# Walk into the audit with the proof and the reasons An audit asks for months of evidence and the reason behind every control. Korium holds the framework's own text, each control's evidence as it happens, and the decisions behind it, so being ready is a question you ask, not a month you lose. [Start for free](https://app.kyroco.ai/pricing.md) [See how it works](../korium-how.html) We are going through SOC 2 and HIPAA this way ourselves. The criteria are loaded in Korium, every gap is checked against what our systems actually do, and every drill is saved with the date and time it ran. What goes wrong today ### Proof you cannot go back for 16 of the 23 kinds of evidence on our own list only count from the day you start keeping them. ### Tickets drift from the truth Our September review found tickets and an earlier gap assessment that the code itself contradicted. ### Advice that is not in the criteria We were told every change needs a second approver. The actual SOC 2 criteria do not say that. ### Every review starts from zero A new consultant, a new spreadsheet, and the same questions asked again. Before the window opens ## Check every gap against the real criteria The first thing Korium asks is what the criterion actually says and what proof we already hold. Each gap gets an owner and a start date before the clock starts. WHAT STARTS IT WHAT COMES OUT A framework is chosen SOC 2, HIPAA, or both. Its own text is loaded once. A review starts "Where are we on HIPAA?" Someone claims a rule "Auditors need a second approver on every change." loads asks checks writes KORIUM The criteria and our proof The first question it asks: what does the criterion say, and what proof do we hold? First review No history yet. Korium maps each criterion to the systems it touches. Known control Korium has its history, so it returns: Criteria text Evidence Decisions Open gaps Also looked up every time · The last review, and what it found · Which tickets the systems contradict · What cannot be rebuilt later asked from ChatGPT or Claude Readiness brief What the team knows before the audit window opens CRITERIA · The exact text and its points of focus · What it does not require EVIDENCE · What we hold, with dates · What has to start now GAPS · Each with an owner · Each with a tracked issue each finding is saved as it is checked While the window runs ## Every drill and review lands with a date and a reason Proof goes into Korium the day it happens. The auditor samples a record, not a scramble, and the next review starts from this one. WHAT GOES IN WHAT COMES OUT Drills and tests An alarm fired on purpose, and who got it Access reviews Who has access, and who removed it Decisions Each control's design, with its reason Exceptions What was accepted, why, and who signed off System checks What the systems do, not what tickets say Incidents Later: what happened, and how it was handled KORIUM One record per control, over time The team, its assistants and its reviewers read the same place. Saved as it happens Dated, so an auditor can sample it Evidence Decisions Exceptions Corrections Remembers what changed When advice turns out wrong, the correction replaces it. The old note stays, marked replaced. Criteria on hand SOC 2 and HIPAA text, so answers cite the criterion itself. asked from ChatGPT or Claude files tracks explains carries Evidence by control Each criterion with its proof, dated, ready for the auditor to sample. Gap list · What is not collected yet · What cannot be rebuilt later · Who owns each one Answers for the auditor "Why does it work this way?" answered with the decision and its date. The next review's start This review's findings, so the next one checks what changed instead of starting over. saved back after every drill and review: what ran, when, what it proved Ask Korium ## The questions an audit asks | THE QUESTION YOU ASK | WHAT KORIUM ANSWERS FROM | | --- | --- | | "What does CC8.1 actually require for change approval?" | The criterion's own text and points of focus, not a summary of it. | | "Which evidence can't we rebuild if we start late?" | The gap list, marked by what can and cannot be rebuilt. | | "When did we last prove an alert reaches a person?" | The drill on record, with its date, time and result. | | "Why don't we require a second approver on every change?" | The decision, its reason, and the criterion it rests on. | | "Which vendors are due for a review?" | The vendor list, with each one's tier and last review date. | | "What did the last HIPAA review find?" | Its findings, each checked against the systems, and what changed since. | Example ## The criterion, the decision and the correction, in one answer The answer quotes the criterion, not a blog post about it, and shows when the team's own understanding changed. Your auditor still makes the call. Korium:Compliance Example Do auditors need a second person to approve every change? Change approval, SOC 2 CC8.1 Criteria text loaded October 28 · 1 decision · 1 correction What the criterion says Changes are approved before they go live, and splitting duties is considered. CC5.1 allows other controls where splitting duties is impractical. How we do it Documented other controls, plus approval records an auditor can sample. Decided September 15, after reading the criteria. Watch out The second-approver rule came from vendor guidance, not the criteria. The old note is kept, marked replaced. The criteria say what. The memory says why. 01 The real text ### Answers cite the criterion Not someone's summary of it, and not last year's spreadsheet. 02 Proof over time ### A cycle, not a policy on a shelf Auditors look for testing, review and correction, each with a date. 03 We are doing it too ### SOC 2 and HIPAA, on this loop Kyroco is working toward both with the same records this page describes. ## Stop rebuilding the audit trail the month before the audit. [Start for free](https://app.kyroco.ai/pricing.md) [See how it works](../korium-how.html)