Audit fieldwork goes badly when requests are tracked in email. Items get missed, two people produce the same artefact differently, and nobody can say what is outstanding, which is itself read as a control weakness.
Route everything through one coordinator. A single point of contact prevents duplicate and contradictory submissions. Auditors receiving two different versions of the same artefact will ask why the control operates inconsistently.
Record exactly what was sent. Note the filename, the period covered, and the date submitted. Follow-up questions arrive weeks later and you need to know precisely what the auditor is looking at.
Flag anything you cannot produce early. Evidence you cannot produce is a finding whether you flag it or not. Raising it early gives time to offer a compensating artefact or agree a remediation plan.
Here's a preview. Unlock the free download to get all 3 sections (2 more below).
| Req ID | Request | Control ref | Period required | Owner | Due | Status | Artefact submitted | Submitted on | Accepted |
|---|---|---|---|---|---|---|---|---|---|
| PBC-01 | Access review evidence for all four quarters | CC6.2 | 2026 full year | D. Osei | 2026-11-10 | Submitted | access-review-2026-Q1..Q4-signed.pdf | 2026-11-08 | Yes |
| PBC-02 | Leaver list with access revocation timestamps | CC6.3 | 2026 full year | IT Ops lead | 2026-11-10 | In progress |
More free templates IT teams use alongside this one.
A SOC 2 Type II does not test whether you have a control. It tests whether the control operated throughout the period, and asks you to prove it with artefacts from specific dates. This tracker is organised around that reality: per control, per evidence artefact, per sample date.
Most ISO 27001 gap assessments focus on Annex A and skip clauses 4 to 10, which is backwards: the management system clauses are mandatory and are where certification audits most often find problems.
Auditors test three things about policies: that they exist, that they are approved by someone with authority, and that they are reviewed. The register answers all three in one page, which is why it is usually the first artefact requested.
Prepared By Client: the list of evidence the auditor asks you to provide. Tracking it with owners, deadlines, and submission records is the single most effective way to keep fieldwork short and uneventful.
To prevent duplicate or contradictory submissions. An auditor receiving two different versions of the same artefact will reasonably ask whether the control operates consistently, which turns an administrative issue into a control question.
Say so early. It will be a finding either way, but flagging it gives time to offer a compensating artefact, explain the context, or agree a remediation plan, all of which are better than the auditor discovering the gap during fieldwork.
