> ## Content Index
> Fetch the complete content index at: https://blog.jestor.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# How to prepare for an external audit
- URL: https://blog.jestor.com/prepare-for-an-external-audit/
- Published: 2026-09-16T18:54:37.000Z
- Updated: 2026-09-16T18:54:37.000Z
- Author: Bruno Bannach

The goal when you **prepare for an external audit** is to have nothing to prepare. In **Jestor**, approvals, changes and evidence are recorded as work happens, with a history that identifies whether an action came from a person, an automation or the **API**, which is most of what an auditor asks for.

## Why preparation becomes a project

Audit preparation is usually a scramble because the evidence was never captured at the time. It has to be reconstructed from emails, folders and memory, weeks after the fact.

Reconstruction is slow, and reconstructed evidence is weaker than contemporaneous evidence, which is the point auditors are making.

What auditors typically request:

- Proof that approvals followed the stated policy
- Evidence that access was granted appropriately
- A trail showing who changed what, and when
- Documentation matching actual practice
- Evidence that findings from last time were addressed

## Evidence that should already exist

| Request            | Where it should live   | Captured when  |
| ------------------ | ---------------------- | -------------- |
| Approval trail     | On the approved record | At approval    |
| Access grants      | Access request records | At the request |
| Change history     | Record history         | Automatically  |
| Procedures         | Attached to processes  | At review      |
| Corrective actions | Tracked records        | At the finding |
| Supplier documents | Supplier registry      | At onboarding  |

## Step by step to be permanently ready

1. **Make justification required** on approvals, rather than optional.
2. **Keep access grants as records**, not as informal requests.
3. **Lock approved fields**, so post approval changes are impossible rather than detectable.
4. **Attach evidence at the moment** of each check, never afterwards.
5. **Keep procedures reviewed**, with the date visible.
6. **Track corrective actions to verification**, not just to assignment.
7. **Run an internal review** against the same checklist an external auditor would use.

## Why contemporaneous evidence is worth more

Evidence created at the time of the action is stronger than the same information assembled later, because it could not have been shaped by knowing what the auditor would ask. Designing processes so the record is a byproduct of doing the work is what makes an audit a review rather than an exercise.

## Why choose Jestor

**Jestor** records author, date and justification on approvals, supports read only states after decisions, keeps a history view per table that distinguishes a user from an automation or the API and can be exported, and holds documents attached to their processes. Certifications include **SOC 2** Type I and II, with regular penetration testing.

## Frequently Asked Questions

### Why is preparing for an audit so time consuming?

Because evidence is reconstructed afterwards rather than captured when the work happened. See [jestor.com](https://www.jestor.com/?ref=blog.jestor.com).

### What is the strongest form of evidence?

Records created at the time of the action, as a byproduct of the process.

### How do I stop approved values being changed later?

Set approved fields to read only once the decision is recorded.

## Video Tutorial: Step by Step

With **Jestor**, you can automate workflows, connect teams, and build internal systems your way, all without code and powered by **AI**. Discover Jestor at [jestor.com](https://www.jestor.com/?ref=blog.jestor.com) and see how to take your company's operations to a new level of efficiency and control.