The relationship with your auditor shapes how an audit feels more than almost anything else. The same controls and the same evidence can produce a calm fieldwork period or a tense one, depending on how both sides communicate.
Most friction comes from mismatched expectations about what the auditor is there to do. This article covers what the role allows, what to agree before fieldwork, how to handle disagreement, and how to make the second audit smoother than the first.
What the auditor is there to do
An auditor is independent by design, and that independence is what gives the report or certificate its value to your customers. It also sets limits on the relationship.
A SOC 2 auditor is a CPA firm performing an attestation engagement. It reports on management's description and the design and operation of controls. The AICPA's independence rules mean the firm cannot take on management responsibilities for you, such as deciding what controls you need or owning remediation.
An ISO 27001 auditor works for a certification body accredited under ISO/IEC 17021-1, with the additional requirements of ISO/IEC 27006-1. The certification body decides whether to certify your ISMS. It cannot provide management system consultancy to an organization it certifies.
The auditor also has a duty of professional skepticism. Being asked for a second piece of evidence, or asked the same question twice, is not distrust of you personally. It is the job.
What they can help with
Within those limits, auditors can help a great deal. Most will:
explain what a criterion or clause requires and how they intend to test it,
share their request list and sample size approach before fieldwork,
tell you what form of evidence they prefer for a given control,
tell you early when evidence will not be accepted, and why, and
explain a finding in enough detail for you to address it.
What they will not do is tell you which tool to buy, write your policy, or design your control. If you need that, use an advisor who is not your auditor.
Read the engagement terms before kickoff
The relationship starts with a contract, and the contract settles more than the fee. Read it before the first meeting, not after a disagreement.
For a SOC 2, the engagement letter sets out the scope: which trust services categories, which system, and which period. It also states management's responsibilities, which typically include giving the auditor access to information and people, and providing written representations at the end. It may say how the firm handles extra work caused by delays.
For ISO 27001, the certification agreement sets out your obligations as a certified client. Certification bodies require clients to tell them about significant changes, such as changes to scope, ownership, or the organization itself, because those can affect the certificate.
Knowing these terms in advance means fewer surprises later. A team that knows it must report a significant change will report it. A team that has never read the agreement finds out during the next audit.
What to agree at kickoff
A kickoff meeting that settles practical questions prevents most of the friction that follows. Agree these, and write the answers down.
The timeline. Dates for each request wave, for interim and final fieldwork if both apply, and for the draft report or certification decision.
Points of contact. One coordinator on your side and one on theirs. Every request and every answer goes through those two people.
How evidence is delivered. Through the firm's portal, a shared repository, or yours. Email attachments are the worst option.
How issues during the period are disclosed. When and how they want to hear about a control failure. Handling those conversations is covered in what to do when a control fails mid-period.
Status cadence. Usually a weekly call during fieldwork, with the request tracker as the agenda.
Response times on both sides. How quickly you will answer requests, and how quickly they will review submissions and raise follow-ups.
System access. Whether they need to observe systems live, and how screen shares or any direct access will work.
The escalation path. Who on each side to contact if something stalls or a disagreement cannot be settled at working level.
Habits that keep fieldwork moving
The habits that make fieldwork go well are unglamorous.
Keep commitments, including small ones. If you said the export would arrive Thursday, send it Thursday or say on Wednesday that it will not. An auditor who can rely on your dates plans around them.
Batch your questions. One message with five clarifying questions is easier to answer than five messages over a week.
Do not change scope quietly. A new system, a tool migration, a reorganization: tell the auditor as soon as you know. They affect the populations and the system description, and surprises found in a sample cost more time than changes announced early.
Make people available. Interviews and walkthroughs depend on control owners being reachable during the agreed weeks. Preparing them is covered in preparing control owners for auditor interviews.
Run the request list from one place. The mechanics are in the PBC list.
When you disagree with a finding
Disagreements happen, and most are resolved by evidence rather than argument.
Start by asking the auditor to explain the finding in terms of the criterion or clause, and the evidence they examined. Often the disagreement turns out to be about a misunderstood process, and a walkthrough or an additional record resolves it.
If you still disagree, put your position in writing, with the evidence. Be specific: which requirement, which records, why they show the control operated. Avoid arguing that a finding is unfair, or that other firms would not raise it. Neither is evidence.
If working-level discussion does not settle it, use the escalation path you agreed at kickoff. For a SOC 2 engagement, that usually means the engagement manager or partner. The opinion remains the firm's to give. For ISO 27001, certification bodies are required to have documented processes for appeals and complaints, and you can use them. The certification decision is made by people within the certification body who did not conduct the audit.
After the audit
The weeks after the report or certificate arrives are the best time to improve the next audit. Ask for a debrief, and ask specific questions.
Which evidence was hardest for them to work with, and why?
Which requests needed the most follow-ups?
Which controls are they likely to test differently next time?
Are there observations that fell short of an exception but are worth attention? Some firms share these informally, and practice varies.
Record the answers with the closed request tracker, so next year's preparation starts from them. Continuity also matters. A firm that has audited you before knows your system, and changing firms means a new team learning it from the beginning. Change when there is a reason to, not by default.
How TrustLynce helps
The auditor portal gives your auditor a room of their own, with requests, evidence and findings in one place and a record of what was asked and answered. If you need help designing controls, which your auditor cannot provide, our advisory services cover readiness and audit preparation.