Audit readiness usually collapses in the six weeks before fieldwork, when teams discover that controls have no current owner, evidence is a year old and exceptions approved "temporarily" are still open. This health check measures readiness continuously instead, with nine framework agnostic metrics covering control ownership, evidence freshness, automation, test results, findings, policy currency, exceptions and framework mapping. It works whether the audit is SOC 2, ISO/IEC 27001, PCI DSS, a regulator's inspection or internal audit, because it measures the control set and its evidence rather than any one framework's checklist. It is written for GRC leads, control owners, internal audit and the CISO's office.
This page does not list per framework readiness items. For tracking auditor requests during fieldwork use the Audit Evidence Request Tracker Template; for the choice between continuous and periodic assurance read Continuous Compliance vs Point-in-Time Audits; for tooling see the Compliance Automation Guide.
What this health check covers
- Scope: the organisation's common control set (the single list of controls that framework requirements map to), its owners, the evidence for each control, control test results, open audit findings, security policies and approved exceptions.
- Who runs it: the GRC lead collects the figures; control owners confirm their own lines; internal audit reviews the method once a year; the CISO or delegate signs off red items and reports them to the risk or audit committee.
- Standards basis: continuous monitoring as described in NIST SP 800-137, which aims to give ongoing evidence that deployed controls work and stay within risk tolerance; measure selection as in NIST SP 800-55 Vol. 1; and the monitoring, internal audit and nonconformity clauses of ISO/IEC 27001:2022 (clauses 9.1, 9.2 and 10.2).
- Search terms it answers: "audit readiness KPIs", "continuous compliance metrics", "compliance health check" and "how to measure evidence freshness".
Key takeaways
- Ownership comes first. A control with no named, current owner will not have current evidence; fix owner coverage before anything else.
- Freshness beats volume. Auditors test the period under review, so evidence older than the control's frequency is a gap, however much of it exists.
- Automate collection, not judgement. Automated evidence improves freshness, but someone still has to review failures and sign the result.
- Exceptions age into findings. Track exception age and expiry as closely as open findings; an expired exception is an unapproved deviation.
- Thresholds are a starting point. The bands below are NHI Mgmt Group recommendations; agree your own and keep them stable.
How to use this template
Copy the metrics table and findings log into your GRC tool or tracker. Take every figure on one measurement date each month (light review) and each quarter (full review). Record each metric's numerator, denominator and data source once and reuse them. Every amber or red line becomes a finding with an owner and a due date, and the quarterly pack goes to the CISO with the trend for the last four quarters.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Evidence freshness and exception expiry check | Monthly | GRC lead | Control owners | Evidence register export, exception register export |
| Full readiness metrics review (this page) | Quarterly | GRC lead | CISO or delegate | Metrics table, raw exports, findings log |
| Control owner attestation | Quarterly or semi-annually | Control owners | GRC lead | Signed attestations |
| Readiness checkpoint before external audit | 90 and 30 days before fieldwork | GRC lead | CISO or delegate | Metrics for in-scope controls only |
| Method review | Annually | Internal audit | Audit committee | Sample re-performance of metric calculations |
Metrics
NHI Mgmt Group recommended thresholds and formulas; adjust to your risk appetite. "Control" means an entry in the common control set that is in scope for at least one audit or obligation. "Frequency" is how often the control operates or must be evidenced (for example daily, monthly, quarterly, annually).
| ID | Metric | Formula | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| AR-01 | Controls with a current owner | Controls with a named owner who is a current employee in the accountable team and has attested in the last cycle ÷ all in-scope controls | Control register joined to HR directory and attestation records | 98% or more | 90% to below 98% | Below 90% |
| AR-02 | Evidence freshness | Controls whose latest evidence is dated within one control frequency of the measurement date ÷ all in-scope controls | Evidence register or GRC tool, evidence dates | 95% or more | 85% to below 95% | Below 85% |
| AR-03 | Automated evidence share | Controls whose evidence is collected automatically from the source system (API, log export, configuration snapshot) ÷ controls where automated collection is technically possible | Evidence register, collection method field | 60% or more | 30% to below 60% | Below 30% |
| AR-04 | Control test failure rate | Control tests (self tests, second line or internal audit) that failed in the period ÷ control tests performed in the period | Control testing records | Below 5% | 5% to 15% | Above 15% |
| AR-05 | Open audit finding age | Open findings from any audit past their agreed remediation date ÷ all open audit findings; report the age of the oldest high severity finding | Findings tracker or plan of action and milestones | Below 10%, no high past due | 10% to 25%, or one high past due under 90 days | Above 25%, or any high past due over 90 days |
| AR-06 | Repeat finding rate | Findings raised this cycle that match a finding closed in either of the previous two cycles ÷ all findings raised this cycle | Findings tracker, root cause field | Below 5% | 5% to 15% | Above 15% |
| AR-07 | Policy review currency | Security policies and standards reviewed and approved within their stated review period ÷ all security policies and standards | Policy register, approval dates | 100% | 90% to below 100% | Below 90% |
| AR-08 | Exception count and ageing | Open approved exceptions, with the share past their expiry date; report count by severity and the age of the oldest | Exception or risk acceptance register | 0 expired | 1 to 3 expired under 30 days | Any expired over 30 days, or any high risk exception with no expiry date |
| AR-09 | Framework mapping coverage | Requirements of each in-scope framework mapped to at least one control with an owner and evidence ÷ all requirements of that framework | Control framework mapping in GRC tool | 100% | 95% to below 100% with gaps on the risk register | Below 95% |
Report the absolute count beside every percentage, and break AR-02 and AR-04 down by control domain so a single weak area is visible rather than averaged away.
