Introduction
An audit date lands in the diary, and the scramble starts. Evidence is scattered across inboxes. Nobody is sure who owns the access review. A reconciliation exception from March is still open.
When preparation begins late, auditors find these gaps before management does. The FCA's Consumer Duty review of 23 payments firms found just under half had only partially implemented the Duty and needed significant further work.
An audit readiness assessment gives you a structured view of where you stand, where the gaps are, and what to fix first, before fieldwork begins. This guide covers what it includes, how to run one, and where UK fintechs most often fall short.
Key Takeaways
- A readiness assessment is a diagnostic, not an audit opinion or certification.
- Link every requirement to a control, owner, evidence source, test and deadline.
- Look beyond financial records: regulatory, third-party and technology risks matter too.
- Treat readiness as ongoing monitoring, not a pre-audit sprint.
What Is an Audit Readiness Assessment?
An audit readiness assessment is a pre-audit review of your scope, controls, processes, documentation, systems, people and evidence against the requirements of a specified audit or framework. There is no single authoritative definition, so agree on one with your stakeholders at the outset.
Readiness assessment vs formal audit
A formal audit is an independent examination that can produce an opinion, report, attestation or certification. Under the IIA's 2024 standards, assurance engagements must communicate a conclusion on governance, risk management and control effectiveness. A readiness assessment does not. It identifies gaps and priorities.
Who performs it matters. It can be done internally, by a specialist adviser, or sometimes by the intended auditor, but independence rules apply. The FRC Ethical Standard restricts non-audit services that statutory audit firms provide to audited entities, particularly public interest entities. Confirm with your auditor before engaging anyone.
Typical outputs
A good assessment produces:
- A confirmed scope
- A control-and-evidence matrix
- A risk-rated gap register
- A list of missing documents
- Named owners and target dates
- Remediation recommendations and retesting criteria
Management should finish with a defensible view of what is ready, what is partially ready, what lacks evidence, and what must be fixed before fieldwork.
Why Audit Readiness Matters for Fintechs
Less disruption and rework
Incomplete evidence, vague responsibilities and repeated auditor requests stretch fieldwork and pull operational teams away from their jobs. Open reconciliations and control exceptions make it worse.
A wider risk environment
Fintech audits rarely stop at the financial statements. Depending on your permissions, products and customers, scope may include:
- Customer onboarding and AML controls
- Transaction monitoring
- Safeguarding and client-money processes
- Complaints and data protection
- Operational resilience and access management
- Regulatory reporting
Not every area applies to every firm. Validate the requirements against your own permissions and operating model. For example, CASS 15 safeguarding rules apply to payment and e-money firms, and the FCA's PS25/12 strengthens that regime.
Situations that should trigger an assessment
- First-time audits or planned regulatory reviews
- New licences, permissions or variations
- Fundraising and investor due diligence
- Sponsor-bank or banking-partner reviews
- Expansion into new jurisdictions
- Major product launches, acquisitions or system changes
- Rapid growth or repeat audit findings
Counterparty requests such as investor or banking-partner due diligence are commercial requirements, not FCA rules. They still shape what you must be able to show.
Stakeholder confidence
A documented readiness position helps boards, investors, partners and auditors see your control maturity and outstanding risks. It also tends to improve everyday governance and management information, because weaknesses surface earlier.
What an Audit Readiness Assessment Covers
Scope, criteria and boundaries
Before any testing, define:
- Audit type and applicable framework or regulation
- Legal entities, products and jurisdictions
- Systems and the reporting period
- Materiality thresholds and evidence expectations
Document exclusions and assumptions. Otherwise management may mistake a limited-scope review for full readiness.
Frameworks matter here. ISO/IEC 27001:2022 is the current edition. PCI DSS v4.0 was retired on 31 December 2024, so v4.0.1 is the only active version. DORA applies to EU-regulated entities, so it is relevant to UK-facing firms only where an EU entity or activity is in scope.
Governance, accountability and resources
Check for management sponsorship, a named audit contact, control owners, escalation paths and committee oversight. A RACI-style model helps, though it is not mandated.
Then hunt for single-person dependencies. Can the control still run when that person is on leave, leaves, or the team doubles in size?
Policies, procedures and control operation
Four separate questions apply to every control:
- Is there a policy?
- Is the control designed appropriately?
- Does it operate consistently?
- Is there evidence it operated during the period?
Walk through approvals, segregation of duties, access reviews, customer-risk processes, monitoring, change management and exception handling, as relevant to scope. Assurance standards such as ISAE 3402 draw the same line between controls designed at a point in time and controls tested over a period.
Evidence, data and retention
Evidence includes policies, training records, case files, alerts, approvals, reconciliations, minutes, tickets, logs, vendor reviews and regulatory submissions. It should be complete, dated, attributable, easy to retrieve and protected from alteration.
