“But … It Passed Last Year”: The Assumption That Can Haunt Your Next Audit

Halloween may be a bit early to talk about A Christmas Carol, but the Ghost of Audits Past could haunt your team at any time of the year.

It’s a fairly familiar scenario for lots of CISOs: as the next audit approaches, someone opens last year's request list and starts assigning tasks. The files are familiar, the owners know the routine, and the team has a report showing that the previous engagement was completed successfully. Theoretically, this year’s audit should be straightforward.

Then the bumps start to appear as one control owner asks why a particular spreadsheet is needed, and then another points out that the export no longer includes all the relevant applications. The explanation is reassuring enough to keep things moving: “It passed last year.”

Unfortunately, although a previous audit provides useful historical context, the processes behind it often carry unresolved problems into the next engagement. These “ghosts” also tend to appear at the worst possible time, when deadlines are tight and the team has the least capacity to deal with them.

Read more: The Franken-Audit: When Good Evidence Becomes a Jumbled Mess

‍

A completed audit can conceal a difficult process

An organization can complete a successful audit while relying on workarounds that make the next one harder. Perhaps the security lead spent days explaining an ambiguous request, a system owner produced several versions of an export before the right population was established, or a late call resolved a question that never made it into the team's written instructions.

It’s easy to say that “a pass is a pass” but that often hides the pain that the team endured to make it happen. The report doesn't tell the internal team everything about that experience, and if the request list becomes the starting point for next year, the final artifact may survive while the explanation behind it disappears.

This level of vagueness leaves colleagues repeating tasks without even knowing why they were needed. When the original owner changes roles or leaves, even a familiar control can become difficult to substantiate. The organization may have retained the files, but it lost part of its understanding of how the audit was completed.

Last year's workaround becomes this year's procedure

As an example of how things can snowball from year to year, imagine a team that spent weeks gathering change management evidence during its last audit. The auditor needed to understand how production changes were approved, but the team initially supplied tickets without any of the supporting review records. After lots of back-and-forth, an engineering lead pulled together the missing information and explained how the process worked.

A year later, the engineering lead has left, and their explanation was never added to the collection instructions. So, the team blindly follows last year’s request list and submits the same type of tickets, assuming they’ll be sufficient because the previous audit was completed successfully. As expected, when the auditor asks for evidence of approval, the familiar scramble begins. The engineers search old records and security coordinates the responses, and then someone eventually remembers that this happened last year too. A problem that could’ve been addressed after the previous engagement has become another deadline-driven exercise.

The previous audit established that the evidence ultimately supplied supported the auditor’s assessment, but it didn’t establish that the company had a reliable process for producing it again, and copying the request list carries that weakness into the next engagement.

Reassess the assumptions behind recurring requests

How can an organization prevent itself from being haunted by their previous mistakes? Here’s a few areas to consider:

1. Before reusing an evidence plan, review what has changed since the previous engagement. An acquisition, a new identity system or a different operating model may change which populations and processes need to be considered. Smaller changes, such as a revised approval workflow, can also affect the evidence available.
2. Pay particular attention to controls that generated repeated questions last time. Determine whether the difficulty came from how the control operated, how the evidence was prepared, or how the request was understood. Each requires a different response.
3. If the activity wasn't performed as intended, management needs to address the underlying control issue. If the evidence omitted essential context, improve the submission instructions. If the request was unclear, discuss it with the auditor before asking several teams to repeat the collection exercise.

That review should produce an updated evidence plan with a reason for each change. It should also leave room for the auditor to determine the testing required for the new engagement.

Preserve the explanation as well as the artifact

Useful audit history should also include the decisions that made a submission understandable. In practical terms, this means recording why a source was selected, what population it covered, and how discrepancies were resolved. Where ownership changes, include responsibility for maintaining that explanation in the handover.

After the audit, review the requests that consumed the most time. Look for recurring causes and assign responsibility for improving the process while the experience is still fresh. During the next cycle, check whether those improvements have actually reduced the difficulty.

This creates a more reliable operating rhythm between engagements. Teams can identify changes as they happen and retain evidence of recurring activities close to their execution, reducing the dependence on retrospective reconstruction.

Bring current context into the next engagement

Thoropass brings evidence requests and auditor collaboration into its Audit Lifecycle Platform, helping teams manage questions and submissions in a shared workflow. First Pass AI can flag routine evidence issues, such as missing information or outdated artifacts, before formal testing.

Direct discussion with experienced auditors helps teams examine whether their planned evidence reflects the current business and scope. That discussion is particularly valuable when a familiar submission no longer tells the full story.

Technology can reduce the administrative work around those conversations. Management remains responsible for its controls, and auditors independently assess the evidence and reach their conclusions.

Give last year's experience a useful role

The next audit should benefit from the work your team has already done. Reusing clear instructions and retaining relevant context can save considerable effort, provided those instructions are checked against the current environment.

Before copying last year's request list, choose the three submissions that caused the most difficulty. Establish why they were difficult, what has changed, and who owns the improvement. That's a practical way to stop the same problems returning whenever an audit approaches.

Talk to Thoropass about an audit process that combines earlier evidence feedback with direct access to experienced auditors.

‍