Policies in one place, spreadsheets in another, approvals lost in email. Every time I think about the audit I panic about pulling it all together. How do people keep this straight?
The requirement behind your panic is clause 7.5, control of documented information. It doesn’t demand a fancy system; it demands that each document has an owner, a version, an approval, and a date, and that you can produce the current approved version on request.
The shift that fixes the scramble is to stop treating documents as files you hunt for and start treating a single register as the source of truth, where each policy, risk, and record carries its own version and approval state. Then “get audit-ready” isn’t a pre-audit project; the current, approved version is always the one on record.
If you’re starting from scattered drives, don’t try to boil the ocean. Bring the audit-relevant documents (policies, the risk assessment, the SoA, records of incidents and reviews) under that discipline first; the long tail can follow.