Retention rules vary. MLR 2017 regulation 40 requires CDD and transaction records to be kept for five years from the relevant event. UK GDPR says personal data should be held no longer than necessary, and the ICO sets no fixed periods by data type.
Third parties and cross-border dependencies
Cloud providers, payment processors, sponsor banks, outsourced compliance and group entities all shape your control environment. Map who is responsible for what: access, oversight, incident reporting, evidence availability and data transfers.
FCA SYSC 8 covers outsourcing controls, including regulator and auditor access. Outsourcing never transfers your accountability for operational resilience.
How to Conduct an Audit Readiness Assessment
Step 1: Set objective, scope and timetable
Fix the target audit date, decision-makers and applicable requirements. Build a timeline with room for remediation, evidence collection and retesting. Talk to the intended auditor or authority early, so scope, materiality and evidence expectations are not guesswork.
There is no standard readiness window. Fraxtional's risk assessments typically run two to four weeks, with initial findings within ten business days, but remediation time depends on what you find.
Step 2: Map requirements to controls and evidence
Build a control matrix with these columns:
- Requirement and control objective
- Control owner and frequency
- Evidence source and testing method
- Current status and gap
- Due date and reviewer
The matrix exposes requirements with no control, controls with no owner, and controls with no reliable evidence.
Step 3: Walk through and test
Interview accountable staff, observe processes, inspect sample evidence, review system configurations and test whether controls operated across the period. Assess design and operating effectiveness. A policy document or a verbal assurance is not proof. If you sample, record the population, method and size.
Step 4: Rate gaps and plan remediation
Prioritise by regulatory significance, customer or financial impact, likelihood, audit risk, dependencies and time to fix. Every action needs an owner, deadline, resources, acceptance criteria and a retest method. Record the rationale for any risk that management chooses to accept.
Step 5: Validate, report and maintain
Run a dry run of likely auditor requests. Confirm evidence is complete and retrievable. Report open high-priority issues to management and governance forums.
Then keep going. Monthly or quarterly monitoring, control testing, policy reviews and issue tracking turn a one-off exercise into a programme.
Common Audit Readiness Gaps and How to Address Them
Evidence and documentation problems
FCA reviews show the pattern. A review published in 2026 found CDD process gaps including procedures lacking practical detail, missing records of the purpose of business relationships, thin EDD evidence and weak version control.
FCA observations on operational resilience also flagged unclear remediation owners and little recorded second- or third-line input.
Common culprits:
- Stale policies and undocumented processes
- Incomplete case files and inconsistent approvals
- Missing timestamps and poor file naming
- Evidence held in personal inboxes or chat threads
A central evidence repository, standard templates, documented procedures and clear retention rules fix most of this.
Growth, change and ownership gaps
New products, new jurisdictions, system migrations, new vendors and rapid hiring can invalidate controls that used to work. Watch for:
- Unclear control boundaries
- Untrained staff or reliance on a single employee
- Weak communication between compliance, engineering, finance, operations and leadership
When to bring in specialist support
Consider outside help if you:
- Lack an experienced compliance leader
- Juggle several regulators
- Face a material review or partner due diligence
- Need an objective remediation plan
Fraxtional offers director-led fractional compliance leadership, including CCO, CRO, CAMLO and MLRO support, and a Policy and Controls Review with control effectiveness testing and documentation gap analysis.
Support has limits. The FCA says it will probably refuse an application if external support is a firm's only compliance resource, and the accountable individual must have sufficient knowledge and experience. External support does not replace management accountability or auditor independence.
Frequently Asked Questions
How do you ensure audit readiness?
Define scope, map requirements to controls, keep complete evidence, assign clear owners, test periodically and track remediation. Continuous monitoring beats a last-minute document hunt.
What is a readiness checklist?
A readiness checklist is a control matrix tracking requirements, controls, owners, evidence, testing status, gaps, deadlines and remediation progress for a specific audit.
What are the 5 stages of an audit?
Commonly: planning and scoping, risk assessment, fieldwork and testing, reporting, and follow-up. Terminology varies by audit type and framework.
What is a readiness audit?
A readiness audit is a pre-audit assessment that finds weaknesses and prioritises fixes. It is not the formal audit that produces an opinion, report or certification.
How far in advance should a business complete an assessment?
It depends on scope, complexity and likely remediation workload. Leave enough time to fix, document and retest material gaps before fieldwork.
Can a growing fintech complete an assessment without a full-time compliance officer?
Yes, with accountable internal owners and qualified external support. Management keeps responsibility, evidence stays accessible, and the arrangement must not compromise the formal auditor's independence.
