The audit is going smoothly. You’ve showed them your risk register. You’ve walked them through your access control procedures. You’re starting to relax.
And then, the auditor looks up from their notes.
“Can you show me your documented list of internal and external issues?”
Your stomach drops. You know you talked about those issues. You had a whole workshop…
