Before an audit
Clarify scope, review evidence, identify weak interfaces and prepare owners to explain how the system actually works. The goal is readiness, not rehearsed answers.
After a finding
Separate correction from root cause, understand why the issue could occur, define proportionate actions and collect evidence that the action is implemented.
Effectiveness matters
Closing an action is not the same as solving the problem. Follow-up should ask whether recurrence risk was genuinely reduced and whether the change works in practice.