Audits go smoothly when the evidence is already in one place. They go badly when the first week is spent chasing PDFs in inboxes.
This checklist covers the supplier evidence auditors ask for most often.
| Evidence | Where it comes from | Valid for |
|---|---|---|
| Signed contract and DPA | Procurement / legal | Contract term |
| Security certificate (ISO 27001, SOC 2) | Supplier | Usually 12 months |
| Completed security questionnaire | Supplier, via GRC Watch | 12 months |
| Risk assessment and decision | Your team | Until next review |
| Exit plan | Your team | Until next review |
Store the evidence next to the supplier, not in a shared drive folder named after the audit. Next year's audit asks the same questions.