How to prepare for a compliance audit (without the stress)
A compliance audit goes well when the evidence exists before the auditor arrives, not when someone assembles it the week before. That is why this guide covers the types of audit, the evidence, nonconformities and the timeline.
In 30 seconds: work out which compliance audit you face (internal, ISO 27001 certification, ENS or DORA/NIS2 supervision) and which criteria apply. Then run an internal audit early, close its findings and hold the management review. You also need your evidence organised by requirement and dated. Finally, if a major nonconformity appears, fix it and prove it works before certification; an action plan covers minor ones.
Types of compliance audit you may face
Not every audit pursues the same goal. So the first step in any compliance audit is knowing who audits, against which criteria and what the result means.
Internal audit
ISO 27001 requires internal audits at planned intervals (clause 9.2), with auditors who ensure objectivity and impartiality. DORA, for its part, requires internal auditors to review the ICT risk management framework regularly (Article 6(6)). In practice, it is the dress rehearsal for any compliance audit. That way you find the gaps while they still cost nothing.
ISO 27001 certification: stage 1 and stage 2
First, you need an accredited certification body; in Spain, accreditation usually comes from ENAC. In stage 1, the auditor reviews the documentation and checks whether you are ready: scope, risk assessment, Statement of Applicability, internal audit and management review. Then, in stage 2, they verify that all of it works through interviews, sampling and records. Finally, annual surveillance audits follow, with recertification in year three. Also remember that since 1 November 2025 only certificates to the 2022 version are valid, as we explain in the ISO 27001:2022 Annex A changes.
The two-yearly ENS audit
Article 31 of Royal Decree 311/2022, Spain’s National Security Framework (ENS), requires an ordinary audit at least every two years. It also requires an extraordinary one after substantial changes, and that date restarts the clock. Under Article 38, MEDIUM and HIGH category systems need a certification audit, while BASIC systems only need a self-assessment. The report then goes to the system owner and the security officer. If you are starting out, read how to comply with the ENS step by step.
DORA and NIS2 supervision
Here there is no certificate: the supervisor does the reviewing. For DORA (Regulation (EU) 2022/2554), the supervisor in Spain is the Banco de España, the CNMV or the DGSFP. They can ask for the annual review report on your ICT framework and for test results such as resilience testing and TLPT. Meanwhile, Article 32 of the NIS2 Directive allows inspections and regular and targeted audits of essential entities. By contrast, Article 33 provides ex post supervision for important entities. In Spain, moreover, NIS2 is still awaiting transposition, as covered in the state of NIS2 in Spain.
ISO 19011: how a compliance audit is approached
ISO 19011 is the reference guidance for auditing management systems. Its fourth edition, ISO 19011:2026, came out in May 2026 and replaces the 2018 version. It is not certifiable, but it shapes how auditors work in any compliance audit, internal or external. In addition, the new edition expands guidance on remote audits and digital tools.
Its logic is worth knowing, because it explains what you will be asked for. First, the auditor works from a plan, opens with a meeting and collects evidence by sampling. Next, they compare that evidence with the criteria and write findings. Finally, they present conclusions at the closing meeting. Its principles include impartiality, confidentiality and an evidence-based and risk-based approach. For information security systems, ISO/IEC 27007 applies the same guidance.
Evidence checklist for your compliance audit
An auditor is not satisfied with policies: they want dated records that show controls work. Before any compliance audit, check that you have the following to hand:
- Scope and context: approved scope, interested parties and a current Statement of Applicability.
- Risks: signed assessment and treatment plan, with the date of the last review.
- Policies: approved by management, versioned and shared with staff.
- Operational records: joiners and leavers, backups and restores, patches and incidents.
- Training: attendance and awareness content from the last year.
- Suppliers: contracts, assessments and, under DORA, the register of information.
- Improvement cycle: internal audit, management review and nonconformities closed with proof of effectiveness.
If this evidence is scattered across emails and folders, preparing the compliance audit will take weeks. With automatically collected evidence, however, you only need to review it.
Major and minor nonconformities: what to do with them
In a compliance audit, a major nonconformity means a requirement is missing or fails in a way that undermines the system. For example, never having run an internal audit or having no risk assessment. A minor one, by contrast, is an isolated lapse that does not call the whole into question. On the other hand, observations are not breaches, although you should still act on them.
However, the consequences differ widely. Under ISO/IEC 17021-1, the certification body must verify the correction of every major nonconformity before certifying. If it cannot do so within six months of the last day of stage 2, it must repeat that stage. For minor ones, instead, it only needs to accept your action plan and check it at the next surveillance audit.
That is why a good action plan follows clause 10.2 of ISO 27001:
- Correct the specific problem straight away.
- Analyse the root cause, not just the symptom.
- Define the corrective action, with an owner and a date.
- Verify afterwards that the action worked and keep the proof.
Compliance audit preparation timeline
This indicative timeline suits a compliance audit for certification or for the ENS. Even so, adjust it to your size and to what you already have in place.
| When | What to do | Outcome |
|---|---|---|
| 12 weeks before | Confirm scope, standard, dates and audit team | Agreed audit plan |
| 10 weeks before | Review documents and the Statement of Applicability | Current, approved documentation |
| 8 weeks before | Run a full internal audit | Report with findings |
| 6 weeks before | Fix findings and analyse causes | Actions closed or under way |
| 4 weeks before | Hold the management review | Signed minutes |
| 2 weeks before | Rehearse interviews and go over evidence | Owners ready |
| Audit week | Prepare room, access, agenda and a single point of contact | An audit without delays |
| Afterwards | Draft the plan for any nonconformities | Proposal sent on time |
Moreover, many certification bodies expect at least one full cycle of internal audit and management review before stage 2.
Mistakes that turn a compliance audit into a scare
In general, the scares in a compliance audit do not come from major failures but from avoidable details:
- Unapproved documents or documents dated after what they describe.
- A Statement of Applicability that does not match what you actually do.
- Process owners who cannot explain their own process.
- Old findings left open or closed without proof of effectiveness.
- Improvised answers: better to note the request and come back with the evidence.
Frequently asked questions
How long does it take to prepare for a compliance audit?
If the system already works, preparing the compliance audit takes around eight to twelve weeks. If you start from scratch, however, you first need to implement the controls and build up several months of records.
What happens if the auditor finds a major nonconformity?
The certificate does not issue until the certification body verifies the correction. So you have at most six months from the last day of stage 2; otherwise, you must repeat it.
Can someone from inside the company carry out the internal audit?
Yes, as long as they are objective and impartial. In other words, nobody should audit their own work. That is why smaller companies often find it more practical to hire an external auditor.
How often must you repeat the ENS audit?
At least every two years, and also after substantial changes. In addition, force majeure not attributable to the entity can extend the deadline by three months.
Can one compliance audit cover several regulations?
It can if you integrate your systems. For example, ISO 27001 and ISO 22301 allow combined audits. Moreover, much of the evidence works for the ENS, NIS2 and DORA at the same time.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps with your compliance audit
Atalaya GRC organises your requirements service by service and applies one control, many regulations, so a single piece of evidence covers ISO 27001, the ENS, NIS2 and DORA. In addition, it dates each piece of evidence and links it to its control. Likewise, the regulatory clock alerts you to audits, reviews and corrective action deadlines. See our ISO 27001 and ISO 22301 guide or request a demo.
