Guide
How to Prepare for a Compliance Audit
By Keelstar Team · Updated June 1, 2026
The short answer
Start by mapping what the auditor will request — vendor files, screening logs, policy acknowledgments, contract dates — then pull live evidence from systems of record, not reconstructed folders. Assign an owner per workstream, run a dry-run export two weeks before the audit window, and fix gaps while you still have time.
Know the scope before you gather documents
Audits differ: a payer credentialing review, a SOC 2 observation, a CMS compliance audit, and a customer vendor assessment each want different samples. Get the request list or sampling methodology early. Guessing produces over-collection, missed items, and last-minute scrambles.
Map evidence to your workflows
Organize preparation around how work actually happens — vendor onboarding, exclusion screening, COI tracking, policy acknowledgments — not around file folders someone created three years ago. Each workflow should have a defined owner who can export a complete record on demand.
Run a dry-run export
Two weeks before the audit window, pull the same exports you expect to produce: vendor packets, screening logs, approval chains, training records. Gaps discovered during a dry run are fixable. Gaps discovered when the auditor is in the room are not.
Fix systemic issues, not just samples
If the dry run reveals missing W-9s, lapsed COIs, or screening without dates, treat that as a control failure — not a one-off. Remediate the underlying workflow so the sample is representative of ongoing compliance, not a curated exception.
Assign roles for audit week
Designate a single coordinator, workflow owners who can pull records within hours, and a legal or compliance reviewer for sensitive items. Auditors lose confidence when every question starts a three-day email chain.
After the audit
Capture findings in a remediation tracker with owners and due dates. Update retention policies, access controls, and monitoring rules where the audit exposed weakness. The best audit preparation makes the next audit boring.
Frequently asked questions
- How far back do auditors typically request records?
- It varies by audit type — CMS and payer reviews often look back several years for healthcare compliance; SOX-style reviews focus on the current fiscal period. Know your retention policy before the request arrives.
- Should we create a special audit folder?
- Only as a staging area for exports. Source evidence should live in your operational systems with audit trails. Copying files into a folder for the auditor is reconstruction — acceptable as a deliverable, not as your only record.
Related guides
Put this into a monitored workflow
Keelstar Platform handles this continuously — with reminders and an audit trail.