Audit-readiness step by step (DORA, NIS2, ISO)

Before every audit, the same picture: scattered documents, outdated versions, knowledge in individual heads — and a team spending weeks gathering evidence. There’s another way.

What does an audit really check?

Not whether documentation exists, but whether reality matches it. Audit-readiness means being able to show at any time that processes are lived the way they’re described. DORA, NIS2, ISO 27001 and TISAX require demonstrably lived workflows — not just filed ones. The examiner asks for evidence, not intent.

Why doesn’t the old doc collection hold?

Because it describes an ideal picture that drifts from practice from the day it’s created. Every change no one maintains widens the gap. In the audit, the examiner finds exactly that difference between target and actual — and that’s where findings arise that get expensive and uncomfortable.

The five steps to an audit-proof view

1. Clarify trigger and scope. Which standard, which processes are in focus? The most pressing deadline sets the order. Better one process fully audit-proof than ten half.
2. Connect the sources. Instead of documenting, connect the systems where the work already runs — email, tickets, ERP, files. The effort is in the connection, not the retyping.
3. Make the actual state visible. Magnet condenses the real workflow from it — including the steps that appear in no diagram but happen every day.
4. Compare target and actual. Where does lived practice deviate from the requirement? That’s where improvement starts, before the examiner asks — and a looming finding becomes an already-closed gap.
5. Keep it current. Because the view from real sources follows along, the evidence stays audit-proof without maintenance effort. The next cycle doesn’t start from zero.

How does the evidence fall off “as a by-product”?

When the process view is pulled from the real systems anyway and stays current, it’s by definition close to reality. The audit evidence is then no longer a special project, but an export of what already exists. Instead of a special shift four weeks before the deadline, there’s a state that can be shown at any time.

What does that mean over the year?

Audit-readiness turns from a project into a state. The examination loses its exceptional character, the team gets back the weeks that otherwise vanish into preparation — and the risk of unpleasant surprises drops, because target and actual no longer drift apart.

Deeper reads: Audit documentation that actually holds and DORA & NIS2: processes lived and provable.