What is Audit (security / compliance)?
A security or compliance audit is an independent review by a licensed third party (usually a CPA firm) that verifies your stated security controls actually exist and operate effectively - required for SOC 2, HIPAA reciprocity, PCI DSS Levels 1-3, and increasingly by enterprise customers and reviewers.
Different audit types serve different purposes: SOC 2 (Trust Service Criteria), SOC 3 (public-facing version of SOC 2), HIPAA Risk Assessment (annual self-assessment, not a formal audit), PCI DSS ROC (formal audit by a Qualified Security Assessor), HITRUST (HIPAA-specific certification), and FedRAMP (federal cloud authorization).
Audit firms typically engage in three phases: scoping, fieldwork (testing controls), and reporting. Engagements run from a few weeks (small SAQ-A validation) to 6-12 months (SOC 2 Type II first run).
The single biggest cost driver is the absence of documentation when the audit starts - auditors bill hourly while you scramble to write policies. Going in with a complete WISP, Risk Assessment, and evidence folder reduces audit cost 40-60%.
Why it matters for Florida small business
Most Florida small businesses don't realize how much an audit costs until the firm sends the engagement letter - having documentation in place beforehand cuts the bill in half.
What to do
Before engaging an audit firm, get your documentation foundation in place: WISP, HIPAA Starter Kit (if applicable), and the security documentation Binder.