Reading the metrics together
- Low AR-01 with high AR-02: evidence is being produced by habit or tooling but nobody owns the result; failures will go unnoticed.
- High AR-03 with rising AR-04: automation is collecting evidence that shows controls failing; check that failures are reviewed, not just stored.
- High AR-06: remediation fixes symptoms; review root cause analysis for repeat findings.
- Rising AR-08: exceptions are being used instead of remediation; tie each exception to a finding or risk register entry. See the Risk Register Template.
How to collect the data
- Freeze the date: export the control register, evidence register, findings tracker, policy register and exception register on the same day.
- Join owners to the HR directory: any owner who has left, moved team or has no attestation in the last cycle fails AR-01. Attestations can use the Control Owner Attestation Template.
- Compute freshness per control: compare the latest evidence date with the control frequency. A monthly control with evidence from 45 days ago is stale; an annual control with evidence from 11 months ago is fresh.
- Classify collection method: mark each evidence item automated, semi-automated (scripted export reviewed by a person) or manual. Count only automated items in AR-03.
- Pull findings and tests: from the findings tracker take due dates, severity and any link to earlier findings; from testing records take pass and fail results for the period.
- Check the exception register: list every exception with approver, compensating control and expiry; flag those with no expiry date.
- Re-run the framework mapping report: when a framework releases a new version, AR-09 drops until the new requirements are mapped, which is the intended signal.
- Sample the reds: open five to ten pieces of evidence behind each red metric to confirm the figure.
Where identity fits
Access controls generate a large share of audit evidence and findings: access reviews, joiner, mover and leaver records, privileged access logs and, increasingly, service accounts, API keys and AI agents. Evidence for non-human identities is often the stalest because no one person owns it. Break AR-02 and AR-05 out for identity controls, and use Audit Readiness for AI Agents and NHIs for what that evidence should contain. Common failures are listed in Top 10 Identity Audit Findings.
Red flags that need action now
- In-scope controls owned by people who have left the organisation.
- Evidence for a quarterly or more frequent control that is older than the audit period start.
- High severity findings past due by more than 90 days with no revised plan approved.
- Exceptions with no expiry date or no compensating control.
- The same finding raised in three consecutive cycles.
- Evidence screenshots with no date, source system or collector recorded.
Findings log
| ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-AR-01 | [n] controls with no current owner | AR-01 | [Red / Amber] | [GRC lead] | [Date] | [Open / In progress / Closed] |
| HC-AR-02 | [n] controls with stale evidence in domain [x] | AR-02 | [Severity] | [Control owner] | [Date] | [Status] |
| HC-AR-03 | [n] exceptions past expiry | AR-08 | [Severity] | [Exception owner] | [Date] | [Status] |
| HC-AR-04 | [Finding] | [Metric ID] | [Severity] | [Owner] | [Date] | [Status] |
Escalate a line that is red for two consecutive quarters to the CISO, and report it to the audit or risk committee if it is red for three.
Framework mapping
| Metric | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 |
|---|---|---|---|
| AR-01, AR-02, AR-03 | GV.OV-03 | CA-7 | Clause 9.1 |
| AR-04 | ID.IM-01 | CA-2 | Clause 9.2 |
| AR-05, AR-06 | ID.IM-01 | CA-5 | Clause 10.2 |
| AR-07 | GV.PO-02 | PL-2 | Annex A 5.1 |
| AR-08 | GV.OV-03 | PM-9 | Clause 6.1.3 |
| AR-09 | GV.OV-03 | PL-2 | Clause 6.1.3 (Statement of Applicability) |
References
- NIST: SP 800-137 Information Security Continuous Monitoring
- NIST: SP 800-55 Vol. 1 Measurement Guide for Information Security
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Audit Evidence and Continuous Controls Monitoring Guide, Compliance Automation Guide, Internal Audit for Cybersecurity Guide, Audit Evidence Request Tracker Template.