Before an audit, check that management and IT can explain the same operating reality. A policy is useful only when people know how it applies and can show what happens in practice.
Check each important control
Identify its owner, how often it operates, and a recent example of it working. Access reviews, backup checks, supplier decisions, and changes should leave evidence that can be traced without searching through unrelated folders.
Check management’s part
Make sure the risk assessment, security policy, objectives, and management decisions are current. Be ready to explain why a risk was accepted or a treatment was chosen, what remains open, and who is responsible for the next action. A short, consistent explanation is more useful than a large collection of disconnected documents.