Fieldwork is a request list, and the requests are far more predictable than a first-time team expects. This checklist is that list, grouped by domain.
The test
One question per row: if an auditor asked for this today, could you produce it within an hour?
Anything that fails is your work list, and it is dramatically cheaper to fix in the weeks before fieldwork than during it.
What is covered
Governance: policy, risk assessment, management review
Access control: populations, reviews, joiners and leavers
Change management: approvals, and the rejected change they will ask for
Operations: logging, scanning, and an actual backup restore
Incident response: including the population when there were none
Vendors, people, endpoints
Two patterns worth knowing before you start
Populations come before samples. For anything marked "complete population", the auditor chooses which items to test. Evidence has to exist for every item, not the ones you would have picked.
They will ask for the negative case. A rejected change, an incident where escalation was used, a vendor that failed review. A process with no exceptions in twelve months invites the question of whether it runs at all.