Operations · 20 min

Prep for an audit: map controls to evidence and find the gaps

Copilot Chat

Short answer: Upload or paste your list of controls and your process documents into Copilot Chat. Ask for a table matching each control to the evidence you have, what's missing, and who should provide it. Then ask it to check that each control is testable. Your auditor still decides what counts.

Last checked against Microsoft docs: Oct 21, 2026

Audit stress usually comes from not knowing what's missing until the auditor asks. A control-to-evidence map shows the gaps early, while you still have time to fix them. People who make audits boring are worth a lot to any company.

A common situation (composite)

The auditors arrive in four weeks.
We have controls on paper.
I'm not sure we can prove half of them.

What you get

Data: your control list and the process documents behind them.
Does: maps controls to evidence and flags gaps.
Output: a gap table with owners and a prep plan.
How often: before every internal or external audit.

Before you start

Needs: Microsoft 365 Copilot Chat with the documents uploaded. Not sure what you have? Start here.
Microsoft's label for this scenario: Microsoft 365 Copilot.
Where: Copilot Chat.
Access: Copilot only uses content you already have permission to open. Use only information your company allows in Copilot.

The steps

Get the control list from your risk or compliance team.
Collect the process docs, work instructions and logs that show each control running.
Upload them to Copilot Chat and run the prompt.
Confirm every gap with the control owner.
Run the follow-up to tighten vague controls.

Copy this prompt

Here's our list of controls: [paste or upload]. Here are our process documents: [upload].

Make a table: Control ID | What the control is | Evidence we have (document name and section) | What's missing | Suggested owner.

Only list evidence that's actually in the documents. If a control has no evidence, write NO EVIDENCE FOUND. Don't decide whether we pass. That's the auditor's call.

(Prompt from stuckwithcopilot.com/guides/audit-prep-checklist/)

Make it better

Run this next, in the same chat.

For each control marked NO EVIDENCE FOUND or with weak evidence, check if the control itself is clear and testable: who does it, how often, and what record it leaves. Rewrite any vague control so it's testable, and mark it DRAFT for the control owner to approve.

(Prompt from stuckwithcopilot.com/guides/audit-prep-checklist/)

Data tip: use this with your work Copilot, and leave out passwords, payment details and anything your company marks restricted.

What a good result looks like

Every piece of evidence points to a real document and section, gaps are clearly marked, and rewritten controls are labeled as drafts for the owner.

If a feature is missing

If documents are restricted, work from the control list and your own notes, and fill in evidence names by hand.

Make it smarter

Keep a short "What it got wrong" note. Paste it above the prompt next time, like "Don't invent dates".

Not sure what to ask? Copy the quick note for your Copilot admin.

Questions people ask

Prep for an audit: map controls to evidence and find the gaps?

Upload or paste your list of controls and your process documents into Copilot Chat. Ask for a table matching each control to the evidence you have, what's missing, and who should provide it. Then ask it to check that each control is testable. Your auditor still decides what counts.

What do I need for this?

Microsoft 365 Copilot Chat with the documents uploaded. If documents are restricted, work from the control list and your own notes, and fill in evidence names by hand.

Can Copilot tell me if we'll pass?

No, and the prompt tells it not to. It helps you find gaps. Your auditor and compliance team decide.

Is it OK to upload audit documents?

Use your work Copilot and follow your company's rules. Skip anything marked restricted or confidential, and leave out personal data.

What about FMEA or risk registers?

Same method: paste the register and ask for missing owners, missing mitigations and risks with no review date.

Next step

Try it once, then make it yours.

Run the prompt on one real task this week. Then pick your next workflow.

See the workflow library ↗

Cite or share this guide

Prep for an audit: map controls to evidence and find the gaps. Stuck with Copilot. https://stuckwithcopilot.com/guides/audit-prep-checklist/ Last checked Oct 21, 2026.

One Copilot idea a week

One idea a week that makes your job easier, makes you smarter, and gets your Copilot doing more for you. Something genuinely cool, not a hack. Built for people in sales, marketing and ops.

Where this comes from

Inspired by Microsoft's Copilot scenarios. See the original at Microsoft Copilot adoption (Microsoft 365 Copilot Prompt Pack for Operations). The prompts and steps here are rewritten and expanded by Stuck with Copilot. This site is not affiliated with Microsoft.

Official references

Last checked against Microsoft docs: Oct 21, 2026.