Client security audit readiness for the UK SMB managing director

Why a client security audit is now landing on your desk

The single biggest shift in the last three years is that clientprocurement teams — not regulators — now sit on the critical path of the SMB sales pipeline. A 60-question security questionnaire with a four-week response window has become a standard pre-onboarding hurdle for any UK SMB selling into mid-market or enterprise accounts. The questions cover most of what a stand-alone auditor would ask, but the levers are different: lose marks here and the deal stalls, not your CISO gets a talking-to.

A close second is insurance. Cyber-insurance renewals have become materially harder; underwriters now require a named set of controls to be evidenced at renewal, and a poorly-evidenced renewal changes both your premium and your excess. Both of these are landing on desks that did not own security six years ago — yours, in most cases.

The good news is that this is a bounded problem. The auditors — whether the client’s procurement team, the underwriter or a third-party assessor — ask for the same four categories of evidence. If you have working evidence in those four, you can answer most of the questionnaire in an afternoon.

What “audit-ready” actually means to an auditor

The single most common mistake is to read “audit-ready” as “the policies folder”. It isn’t. An auditor does not want to know that you have a lone-worker procedure. They want to know that the procedure you have is current, the people named in it have trained to it, and the trail shows it. The folder is a starting point; the trail is the answer.

Across client security audits, insurer questionnaires and SOC2 / ISO 27001 light-assessments, the same four categories of evidence dominate:

• Policies. Current, versioned, owner-named, with a revision history that explains why each change happened.
• Incident logs. Timestamped, classified, evidence-packed, with a date-stamped severity assessment and a record of the response.
• Training and competency records. Drills, briefings, sign-offs — the things that prove your named owners have actually practised what the policy says.
• Lone-worker evidence. Welfare-tap history, missed-tap escalations, audit-response-module records. The category that catches most SMBs out who never thought they had a lone-worker problem.

If you can produce all four, with at least a year of dating under each, you answer 80% of the questionnaire and most of the verbal follow-up. The remaining 20% is sector-specific — covered by the same categories but at a stricter cadence.

Policies — current, versioned, owner-named

Auditors read a policy corpus in three layers: do the policies exist, are they dated within the last twelve months, and can you show what changed and why. Most SMBs pass the first two; almost as many fail the third. A policy that has been the same document for three years reads as either a forgotten policy or an out-of-date one — either reading costs marks.

The shape that answers the third layer is a revision log. Each policy carries a version number, a date, a named reviewer, and a one-paragraph rationale for the change. PolicyRevision is the field-level mechanism for this: every change to a tracked policy writes a new revision row with the author, the timestamp, the diff summary and the rationale. The auditor sees a story rather than a static document.

The second element an auditor will look for is a current HealthReport— a rendered artefact showing whether the policy corpus is up to date, who has read it, what is overdue, and what is flagged for review. Generating one of these from the running system takes a few minutes; producing one by hand from a shared drive takes a working day at minimum.

What you actually need to evidence is small: a policy list with named owners and review dates, a revision trail per policy, and a current health summary. Most auditors will accept this in PDF form or as a tabulated export, and the answers roll forward unchanged from one audit to the next.

Incident logs — timestamped, classified, evidence-packed

The auditor’s question on incidents is not “did incidents happen” — it is “can you show me what you did about them”. An SMB with three years of clean logs and one well-handled incident scores better than an SMB with no incidents and no record of how a near-miss was triaged. The trail is the answer.

The shape of a defensible incident record is: a timestamp (to the minute), a one-paragraph narrative of what happened, a named severity classification (low / medium / high / critical), a named owner of the response, evidence (CCTV frame, witness name, photo of the affected area, related correspondence), and a date-stamped resolution note. The auditor reads this in two minutes and ticks the box.

Where the SMB operating system really earns its keep is the classification step. Severity is the field most likely to be inconsistent across incidents handled by different people, and inconsistency is the field an auditor will probe. A working system applies its AI severity triage as the incident is captured — a consistent classification across incidents, with the rationale visible to the responder at the point of triage. The auditor sees a defended rationale, not a subjective guess.

For export, the working shape is a CSV that drops into a spreadsheet and a PDF that can be attached to the questionnaire return. Both should be producible from the incident record at the moment the auditor asks, not assembled under pressure while the deadline ticks.

Training and competency records

The training category is the one most SMBs are confident on and most SMBs are weakest on. A signed training acknowledgement is not a training record. The auditor will want to see three things: the drill (not the briefing), the debrief (not the punch-list), and a named sign-off (not an attendance list).

A drill is a rehearsed event — an evacuation, an invacuation, a lone-worker check-in, a lost-child procedure. The auditor wants the date, the scenario, the time-to-clear, the roll-call result, and the named observer. A working drill calendar is the artefact here: a year of dated, planned, executed and debriefed drills, with named owners and named deputies.

