We don’t know what is missing until the auditor asks.
Fix: A record without a file shows the gap, and the audit period groups the records In period, so you see what the auditor will see.
See audits and recordsCertification audit
Certification audit preparation
The auditor arrives in eight weeks. Know today what they will find.
Before the certification audit, Acuna GRC shows you which proof is ready and which is missing. Run your internal audit in it, and track every finding until it is verified and closed.
1 · WATCH YOUR KPIS6 of 8 on target
✓Controls run on time94%On target
✓Records with a file97%On target
✓Audits held as planned2 of 2On target
!Overdue corrective actions3Warning
2 · FILL THE GAPRecords
Records without a file54File attached
✓EVD-014 · Firewall rule reviewNo file yetFiled
✓EVD-012 · Access review Q3Filed
3 · GENERATE THE REPORTGenerate Report
✓Management review · Q3GeneratingPDF · snapshot saved
✓KPI section · Controls run on timeIncluded
✓List section · Open issuesIncluded
Does this sound like you?
Why does audit preparation feel like a scramble? The gaps show up too late.
Most teams find out what is missing when the auditor asks for it. Audit readiness means seeing the gaps first, while there is still time to close them.
Our internal audit is a spreadsheet.
Fix: Plan audit programs, run each audit with its lead auditor and auditee, and log what it finds as issues linked to the requirement.
See the internal auditFindings from last year are still open.
Fix: Each issue gets a corrective action with its root cause, and the action is verified before it is closed.
See corrective actionsHow Acuna GRC covers it
How do you prepare for a certification audit? Assess, audit, fix, then report.
Start with a gap assessment in Evaluations. Then run the internal audit in Assure, close what it finds with corrective actions and generate the report management reviews, with connectors keeping the numbers current.
01 · Evaluations
How do we know we are ready?
Run a pre-audit gap assessment against your framework. The evaluation freezes on the day it is answered, a reviewer validates or adjusts each item, and the gap report shows how much meets its target, per domain.
See Evaluations →02 · Assure
What evidence will the auditor ask for, and is it all there?
Plan your audits in a program, internal first. Set the audit period, and the audit groups its linked records as In period, Undated and Other periods, hiding nothing. A record without a file or link shows the gap.
See audits in Assure →03 · Assure
How do we close what we find before the auditor arrives?
Log each finding as an issue linked to the audit and the requirement or control. Open a corrective action with its root cause, and move it from Implemented to Verified before you close it. Owners are reminded when it is due.
See corrective actions in Assure →04 · Assure
How do we produce the management review?
Pick a report template, set the period and scopes, and click Generate Report. Its sections show your live KPIs, so the report and the dashboard agree. Export to PDF or Excel; each generation is saved as a snapshot.
See Assure →05 · Integrations
Can the numbers keep themselves up to date?
Connectors pull data from your identity, device and cloud tools every 4 hours and record it as KPI measurements or control executions. A control that passes moves its next due date, so the proof stays current.
See Integrations and API →Also part of the preparation
- ImplementEvery control has an owner and a schedule, and a signed checklist run creates its record on its own.
- OperateCompleting a task lets you link or create a dated record on the spot, naming who did the work.
- Staff PortalStaff acknowledge each published policy, and each acknowledgement is kept with the version read.
Aiko at your pace
Can AI help us get audit ready? Aiko drafts. You confirm.
Ask Aiko for a KPI in plain words, such as overdue corrective actions with a target of 0. Aiko drafts it on a card, and nothing is created until you confirm.
1Aiko proposes
Aiko · Create a KPI“Create a KPI for overdue corrective actions, target 0, owner Anna.”You ask in plain languageProposalKPIOverdue corrective actionsTarget0OwnerAnna2You confirm
You check the cardConfirm✓KPI createdRecorded in the Activity log, with its inputs and outcome.3You set the pace
How much Aiko doesSuggest only
Aiko explains. You do it.Ask me first · default
Aiko prepares. You confirm.Do it and tell me
Aiko does it and shows you.
Missing links, planned in one run
Ask which controls have no measure and Aiko plans the missing links in a bulk run. Nothing is linked until you click Apply.
Some things always ask first
Admins set the highest mode for each action.
Every step on record
Every Aiko action goes into the Activity log.
One Aikoacross Acuna GRC. Add a module and it helps there too. How Aiko works
Swiss experts
Can someone prepare the audit with us? Our auditors do it with you.
A Certified Lead Auditor, a management systems auditor and an ISO 27001 Lead Implementer prepare the certification audit with your team, in Acuna GRC. The certificate itself comes from an accredited certification body.
.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
Auditing expert
Jean Munyarugerero
Management systems auditor
GRC Consulting team leader
Bénédicte Sévin
ISO 27001 Lead Implementer
Do it yourself
You run the program in Acuna GRC, with Aiko.
Done with youAudit preparation
Guidance, reviews and audit preparation with your team.
Done for you
Our experts run it. You review.
Audit preparation, done with you
- Run a gap assessment against your framework
- Lead an internal audit with your team
- Check the records the auditor will ask for
Integrations
Can Acuna GRC collect audit evidence from our tools? Yes, with 100+ connectors.
Connectors pull security data from the identity, device, cloud and backup tools you already run, on a schedule. Each one you connect is one less screenshot to take before the audit.
Animation: a robot arm takes data from Microsoft Entra ID, Microsoft Defender, Azure, AWS, GitHub and Jira and puts it on a belt into your workspace in Acuna, where your evidence, KPIs and security alerts stay current.
Entra ID
Entra Access Reviews
Okta
Intune
Defender
CrowdStrike
AWS
Azure
Microsoft 365
GitHub
Acronis
KnowBe4
Jira- 100+ connectors in all
Your tools feed Acuna GRC
Connectors pull security data on a schedule, and API keys let your own systems push data in. Every call is logged.
Missing a connector? We build it.
We design the integration around your setup. Every native connector we have exists because a client needed it.
Fixes land where your team works
Tasks sync both ways with Jira and ServiceNow. See Integrations and API
How it connects
Which parts of Acuna GRC prepare the audit? Assure, with what feeds it.
The audit runs in Assure, the gap assessment in Evaluations. Implement and Operate file the records as work gets done, and connectors keep the KPIs current.
Acuna GRC core
Add-on modules
Audit preparation connects to
- EvaluationsA gap assessment before the audit
- AssureAudits, records and corrective actions
- ImplementSigned control runs file records
- OperateTasks done file dated records
- Integrations and APIConnectors keep KPIs current
- AikoDrafts KPIs, plans missing links
FAQ
What else do teams ask before a certification audit?
Can Acuna GRC certify us?
No. Only an accredited certification body can certify you. Acuna GRC shows what is ready, holds your internal audit and keeps the evidence, and our experts can prepare the audit with you.
Which certification audits can we prepare for?
Any framework you adopt in Comply, such as ISO 27001, with your own frameworks importable from a CSV file. An audit in Assure can be Internal, External or Certification. Read the ISO 27001 guide
What if a gap stays open on purpose?
Request an exception with a justification and a required Valid until date. While it is approved, the issue shows Risk accepted. Exceptions come with the Evaluations add-on.
Can the auditor see the records in Acuna GRC?
Yes, if you invite them. The starter Auditor access profile can be set to read-only, limited to the scopes in the audit.
Where is our data hosted?
In Switzerland, the EU or the US, as you choose.
Certification audit coming up? Start with one step.
Tell us your framework and your audit date. We show you how Acuna GRC gets you ready, and how our experts can prepare the audit with you.
Hosted in Switzerland, the EU or the US