The Auditor Is Coming: The First 180 Days in GRC

A plain guide to your first six months in governance, risk and compliance, written for the questions you are shy to ask.

You took a job in governance, risk and compliance. Maybe you came from IT, audit, law or a security team. Maybe this is your first job. Either way, someone has told you an audit is coming, and you are not sure what you are meant to have ready.

This handbook follows your first 180 days in order. Day 1 is about finding out what you inherited. The first month is about evidence, policies and risk appetite. Then come the parts people rarely write down: what to do when you get something wrong, how to tell whether you are doing well, and what really happens in an audit.

Each chapter starts with the questions people ask in private. Each ends with one thing to practise on PlayCISO. Read it front to back, or jump to the chapter you need this week.

Facts about standards and laws are sourced and dated. Everything else is advice. Your organisation, your auditor and your regulator have the final word.

Start reading Read it on one page

Day 1

Find out what GRC is for here, what you inherited, and where the risk register really lives.

What GRC Is Actually ForDay 1
The Frameworks You InheritedDays 1–5
Finding the Risk Register and Its Real OwnerDays 2–10

The First 30 Days

Evidence that holds up, policies people read, and a risk appetite leaders can say out loud.

Evidence That Survives an AuditWeeks 1–4
Writing a Policy People Actually ReadWeeks 2–4
Risk Appetite in Plain WordsWeeks 3–6

What If I Screw Up?

Failed controls, missed findings and paper controls happen to everyone. What matters is how you report them.

A Failed Control, a Missed Finding, a Paper ControlAny time

How Am I Doing?

Measure risk reduced, not only findings closed, and use management review to get real decisions.

Metrics: Findings Closed vs Risk ReducedMonths 2–3
Management Review Without the TheatreMonths 3–5

The First Audit

What stage 1 and stage 2 really check, how to handle auditor interviews, and what to do with nonconformities.

Stage 1, Stage 2 and What Comes AfterMonths 4–6
Auditor Interviews, Nonconformities, Corrective ActionMonths 4–6

Choose Your Own Adventure

By 180 days you will see which part of GRC suits you. Here are five common paths.

Five Paths From Here to Day 180 and BeyondMonths 5–6

Epilogue

What GRC is not good at, and how to stay honest about it.

