Why does every audit turn into a scramble?
A regulator writes, an accreditation renewal comes round, or a large client sends its supplier assurance questionnaire. Suddenly the firm needs to prove things it does every day: that staff are trained, that complaints are handled, that files are checked, that data is protected, that policies are reviewed.
The work was done. The proof is scattered. Training certificates are in inboxes, file review sheets are in a folder nobody has opened since last year, and policy sign offs live in a spreadsheet that one person maintains. So someone senior stops their own work for days or weeks to hunt it all down and arrange it into what the assessor asked for.
Why is compliance work done twice?
Once when the firm does the right thing, and again when it has to show that it did. The second round exists because evidence is not captured at the moment the work happens, in a form linked to the requirement it satisfies.
Then it repeats. Each assessment is prepared almost from scratch, even when the questions are largely the same as last year's, because the previous pack was assembled by hand and nothing was kept in a reusable shape.
How do you work out what evidence gathering costs?
List the assessments the firm faces in a year: regulatory returns and visits, accreditation audits, insurer questionnaires, client audits. For each, estimate the hours spent finding and assembling evidence, by whom. Compliance leads, practice managers and partners are rarely cheap. Multiply each person's hours by their charge-out rate, or by what their time would earn on client work, and add the assessments up.
Then consider the risk side: evidence that cannot be found in time looks the same to an assessor as work that was never done. The unbillable hours calculator converts the time into a yearly figure, and the audit shows it next to the firm's other non-billable work.
What does a rebuilt evidence process look like?
A map from requirement to record
Each requirement you are assessed against is listed once, with the record that proves it, where that record lives and who owns it. One record can serve several requirements across different frameworks.
Evidence collected as a by-product of work
Records are gathered from where they are created, whether a training system, the complaints log, file review forms or a policy library, and filed against the requirement, with dates and owners. Anything overdue or missing is raised with its owner while there is still time to fix it.
Packs built on request
When an assessment arrives, the process assembles the pack in the format asked for, indexed to the questions, with draft covering notes explaining each item. Your compliance lead reviews, adjusts and signs it off.
The aim is not a bigger compliance folder. It is a pack you could produce this afternoon if someone asked.
What changes for compliance leads and partners?
The compliance lead moves from collecting evidence to checking it. Gaps show up month by month instead of in the week before a visit. Partners are not pulled off client work to find their own training records or file reviews.
Client audits become a sales asset rather than a burden. A firm that can answer a supplier assurance questionnaire quickly and completely looks well run, because it is.
Which firms face the heaviest evidence demands?
Firms that answer to a regulator, an accreditor or demanding clients, and often all three. Financial advisers regulated by the FCA are expected to monitor and evidence outcomes for clients under the Consumer Duty. Healthcare practices prepare for CQC inspections. Accountancy firms face practice assurance and quality reviews from bodies such as ICAEW and ACCA, and law firms answer to the SRA. Facilities management and IT and managed service providers answer detailed client security and ISO questionnaires.
Evidence is only as good as the records beneath it. See audit trails for recording who did what on client work, and quality records for firms working to ISO 9001.
What happens over the 30 days?
Week one: we take the assessment that causes the firm the most pain and map every requirement in it to the evidence behind it, with the people who hold that evidence. Weeks two and three: collection and pack assembly are built on your own records and systems and used to produce a real pack, whether for an upcoming assessment or last year's questionnaire. Week four: the compliance lead and record owners are trained, and evidence starts flowing in as the work happens. After go-live there are 30 days of support. How we work explains each step.