theagentindex.io/guides/audit-prep-templates/ · Last reviewed 21 Oct 2026
Free working aids · 21 Oct 2026
Audit-prep checklists and templates
Seven working aids for teams looking into a SOC 2 examination or an ISO/IEC 27001:2022 certification. Previews are on this page. Enter an email once to unlock the Free GRC Survival Kit (five practitioner templates). This is not a ranking or score.
Downloads
The Free GRC Survival Kit is five practitioner templates (Markdown, CSV and HTML). Enter a work or personal email to unlock the direct links on this page — 100% free through Q1 2027. The on-page previews below stay readable without signing up.
Free through Q1 2027
Download the Free GRC Survival Kit (5 Templates)
SOC 2 Type I & II evidence, ISO 27001:2022 Annex A, India DPDP & CERT-In AI-agent controls, a vendor-questionnaire fast-answer kit, and an enterprise AI-use policy. 100% free through Q1 2027.
Unlocked. Direct downloads — no paywall. 100% free through Q1 2027.
- SOC 2 Type I & II Evidence Request List — MD · CSV · HTML
- ISO 27001:2022 Annex A Readiness Checklist — MD · CSV · HTML
- India DPDP Act & CERT-In AI Agent Controls Checklist — MD · CSV · HTML
- Vendor Security Questionnaire Fast-Answer Kit — MD · CSV · HTML
- Enterprise AI-Use Policy Template — MD · CSV · HTML
The original seven working-aid tables on this page are also available as Markdown and CSV after you unlock the kit, or from /guides/audit-prep/.
SOC 2 readiness checklist
One row per 2017 TSC criterion (CC1.1–CC9.2), plus optional availability (A1), confidentiality (C1), processing integrity (PI) and privacy (P1–P8). Point-of-focus titles are from the 2020 AICPA PDF. The 2022 revision should be checked. [1] [2]
CC groups: CC1 Control environment, CC2 Information and communication, CC3 Risk assessment, CC4 Monitoring activities, CC5 Control activities, CC6 Logical and physical access controls, CC7 System operations, CC8 Change management, CC9 Risk mitigation.
Preview — first eight common-criteria rows. The download has every row, plus owner and status columns.
| Criterion | Group | Look into | Points of focus (titles) | Evidence you might gather |
|---|---|---|---|---|
| CC1.1 | CC1 Control environment | Look into how leadership sets integrity and conduct expectations, including for contractors and vendors. | Sets the Tone at the Top; Establishes Standards of Conduct; Evaluates Adherence to Standards of Conduct; Addresses Deviations in a Timely Manner; Considers Contractors and Vendor Employees in Demonstrating Its Commitment | Code of conduct; board/management minutes; contractor onboarding records |
| CC1.2 | CC1 Control environment | Look into board or equivalent oversight, independence and the expertise it applies. | Establishes Oversight Responsibilities; Applies Relevant Expertise; Operates Independently; Supplements Board Expertise | Charter; independence statements; meeting minutes |
| CC1.3 | CC1 Control environment | Look into reporting lines and how authorities and responsibilities are assigned and limited. | Considers All Structures of the Entity; Establishes Reporting Lines; Defines, Assigns, and Limits Authorities and Responsibilities; Addresses Specific Requirements When Defining Authorities and Responsibilities | Org chart; RACI; authority matrix |
| CC1.4 | CC1 Control environment | Look into hiring, competence, background checks, training and succession. | Establishes Policies and Practices; Evaluates Competence and Addresses Shortcomings; Attracts, Develops, and Retains Individuals; Plans and Prepares for Succession; Considers the Background of Individuals; Considers the Technical Competency of Individuals; Provides Training to Maintain Technical Competencies | Job descriptions; background-check records; training log |
| CC1.5 | CC1 Control environment | Look into accountability, performance measures and whether incentives create undue pressure. | Enforces Accountability Through Structures, Authorities, and Responsibilities; Establishes Performance Measures, Incentives, and Rewards; Evaluates Performance Measures, Incentives, and Rewards for Ongoing Relevance; Considers Excessive Pressures; Evaluates Performance and Rewards or Disciplines Individuals | Performance-review policy; incentive design notes |
