on your records law and how the content is used. We covered that in a separate post.

Where this shows up in the assessment

Mostly in sub-score 1.3, data quality and governance, and 1.1, data inventory and ownership. It also touches 1.2, findability, and 1.4, security and access control, in the Information & Data Foundation pillar.

A caution

This post is a starting point, not legal or accounting advice. What you must keep, for how long, and in what form depends on your industry, your contracts, and, for governments, your state’s records law. Ask your attorney or records officer before you change a schedule or delete anything.

If you want to know how audit-ready your documents are today, see how the assessment grades it.

Sources

• Learn about retention policies and retention labels (Microsoft Learn)