An idea that I have been kicking around for a few years is why organizations don’t maintain a list of audit questions they have been asked in an Auditor Question Log?  Such a log contains the questions, responses and the organization’s supporting policies or documentation.