We passed the audit. What do we need to keep doing?

Keep operating the controls you presented to the auditor. The next assessment will need evidence of what happened since the last one. Saving everything for the month before the audit leaves gaps that a new policy cannot fill.

For ISO certification, the certification cycle includes surveillance and recertification assessments. Agree the schedule with your certification body; NQA describes its certification cycle. A SOC 2 report covers its stated date or period, so agree subsequent reporting needs with your customers and CPA firm.

Give recurring work an owner

Use your actual policies and risk decisions to schedule checks. Depending on your controls, these may include access reviews, restore tests and supplier assessments. Avoid choosing a frequency simply because another company uses it.

Each check needs a procedure, an owner and a record of the result. Include a backup owner for work that would otherwise stop during holidays or staff changes.

Review exceptions as they happen

A missed check or failed test needs a decision. Record what happened, assess the consequence and assign any follow-up. Keep the original result even when the issue is later fixed.

Track corrective actions until someone has verified their outcome. An overdue item should remain visible to the people responsible for accepting or reducing the risk.

Reassess after changes

A new service, acquisition or major supplier change can alter your scope and risks. Add an information security review to the relevant business process so the work begins when the decision is made.

Revisit responsibilities after organisational changes. A control assigned to someone who left months ago will not operate merely because it is still listed in a policy.

Keep management involved

Use management reviews to make decisions about unresolved risks and the resources needed to address them. Record the decisions and who will act on them. A meeting invitation alone will not show what management considered or agreed.

Keep the internal audit programme active between external assessments. Choose coverage based on the management system and prior results, rather than repeatedly checking only the easiest processes.

Collect evidence during the work

Yrso’s recurring checks can collect evidence when it is due. Use evidence slots for manually collected records that support multiple checks, and custom API submissions for evidence your existing tools can supply. Review whether each submission actually supports the conclusion being recorded.

See the features page for the available workflows and tool + team for ongoing support options.