Most audit preparation advice describes the weeks before fieldwork. By then the outcome is largely decided.
That is not a complaint about the advice. Those weeks do need managing. But the things that determine whether an audit goes smoothly happened months earlier, and no amount of preparation in the final fortnight can retroactively create them.
Three things decide it: whether the controls actually ran, whether evidence was captured as they ran rather than reconstructed afterward, and whether anyone can explain the process without preparing first.
I serve as the sole point of contact for an annual external financial statement audit, and those audits have come back with zero findings. What follows is what actually produces that, working backward from what auditors test.
The diagnostic nobody wants to run
If audit preparation requires weeks of reconstruction, that is not a workload problem. It is telling you the controls are being performed informally, if at all.
Reconstruction means assembling evidence after the fact for something that was supposed to produce evidence as it happened. If a reconciliation was reviewed, there should be a record of the review. If you are creating that record in March for a review that happened in July, what you are documenting is that somebody probably looked at it.
The scramble is a symptom. It is worth treating as one.
Working backward from the request list
The PBC list is predictable. Substantially the same schedules, the same reconciliations, the same supporting documents, year after year.
Which means it can be treated as a standing year round requirement rather than an annual surprise. The schedules auditors will ask for get built as part of the close, rolled forward each period, and are simply ready when asked for.
That change alone removes most of the pain. A schedule built monthly takes a few minutes each time and is always current. The same schedule built once a year takes days, is built from memory of what happened eleven months ago, and is the one most likely to contain an error.
Evidence captured as the work happens
The distinction between contemporaneous and reconstructed evidence is one auditors care about a great deal, and for good reason.
Contemporaneous evidence shows what happened. Reconstructed evidence shows what somebody believes happened. The difference is visible, and it changes how much testing gets done.
The way to make this automatic is to build retention into the procedure rather than treating it as a separate filing task. When the written procedure for a control says what evidence it produces and where that evidence goes, the evidence gets captured by whoever performs the work, as part of performing it. When retention is a separate task competing with everything else at month end, it loses.
This is also one of the strongest arguments for automating a control sensitive process. A well built automation captures its own audit trail as a byproduct of running, which is both more complete and more trustworthy than a person remembering to file something.
The timeline
Throughout the year. Controls running and leaving evidence. Reconciliations completed and reviewed, with reconciling items cleared rather than carried. Unusual or non standard transactions documented when they occur, while the reasoning is fresh.
Quarter end. Roll forward the schedules auditors will want. Clear aged reconciling items rather than letting them accumulate, because an item carried for four quarters is a question you will have to answer.
Before fieldwork. Work the PBC list. Confirm walkthrough readiness. Close out prior year findings and be able to demonstrate the closure, not just assert it.
During fieldwork. Single point of contact. A tracked request log. A same day turnaround target for anything straightforward.
Walkthroughs
In a walkthrough the auditor is testing whether the process you documented is the process that actually runs.
The most common finding is not that a control is weak. It is that the person performing it describes it differently from the documentation. That gap is itself the finding, because it means the documentation does not describe reality and therefore nobody can rely on it.
The preparation is straightforward and frequently skipped: make sure the people who will be interviewed have read the current documentation for the controls they perform. Not to rehearse them. To find out, before the auditor does, whether the documentation is accurate.
If it is not, fix the documentation. The process is usually fine.
Being the single point of contact
Routing every request through one person sounds like a bottleneck. In practice it is the opposite.
Consistent answers, because one person is giving them. No duplicated requests, because the log shows what has been provided. No half answers from someone who was asked in a hallway and did not have the full context. And a clear record of what was handed over, which matters when a question comes back three weeks later.
It also protects the rest of the team's time. A finance team where six people are each fielding ad hoc auditor requests is a finance team that is not closing the next month.
Areas that attract scrutiny
Predictably: revenue recognition and contract terms, inventory existence and valuation, accruals and estimates, related party activity, and management override risk.
The estimates are worth a specific note. An estimate is defensible if it was supported when it was made. It is not defensible if the support was assembled afterward to justify a number that was already booked. Document the basis at the time, including what you considered and rejected.
What a clean audit actually requires
The unglamorous version: reconciliations that are current, controls that ran and left evidence, documentation that matches practice, and estimates that were supported when made.
None of that is achieved in the weeks before fieldwork. All of it is achieved during the year, mostly by having a close process where these things are tasks with owners rather than intentions.
Which is the real answer to how to prepare for an audit. You prepare for it in February, by running a close that produces the evidence an audit will ask for, and then in the weeks before fieldwork you mostly just hand it over.