Blog · Customer audits · Problem 12 of 93
The customer is auditing you next month. Here’s how to get ready.
· 3 min read · By Case Jones
Your contract has a “right to audit” clause, and the customer’s security or compliance team has now used it. They want to see your policies, your evidence and maybe your people, and they’ve proposed dates.
What it costs to leave it
A disorganised audit turns into a long list of findings, follow-up requests and a customer who trusts you less at renewal. Handing over too much creates its own risk: other customers’ data, or internal documents that were never meant to leave.
How to prepare for a customer audit
A customer audit is narrower than a certification audit. They want confidence about the things that affect them. Most of the work is agreeing what’s in scope and having the evidence ready.
- 1
Agree the scope in writing first
Ask which controls, systems and time period they want to review, and whether it’s remote or on site. Check the audit clause in the contract for notice periods, frequency and who pays. Keep it to the service they buy from you.
- 2
Put confidentiality in place
Make sure an NDA or the contract’s confidentiality terms cover what they’ll see. Never show other customers’ data. Use screen sharing or redacted exports instead of handing over raw logs.
- 3
Gather the evidence they’ll ask for
Current policies and their versions, records that procedures were followed in the audit period, access reviews, training records, your vendor list and any incidents. Evidence from the period itself counts more than a promise about the future.
- 4
Pick one coordinator and brief the people involved
One person receives every request, tracks it and replies. Tell the engineers and managers who may be interviewed to answer what they actually do, and to say “I’ll find out” rather than guess.
- 5
Handle findings like a project
Expect a few findings. For each, agree what you’ll change and by when, then send proof when it’s done. A clear follow-up often matters more to the customer than a clean report.
Example
A scope that works for both sides
“Remote review of access control, change management, backups and incident response for the service you use, covering the last six months. Evidence shared in a read-only workspace for three weeks. Interviews with our CTO and support lead, one hour each.”
Or give them read-only access with 93 Compliance
Invite the customer’s auditor by email for the audit period. Their access is read-only, ends by itself (120 days at most), and every visit is recorded.
One audit package gathers what they’ll ask for: a control matrix from each requirement to its policy, procedures and runs, every policy version in effect, training records, each procedure run’s checklist with its photos and files, the risk register, vendors and systems, and known deviations.
Auditor access and the audit package are free, with no card.
- Read-only auditor access for the audit period
- Every visit recorded
- One audit package with the control matrix and evidence
- Policy versions and procedure records from the period
Prepare for the audit
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Can we refuse a customer audit?
If your contract gives them the right, not easily. You can usually negotiate the scope, timing and format, and offer an independent report such as a SOC 2 report instead where the contract allows it.
What’s the difference between this and a SOC 2 audit?
A SOC 2 audit is done by an independent auditor against a standard, and the report can be shared with many customers. A customer audit is one customer checking the things that matter to them, under your contract.
How much evidence should we share?
Enough to show each in-scope control works during the agreed period, and nothing outside it. Redact anything about other customers.