| CC2.1 | CC2 Information and communication | Look into how the entity identifies information needs and keeps quality through processing. | Identifies Information Requirements; Captures Internal and External Sources of Data; Processes Relevant Data Into Information; Maintains Quality Throughout Processing | Data-quality procedure; inventory of information sources |
| CC2.2 | CC2 Information and communication | Look into internal communication of control, security awareness, objectives and system changes. | Communicates Internal Control Information; Communicates With the Board of Directors; Provides Separate Communication Lines; Selects Relevant Method of Communication; Communicates Responsibilities; Communicates Objectives and Changes to Objectives; Communicates Information to Improve Security Knowledge and Awareness; Communicates Information About System Operation and Boundaries; Communicates System Objectives; Communicates System Changes | Awareness materials; change notices; board packs |
| CC2.3 | CC2 Information and communication | Look into communication with external parties and inbound channels. | Communicates to External Parties; Enables Inbound Communications; Communicates With the Board of Directors; Provides Separate Communication Lines; Selects Relevant Method of Communication; Communicates Objectives Related to Confidentiality and Changes to Objectives; Communicates Objectives Related to Privacy and Changes to Objectives; Communicates Information About System Operation and Boundaries; Communicates System Objectives; Communicates System Responsibilities | Customer notices; support/security contact page |
32 further rows (through CC9.2 and optional A/C/PI/P) are in the download.
Related: SOC 2 hub · SOC 2 auditor FAQ.
ISO/IEC 27001:2022 readiness checklist
ISO does not certify and does not issue certificates. Certification is optional. Certificates should cite the full reference (for example “certified to ISO/IEC 27001:2022”). [3]
Clauses 4–10 follow the ISO management-system clause structure. [5] Clause 6.1.3 requires comparing implemented controls with Annex A and producing a Statement of Applicability that justifies inclusion and exclusion. [4]
- Clause 4 Context of the organization: Scope of the ISMS; Interested parties and their requirements
- Clause 5 Leadership: ISMS policy; Roles and authorities
- Clause 6 Planning: Risk assessment; Risk treatment and Statement of Applicability; Information-security objectives
- Clause 7 Support: Competence and awareness; Documented information
- Clause 8 Operation: Operational planning and control of risk treatment
- Clause 9 Performance evaluation: Internal audit; Management review
- Clause 10 Improvement: Nonconformity and corrective action; Continual improvement
Annex A by theme (counts only)
ISO/IEC 27002:2022 has 93 controls (was 114) in four themes; 11 are new. These 93 controls provide the content for Annex A of ISO/IEC 27001. Control titles are not listed here; the full list is in the purchased standard. [4]
- Organizational: 37 controls
- People: 8 controls
- Physical: 14 controls
- Technological: 34 controls
Related: ISO 27001 hub · SOC 2 to ISO/IEC 27001.
Evidence list (examples, not requirements)
Examples, not requirements; your auditor decides. Derived from TSC point-of-focus titles. [1]
- Asset inventory
- Access reviews
- MFA / authentication settings
- Encryption and key-management notes
- Change-control records
- Vulnerability-scan reports
- Incident-response records
- Vendor-risk reviews
- Background checks / training records
- Risk assessment
- Board / management oversight minutes
- Backup / recovery tests
Core policy outlines
Headings only, not full legal text. Review cadence is set by you.
Information security policy
Linked refs: ISO clause 5; TSC CC1 / CC5
- Purpose
- Scope
- Roles
- Key commitments to define
- Review cadence (set by you)
Access control
Linked refs: TSC CC6; ISO Annex A technological/organizational themes
- Purpose
- Scope
- Roles
- Key commitments to define
- Review cadence (set by you)
Change management
Linked refs: TSC CC8.1
- Purpose
- Scope
- Roles
- Key commitments to define
- Review cadence (set by you)
Also in the download: change management, incident response, business continuity / disaster recovery, vendor / third-party management, data classification and retention, acceptable use, risk assessment.
Common exceptions to look into
Areas auditors often ask about. General examples tied to the criteria, not findings data.
