How to Survive an Audit You Didn't See Coming
The email subject line reads 'We've scheduled a review,' and something in your stomach drops. Not because you did anything wrong — but because you're not sure you can prove that you didn't.
That feeling is the real finding. An audit doesn't test whether you did good work; it tests whether you can show it. And the difference between a calm audit and a brutal one is decided long before the auditor arrives — by whether 'ready' is your normal state or a thing you sprint toward in a panic.
The nine things they ask for first
Auditors are more predictable than they look. Across sectors, the opening requests are almost always the same. Have these nine at your fingertips and you've defused most of the room:
The decision record. Who approved what, when, and on what basis. Not a memory — a record.
The approvals and sign-offs. Every gate, with the name and date attached.
The contract and its change orders. The original, plus every amendment, in order.
Invoices matched to the contract. Each dollar paid, tied to the commitment that authorized it.
The procurement justification. Why this vendor, this price, this process — documented at the time, not reconstructed.
Meeting minutes and direction. Especially anything that changed scope, schedule, or budget.
Version history. Proof you can show which drawing, spec, or policy was current on any given day.
Closeout and handover. What was delivered, what's outstanding, who signed for it.
Retention proof. That you kept what you must keep, and defensibly disposed of the rest.
The trick isn't preparation. It's never being unprepared.
Read that list again and notice something: none of it is exotic. It's the ordinary exhaust of doing the work — approvals you already got, invoices you already paid, decisions you already made. The only question is whether that exhaust was captured as it happened, in one findable place, or scattered across inboxes and drives to be reassembled under pressure.
Teams that dread audits treat records as a thing they'll tidy later. Teams that breeze through them treat the record as a by-product of the work itself — so 'audit-ready' isn't a project they launch when the email lands. It's just Tuesday. You don't survive an audit by preparing for it. You survive by never being in a position that needs preparing.
If your last review felt like a fire drill, that's a records problem, not a character flaw — and it's a solvable one. See how teams make ready their resting state with XNM-VISION.