The debrief noteis the second artefact. The auditor is not looking for “drill was successful”; they are looking for “fire door propped-open in the south corridor, action assigned to J. Smith, completed 14 March”. The named action, the named owner, the date of completion. A drill without a debrief is a third of an evidence record; a drill with a debrief is the whole thing.

The third piece is the named sign-off. Every member of staff with a named role in your preparedness playbook should have a date-stamped record of having read the current version of the relevant procedure. The auditor will spot-check two or three names against the system.

The cadence that holds up under inspection: one well-evidenced drill per quarter, a debrief note within seven days of each drill, and a quarterly sign-off from each named owner.

Lone-worker evidence

The category that catches most SMBs out is lone-worker. The instinct is “we don’t have a lone-worker problem”, and then the questionnaire asks about it anyway, because a welfare check on a night cleaner, a security guard on a late shift, a delivery driver on an unaccompanied drop, or a peripatetic care worker visiting alone is a lone-worker situation whether your policy framework labels it as one or not.

The three artefacts the auditor looks for:

• Welfare-tap loops. The schedule of check-ins, the rate at which they were completed on time, the rate of acknowledged-receipt slips on the receiving end. A working lone-worker procedure has a defined tap cadence (hourly, two-hourly, on-arrival, on-departure) and a record of every check-in against it.
• Missed-tap escalations. The incidents where a check-in was missed, the time-to-escalation, the named person who picked it up, the resolution. A system that has recorded no missed taps in three years reads as either implausible (the tap cadence is too long) or unfilled. A handful of well-evidenced missed-tap escalations is the honest and defensible answer.
• ARM records.The audit-response-module records — if a missed tap escalated into an incident, who received the alert, what actions were taken, what was filed, and what the resolution log says.

This is the section that matters most for sites with peripatetic or out-of-hours workers: warehouse and logistics operations running night shifts and single-driver routes, and care homes with peripatetic carers visiting recipients alone at unsocial hours. Both operate on audit-clock expectations more often than their MDs realise.

What Lookpost can produce in an afternoon

The shape of a quarterly evidence pack from a running system is the four outputs below. None is a manual assembly; each is generated from the live audit trail and policy revision log at the moment the auditor or the client asks.

• Policy revision history export. A PDF or CSV across the full policy corpus, with version numbers, revision dates, named reviewers, and one-paragraph rationales for each change in the last twelve months.
• Incident log CSV. A date-stamped export of every incident in the period, with severity classification, named responder, evidence index, and resolution note. Auditor-friendly without reformatting.
• Drill and debrief PDF. A compiled artefact of every drill in the period, with scenario, time-to-clear, roll-call result, named observer, and the linked debrief note including named actions and completion dates.
• Lone-worker procedure PDF. A compiled artefact showing the tap cadence, the welfare-tap completion history, the missed-tap escalations and their resolutions, and the ARM record for any incident that escalated through the lone-worker pipeline.

For a care-home operator, a warehouse lead, or a school business manager, the cadence is the same — but the audit clock is different. Care homes typically face a sharper inspection cadence with named inspector expectations per visit; warehouses and logistics face the insurer-led cyber questionnaire plus an FCA-aligned SOC2 review when the supply chain includes a finance counter-party; security maturity check sit on a layer of safeguarding and Martyn’s Law expectations layered on top of the same evidence pack. The shape of the answer is the same in each case.

A four-step readiness checklist

Keep the readiness simple. Four moves, four weeks, and you are ahead of most of the UK SMB cohort sitting on the same client questionnaires this quarter.

1. 1Appointments.One named owner for each of the four categories — policies, incidents, training, lone-worker — and a named deputy for each. Written into a job description, visible on the organisational chart, dated. The named owners are the people who will answer the auditor; their deputies are the people who answer in their absence.
2. 2Baseline evidence pull.One working day, in the room with the four named owners. From the running system, generate the current revision history export, the last twelve months of incident logs, the list of named training sign-offs, and the lone-worker evidence pack. That is your current state. The gap between this and the auditor’s expectation is the work-plan.
3. 3Rehearsal and debrief. One drill, one debrief, both dated and both written up within seven days. The drill is the artefact that turns the policy corpus from a folder into a working system. The debrief is the artefact that turns the drill into evidence.
4. 4Quarterly evidence pack.One dated pack, generated end-of-quarter, with the four exports above and a quarter-review note from each named owner. This is the artefact you hand the client’s procurement team, the insurance broker, the sector regulator and the in-house board — the same artefact, four times a year, with version history that links quarter to quarter.

A working system makes this a four-move checklist, not a four-quarter project.