5 Ways Startups Can Ensure a Smoother Audit
by Sarah Harvey / July 23rd, 2019
At KirkpatrickPrice, we’ve been fortunate enough to work with companies of all sizes – from startups to enterprise-level companies. By working with a variety of clientele, we’ve seen many different pitfalls that organizations are prone to, especially startups. As an organization committed to helping our clients get the most out of our thorough information security assurance services, we’ve put together a list of five ways startups can ensure a smoother audit. Let’s discuss.
1. Get C-level Buy-in
While undergoing an information security audit is a highly technical process, it also largely relies on the mentality and intent behind engaging in an audit. Why did your organization pursue compliance? Were you asked by a client to become SOC 1 or SOC 2 compliant? Are you doing it to be proactive and position yourself as a secure organization? Are you just doing it to check an item off a to-do list? If you go into an audit with the mentality that it is just an item to check of a to-do list, you’re already at a disadvantage and most likely won’t reap all of the benefits of compliance. Instead, your C-level executives must understand why the company needs to invest in information security audits and how it can help improve the company as a whole. A large part of this also means that an organization’s C-level executives are involved in the audit process. This means that they don’t merely pass off the engagement to directors or department heads, and they have a clear stake in the outcome of the audit by being the executive sponsor.
2. Assign Someone to Oversee the Project, but Ensure that the Workload is Assigned Appropriately
Audit engagements are no small feat, and for startups in particular, the process may seem even more daunting. That’s why we require organizations to identify an executive sponsor – someone who is responsible for overseeing the audit engagement and serves as the main point of contact for your organization throughout the entire engagement. However, while we feel that having one person overseeing the entire project is paramount, that does not mean that other critical members of your organization should be excluded from the engagement. Often times, you’ll need various department heads to answer questions about policies and procedures or internal controls. This is why our Online Audit Manager (OAM) can help make your audit process even smoother: it allows executive sponsors to assign questions to various people within an organization, preventing one person from being responsible for answering all of the audit questions and helping you distribute the workload evenly.
3. Communicate Regularly
There are a lot of moving parts during an audit engagement, especially if multiple people or teams are involved. Communication must be highly effective and clear to ensure a smoother audit for startups. Major key players in the audit engagement should be communicating on a regular basis. If an auditor hasn’t received required documentation on time, who will ensure that is addressed? If a vulnerability is found and communicated to one person on the team but not another, that could delay the audit process altogether. To prevent delays in your engagement, there needs to be a clear line of communication both within your organization and between your organization and your audit firm.
4. Stay on Schedule
When organizations partner with us to perform their audits, one of the most frequently asked questions we get is, “Can we get our report by X date?” While we are committed to staying on schedule and delivering projects on time, the audit process is a two-way street. If your organization puts off answering questions or providing documentation in the OAM, it will only prolong the engagement. This could be especially problematic for organizations who have hard deadlines for their compliance efforts or deals relying on their audit engagement. Ultimately, creating and sticking to a schedule is absolutely necessary in order to ensure a smoother audit process. For example, this might mean that you commit to answering 20 questions a day to stay on or ahead of schedule. Additionally, our OAM goes a step further to help our clients stay on track by displaying a progress-tracking bar.
5. Utilize Your Auditor and Your Audit Firm’s Resources
When choosing an audit firm, startups need to be sure to work with a firm that does more than provide audits: they need to choose a partner and someone who will guide them every step of the way throughout the audit engagement. Feel like you don’t know how to remediate vulnerabilities? Consult with your auditor on remediation strategies. Not sure what your auditor is requiring or what is being asked of you to provide? Your auditor should be able to provide clarification and company resources to reference. If you want to ensure a smoother audit, be sure to utilize your auditor and your audit firm’s resources.
Startups who invest in information security audits are doing what’s necessary to position themselves as secure entities, and we want to make sure that they get the most out of that investment. Let’s talk about how we can help you ensure a smoother audit process. Contact us today.
More Resources for Startups
How to Lead a Cybersecurity Initiative
You’re a Target for Cyber Attacks No Matter Your Business Size
What Type of Compliance is Right for You? 10 Common Information Security Frameworks
