Mike Austin advises running an internal audit before a vendor audit to preview your environment. He outlines scoping and kickoff call practices, including nominating a single point of contact and clearly defining what is included or excluded from the audit (e.g., ERP vs. database/applications for vendors like IBM or Oracle).
Chapters
We we believe fundamentally that if you get audited by a vendor you should run an internal audit yourself prior to the auditors coming in so that you can kind of see what's going on in the environment. And I'll explain that in more detail a little later. And then once you get the notification there's a scoping and kickoff call and it's important there. Again we'll talk in details on this but in that it's important to, you know, nominate a single point of contact that the auditor is only allowed to talk with that person. You know, make sure that it's defined what's in the audit, what's out of the audit that could products. So if you look at the big vendors like IBM or Oracle, it could be, you know, is ERP in, is it out? Is it just, you know, database and applications on the Oracle side that also could be what parts of your organization are included in the audit.