# Supporting audit and compliance requirements > Source: https://lscs.io/learn/grc/supporting-audit-and-compliance-requirements/ > How to prepare for and support a security audit — evidence collection, control testing, managing findings, and building a repeatable audit process. Audit support is one of the most reliable ways into a GRC career, because the work is well defined and the need is constant. It is also where the quality of everything else in the function becomes visible: if controls are documented and evidence is routine, an audit is administrative. If not, it is a crisis. Video: https://www.youtube.com/watch?v=jlX2I9yH2SE ## What this session covers - Know which framework you are being audited against and what evidence each requirement expects. - Collect evidence continuously rather than in a scramble. Evidence produced only at audit time proves very little. - Understand the difference between design effectiveness (is the control sensibly built?) and operating effectiveness (has it actually run?). - Manage findings like risks — owner, remediation plan, date — rather than as a separate to-do list. - Track recurring findings. The same finding twice is a process problem, not a control problem. The most useful mindset shift is to stop treating the audit as an event. Organisations that assemble evidence once a year spend enormous effort and still struggle; organisations where evidence is a by-product of normal operations find audits largely uneventful. Getting to the second state is a GRC project in its own right, and a very good one to be able to describe in an interview. ## Go further with mentorship This session is part of our free twelve-week GRC series. If you want structured, mentor-led support to turn this into a job-ready skill set, the LSCS GRC Mentorship programme runs over six months with live sessions, real case studies and interview preparation. [See the GRC Mentorship programme](https://lscs.io/grc-mentorship-course-details/)