The company formally maintains a state of readiness to demonstrate compliance to external auditors at any time
A commitment to continuous audit readiness, with defined scope and named response roles, makes this control's independent reviews easier to run without scrambling to prepare each time.
This policy control commits in writing to continuous audit readiness with defined scope, current evidence and named response roles, the readiness posture A.5.36's compliance checking supports.