What GRC Is Not Good AtDay 180

Glossary

Accreditation: Formal recognition that a certification body is competent to certify against a standard.
AIMS: AI management system: the equivalent system for managing AI, as described in ISO/IEC 42001.
Annex A: The list of reference controls at the back of ISO/IEC 27001, which you compare your own controls against.
Audit period: The span of time an audit checks evidence for.
CAPA: Corrective and preventive action: the habit of fixing causes, not just symptoms, and checking the fix worked.
Certification body: An organisation that audits management systems and issues certificates.
Checkbox culture: Doing things to pass an audit rather than to reduce risk.
Compliance: Meeting the laws, contracts, standards and internal rules you are bound by, and being able to show it.
Control: Something that reduces a risk, such as a process, a technical setting or a check.
Control owner: The person responsible for making sure a control runs and produces evidence.
Corrective action: An action that removes the cause of a nonconformity so it does not recur.
Documented information: ISO wording for the documents and records a management system must keep.
DORA: The EU Digital Operational Resilience Act, Regulation (EU) 2022/2554, for many financial entities and their ICT providers.
Evidence: Records that show a control ran: what, when, on what, by whom, and the result.
Exception: An approved, time-limited departure from a policy or standard, with a named approver.
Framework: A structured set of practices you choose to follow, such as NIST CSF, which may or may not be certifiable.
Governance: How decisions are made, who makes them, and how they are recorded.
GRC: Governance, risk and compliance: deciding who decides, managing what could go wrong, and showing you meet your obligations.
Inherent risk: How serious a risk is before any controls are considered.
Interested parties: People or groups who affect or are affected by your organisation, such as customers, regulators and staff.
Internal audit: An audit your own organisation runs, or commissions, to check the management system before external auditors do.
ISMS: Information security management system: the policies, processes and controls an organisation uses to manage information security risk, as described in ISO/IEC 27001.
ISO/IEC 27001: The international standard for information security management systems, which organisations can be certified against.
ISO/IEC 27002: The guidance standard that explains the information security controls referenced in ISO/IEC 27001 Annex A.
ISO/IEC 42001: The international standard setting requirements for an AI management system.
Major nonconformity: A serious failure, such as a requirement not met at all, that puts the system in doubt.
Management review: A planned meeting where top management reviews the management system and decides on changes.
Minor nonconformity: A single lapse that does not by itself break the system.
NIS2: An EU directive on cybersecurity for essential and important entities, put into national law by each member state.
NIST CSF: The NIST Cybersecurity Framework; version 2.0 organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
Nonconformity: A requirement that is not met. Certification bodies usually grade them as major or minor.
Observation: An auditor comment that is not a nonconformity but points to a possible weakness or improvement.
Paper control: A control that is written down but does not actually run.
PCI DSS: The Payment Card Industry Data Security Standard, which applies to organisations handling card data.
Policy: A short statement of what leadership has decided and why.
Procedure: Step-by-step instructions for how a team carries out a task.
Recertification audit: A full audit before the end of the three-year cycle to renew a certificate.
Residual risk: The risk that remains after your controls are in place.
Risk: Something that could happen and would affect your goals, described by how likely and how bad it is.
Risk acceptance: A recorded decision by someone with authority to carry a risk as it is, for a set time.
Risk appetite: How much and what kind of risk leadership is willing to carry to reach its goals.
Risk assessment: The process of finding, analysing and rating risks.
Risk owner: The person with the authority and budget to decide what happens to a risk.
Risk register: The list of known risks, each with an owner, rating, treatment decision and review date.
Risk tolerance: A specific limit in one area that should not be crossed, set within the overall appetite.
Risk transfer: Moving some of the impact of a risk to another party, for example through insurance or a contract.
Risk treatment: The decision on what to do about a risk: reduce, accept, transfer or avoid it.
Root cause: The underlying reason a problem happened, which a fix must remove to stop it coming back.
Sampling: Checking a selection of records rather than all of them, to judge whether a control worked.
Scope: The parts of the organisation, locations, systems and services that a management system or certificate covers.
SoA: Statement of Applicability: the document listing the Annex A controls, whether each applies, why, and whether it is implemented.
Stage 1 audit: The first certification step, which reviews documentation, scope and readiness for stage 2.
Stage 2 audit: The main certification step, which checks the system is implemented and effective.
Standard (internal): Specific rules that follow from a policy, such as minimum password length.
Surveillance audit: A yearly audit during the certification cycle that checks the system still works.
Third-party risk: Risk that comes from suppliers, partners and service providers.

Frequently asked questions

What does a GRC analyst do?

A GRC analyst keeps the risk register current, collects evidence that controls work, helps write policies and procedures, supports audits and reports risk to leadership. The aim is to help leaders make risk decisions on purpose and explain them later.

How do I prepare for my first ISO 27001 audit?

Confirm your scope, make sure your Statement of Applicability matches your risk treatment, run an internal audit and a management review, and collect evidence across the audit period. Stage 1 checks documents and readiness; stage 2 checks the system works in practice.

What is the difference between stage 1 and stage 2 audits?

Stage 1 reviews your documentation, scope and readiness. Stage 2 assesses whether the system is implemented and effective, including how risks are managed and controls are applied.

Does compliant mean secure?

No. Compliant means you met a set of requirements when someone checked. Secure means attackers find it hard to do harm. They overlap, but a certified organisation can still be breached.

What is risk appetite in simple terms?

Risk appetite is how much and what kind of risk leadership is willing to carry to reach its goals. A useful one says, by area, where the limits are and who can accept risk at each level.

Other handbooks

Updated 2026-11-14. General guidance, not legal advice. Where a chapter states a law or standard, its sources are listed at the end of that chapter.