Before Precept, Harrow’s compliance programme was a spreadsheet of 140 rows, a shared drive with a folder per framework, and Dana Okafor’s memory. “The spreadsheet was accurate on the day I finished it,” she says. “It was the shared drive that wasn’t.”
Baseline read the spreadsheet in the first week. Twenty-two rows turned out to be the same control written twice, once for SOC 2 and once for ISO 27001; Datum merged them, leaving 118. By week three, SOC 2 was mapped. By week nine, every control had current evidence and an owner.
- 1Week 0Spreadsheet imported. 140 rows read, 22 merged, 118 controls.
- 2Week 3SOC 2 mapped. Mapping isn’t evidence: 58 of 118 here, and climbing.
- 3Week 9First clean evidence pass. Both lines at 118.
“Clean” means every in-scope control has current evidence and a named owner. It doesn’t mean the audit is over.
Evidence expires, so the count moves: after week 9 it drifts and gets pulled back.
Fieldwork started on 13 July. The auditor’s largest request, REQ-2291, arrived at 10:40 on Tuesday 14 July: evidence of Q2 access reviews for all in-scope systems, with sign-off and remediation. Transit matched it to two controls, with the Okta export and AWS IAM report already attached. Two sign-offs were missing; their owners signed the same afternoon. One exception, a contractor account, came with its revocation ticket.
“I sent it at quarter past twelve on Thursday. Seven attachments. No follow-up questions. That’s the first time I’ve written that sentence.”