The Five Questions an Auditor Will Ask You

Auditors ask different questions in different words, but underneath, it's almost always these five. If you can answer them, you're ready.

1. What does the system do? Describe it like you'd describe a job role: its tasks, its limits, and what it's not allowed to decide on its own.

2. What data does it use? Where the data came from, who can access it, and how you keep it current. "I'm not sure" is the wrong answer here.

3. Who is responsible? A named human being, not a department. When something goes wrong, whose phone rings? Write the name down.

4. How do you monitor it? What do you check, how often, and what happens when the numbers look off? "We trust it" is not monitoring.

5. Show me the records. The documentation, the logs, the change history. This is where the previous four answers get proven — or fall apart.

Notice the pattern: every question has a follow-up called "prove it." That's the whole game. Answers are cheap; evidence is the currency.

Print these five questions and tape them where your team can see them. Answer them in writing, keep the answers current, and audits become conversations instead of interrogations.

I explain frameworks; I don't give legal counsel.