Beyond the audit: How to make compliance work every day

The most audit-ready companies don't prepare for audits; they build compliance into how they work every day. That shift turns a yearly scramble into a steady routine, and it gives your business what compliance was meant to deliver: stronger security, greater customer trust, and audits with fewer surprises.

Brad Thies, CEO and founder of BARR Advisory, has spent his career on the other side of the audit table. On an episode of Random but Memorable, he shared what auditors actually look for, why controls matter more than policies, and how to keep pace as AI agents take on more work across your business.

If your business still treats audits like a frantic house clean before a landlord inspection, follow these steps to break the cycle.

Can't see the video? Watch on YouTube.

Understand who audits are for

Start by dispelling a common myth: that audits are simply an internal paperwork exercise. Customers, regulators, business partners, and other stakeholders may all read your audit reports.

As a team, consider how a successful audit might:

• Increase sales
• Reduce customer churn
• Strengthen trust in the marketplace
• Open doors to new, highly regulated industries

Make sure everyone in your organization understands these benefits. Avoid telling employees to follow the rules simply because "they're the rules."

"Here’s an example of where things fall through," Thies said. "A bank might have always complied with a lot of regulations, and they just tell employees, 'We have to comply with this,' without really explaining why beyond 'we have to comply.' It's all about context and explaining why employees have to do these things."

Give compliance an owner

Changing your organization's approach to compliance starts with leadership. Managers need to communicate clearly and visibly demonstrate their commitment to year-round compliance. That means explaining why each requirement exists and following the same processes they expect their teams to follow.

Thies recommends appointing someone to take ownership and drive change. "It has to be somebody with the authority and competence to be able to do that," Thies explains. "If you don't have that, nothing else really matters."

“If you don't address it while it's small, it’ll become a larger and larger hairball."

The most common mistake Thies sees is organizations avoiding ownership of their security and compliance requirements. "It starts with ownership inside the company, and making sure that when they see an issue, they don't let it sit until it becomes a bigger issue. And that's just business! Cybersecurity is one element of business, and like any issue, if you don't address it while it's small, it’ll become a larger and larger hairball."

Focus on controls, not just policies

Most businesses know what they should do to reduce risk and secure access for humans and AI agents. Many turn those best practices into policies, document them in handbooks, and reinforce them during annual training. In practice, employees often ignore these policies. Sometimes leadership isn't committed to them; other times, pressure to stay productive pushes IT and security guidelines aside.

“Follow through on what you say.”

"You need to follow through on what you say," Thies says. "If you say you're doing something, you might as well actually do it."

Auditors want proof your policies aren't empty promises, so don't wait until the last minute to gather evidence. "You can will your way through one audit," Thies adds. "But if you don't make compliance part of your DNA and processes, then it becomes a workload that sits on top of your existing workload."

Instead, put realistic controls in place now. These systems enforce your policies, and the best ones balance the needs of different departments."You can think of a control like a stoplight," Thies said. "Stoplights protect and govern traffic flow. Controls are the same way."

Make the secure way the easy way, so teams don't have to choose between security and productivity. If a policy or control creates friction and triggers workarounds, don't ignore it. Treat that frustration as a signal to bring stakeholders together and find a solution.

Workable controls make it easier to show auditors that:

• Your team has documented clear policies
• You've followed those policies over a sustained period
• You have processes for handling exceptions

The sooner you implement these controls, the smoother your audits will be, and the more likely you'll have evidence ready the moment someone asks. After all, auditors are "looking more for evidence of processes," Thies says, "and not just a general 'did they comply at a point in time,' because we want to make sure the processes operate effectively after we're gone."

Embed compliance into your incident response plans

Thoughtful controls also help your organization respond effectively when a breach occurs. Compliance should form a natural part of your incident response plan.

Thies compares breach response to the long snapper in American football, the player who snaps the ball for punts and field goals. Few people think about the position until something goes wrong. "It's a big catastrophe that typically leads to the other team scoring," he says. "To be effective on that play, you have to plan for the worst-case scenario."

Breaches work the same way. Don't pretend they'll never happen; plan for them.

Many compliance frameworks include requirements that strengthen incident response, such as clear access records that show who did what, and when. So bring compliance into your incident response conversations early. As Thies put it: "Once a breach occurs, there’s still a lot of work to deal with it, but then you recognize, 'Oh, that's why we did those things. That's why we went through those drills and audits. They helped make sure we were prepared.'"

Treat compliance as a discipline that grows with your company

Startup founders often assume compliance matters only to larger companies with hundreds of employees and multimillion-dollar contracts. In reality, compliance affects companies of every size. Whether your health tech company handles one medical record or 1,000, the relevant regulation still applies.

What should change as your business grows is the maturity of your security program. As your workforce and customer base expand, you'll need different tools and processes to protect your crown jewels and secure access across human identities, AI agents, and the secrets they rely on.

Thies explains: "When it comes to the letter of the law around compliance: you have to comply. It's just a matter of to what extent and how mature your program should look." So don't put off compliance. Implement thoughtful policies and reasonable controls now, then evolve them over time.

Don't let AI become a thorn in your side

Teams of all sizes have rushed to adopt AI tools that boost productivity, accelerate software development, and reduce time spent on tedious tasks. While AI requires a shift in your security strategy, it shouldn't fundamentally change your compliance approach. "The bottom line with AI is that it's an amplifier," Thies explains. "What I mean by that is that if you have any weaknesses, they're going to show up pretty quickly."

Auditors still want clear policies backed by effective controls, whether a human or an AI agent is doing the work.

To get a handle on AI usage across your business, ask what each tool or agent is doing:

• Is it merely analyzing internal or publicly available information?
• Is it augmenting a human workflow?
• Is it acting autonomously?

If it works autonomously, ask: Does a human review every decision, only high-impact actions, or no actions at all?

These categories give you a baseline for introducing appropriate policies and controls. "That's the spectrum," Thies explains. "And once you know the spectrum, you'll have a better idea of where the real risk could be. Then you can narrow your focus on where you want to conduct audits and put controls in place."

Thies also recommends treating agents like new hires. You wouldn't give a new employee unrestricted access to sensitive systems, so grant agents only the access they need, expand it gradually, and keep a clear record of what they do. "You need a clear, step-by-step process for getting comfortable letting these things go," Thies said.

Compliance frameworks are still catching up to AI, but the risks are already here. Adapt your processes now, rather than waiting for your auditor to ask.

Break the cycle of annual audit nightmares

Shifting your company's attitude toward compliance will help you win customers, strengthen day-to-day security, and adopt fast-moving technologies like AI without losing control.

Remember that the final report is only one part of a successful audit. More important is the confidence the process gives you: knowing which controls you have in place, what happens when they fail, and that your culture can withstand both emerging and long-standing threats.