A state agency's external audit fieldwork starts next month, but control evidence is still scattered across email. What calendar practice should Policy and Compliance adopt?
Select an answer to reveal the explanation.
Short Explanation
Auditors hate scavenger hunts. Sync the compliance calendar with audit so the evidence binders are stacked before fieldwork, not assembled under fluorescent lights at 11 p.m.
Full Explanation
Aligning the compliance testing calendar with external audit so evidence packages are ready before fieldwork begins is the calendar practice Policy and Compliance should adopt for a state agency whose evidence is still scattered across email. Synchronizing cycles protects public stewardship by avoiding last-minute scavenger hunts. Starting evidence collection only after auditors arrive fails by concept because on-site panic gathering produces incomplete, inconsistent packages. Canceling internal compliance tests for the year to free capacity for audit meetings fails by concept because internal testing is what produces much of the evidence auditors expect. Moving all audit evidence into a personal SharePoint folder owned by one contractor fails by concept because personal repositories create single points of failure and break retention and access control. Exam caveat: CIS-RC emphasizes calendar alignment between compliance testing and audit fieldwork for evidence readiness. Operational check: map internal test due dates to the audit fieldwork start, complete a pre-fieldwork evidence package checklist for in-scope controls, and confirm artifacts live in governed repositories rather than personal email or contractor-only folders.