- Access not removed promptly after leaving (CC6.2 / CC6.3)
- Access reviews not performed or not evidenced (CC6.2)
- Changes without documented approval or testing (CC8.1)
- Vendor reviews missing (CC9.2)
- Incident-response plan not tested (CC7.4 / CC7.5)
- Backup restore / recovery not tested (A1.3)
- Risk assessment not refreshed when things change (CC3.4)
- Training / awareness not evidenced (CC2.2 / CC1.4)
Vendor-questionnaire answer kit
A template answer library. Related comparison (not a ranking): security questionnaire agents.
| Theme | Our answer | Evidence link | Last reviewed | Owner |
|---|---|---|---|---|
| Company / security program | ||||
| Access control | ||||
| Encryption | ||||
| Logging / monitoring | ||||
| Incident response | ||||
| BCP / DR | ||||
| Vendor management | ||||
| Data privacy | ||||
| AI use |
AI-use policy outline
Headings only. Optional references (link only): NIST AI Risk Management Framework, ISO — ISO/IEC 42001, and the live CERT-In CIAD-2026-0049 guide.
- Purpose and scope
- Approved tools / agents register
- Data allowed and prohibited
- Human review of outputs
- Agent permissions / least privilege
- Logging
- Vendor due diligence
- Incident reporting
- Training
- Review
FAQ
Do I need to subscribe to use these checklists?
No. Each section on this page shows a preview you can use without signing up. The five-template GRC Survival Kit unlocks after you enter a work or personal email (that signup also opts you into the weekly brief). The files stay 100% free through Q1 2027 and are working aids, not exclusive content.
Does an auditor require these items?
No. Checklist items are working aids, not a statement of what any auditor requires. Your auditor decides scope, evidence and sampling. General information, not legal advice; confirm scope with your counsel or auditor.
Which Trust Services Criteria version do you follow?
The SOC 2 checklist follows the 2017 TSC criteria, with point-of-focus titles from the 2020 AICPA PDF. The 2022 revision (free AICPA login) should be checked.
Why are Annex A control titles missing from the ISO checklist?
ISO does not publish the 93 Annex A control titles on a free page. This checklist shows themes and counts from the ISO/IEC JTC 1/SC 27 Journal (37 organizational, 8 people, 14 physical, 34 technological). The full list is in the purchased standard.
Is this a ranking of tools or firms?
No. This is not a ranking or score. Linked agents and auditors are directory listings, alphabetical or filter-based.
Related: all guides · tools · which framework · published costs.
Get updates by email
Subscribe to the Brief
Weekly, free, unsubscribe anytime.
Check your inbox to confirm your email. We’ll only send the weekly brief after you click the link.
We use your email only to send the newsletter. See our privacy policy.
Sources
- AICPA, 2017 Trust Services Criteria (March 2020 points of focus), archived official PDF. https://web.archive.org/web/20230905175109id_/https://us.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/trust-services-criteria-2020.pdf
- AICPA & CIMA, 2017 TSC with revised points of focus (2022; free login). https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022
- ISO — ISO/IEC 27001 (Edition 3, 2022-10; Amd 1:2024). https://www.iso.org/standard/27001
- ISO/IEC JTC 1/SC 27 Journal Vol 2 Issue 2 (Dec 2022) — 93 Annex A controls in four themes. https://committee.iso.org/files/live/sites/jtc1sc27/files/resources/ISO-IEC%20JTC%201-SC%2027_N22755_SC27%20Journal%20Vol%202%20Issue%202%20%28update%20Dec%202022%29.pdf
- ISO — management system standards (harmonized clause structure). https://www.iso.org/management-system-standards.html
- European co-operation for Accreditation FAQ — ISO/IEC 17021-1 clause 9.1.3. https://european-accreditation.org/sp_accordion_faqs/question-37-12-iso-17021-12015-clause-9-1-3/
- AICPA & CIMA — Mapping: 2017 Trust Services Criteria to ISO 27001 (2018 spreadsheet). https://www.aicpa-cima.com/resources/download/mapping-2017-trust-services-criteria-to-iso-27001
- AICPA & CIMA — SOC 3 (general-use reports). https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-3
- NIST AI Risk Management Framework. https://www.nist.gov/itl/ai-risk-management-framework
- ISO — ISO/IEC 42001. https://www.iso.org/standard/42001
Prepared by Agent Index (Heritage Services). Last reviewed 21 Oct 2026. General information, not legal advice; confirm scope with your counsel or auditor. Checklist items are working aids, not a statement of what any auditor requires. Licensed CC BY 4.0.