RMAP Audit Readiness: Why Evidence Consistency Matters More Than Document Volume

Many companies preparing for an RMAP audit begin by adding policies, procedures, templates and training records. Documentation is necessary, but document volume alone does not demonstrate that a due diligence program is operating effectively.

What matters more is whether different forms of evidence are consistent.

If a policy describes one process while business records show another, if a procedure assigns responsibilities that employees cannot explain, or if a risk assessment contains conclusions without supporting data and approval records, the program may still have significant gaps.

Auditors do not rely on a single document

An audit does not normally stop at reviewing written procedures. The same management fact may be tested through several forms of evidence, including:

• Whether the policy clearly establishes responsible-minerals commitments
• Whether procedures translate those commitments into practical steps
• Whether supplier and material records follow the defined process
• Whether risk conclusions are supported by reliable information
• Whether mitigation actions are tracked and verified
• Whether relevant employees understand and perform their responsibilities

These forms of evidence should support one another rather than conflict.

For example, if a procedure requires enhanced due diligence for high-risk suppliers, the company should be able to show which suppliers were identified as high risk, the basis for that decision, the actions taken, the approval process and how the effectiveness of those actions was assessed.

Common evidence inconsistencies

Typical audit-readiness gaps include:

• Policies have been updated, but operational teams still use an older process
• Supplier questionnaires have been collected, but no assessment or approval is recorded
• Supplier risk ratings have changed without a documented reason
• Training records are complete, but employees cannot explain their responsibilities
• Corrective actions are marked complete without effectiveness verification
• Management reviews report activity counts but do not address major risks or overdue actions

These gaps do not always mean that no work has been performed. More often, they show that requirements, activities, records and decisions are not connected through a traceable evidence chain.

Build an evidence matrix

An evidence matrix is a practical way to improve audit readiness.

It should be more than a document list. It should connect each requirement with the facts that demonstrate implementation. Useful fields include:

• Requirement or control objective
• Responsible department and owner
• Process and operating frequency
• Key inputs and outputs
• Supporting documents and system records
• Samples selected and testing results
• Identified gaps
• Corrective-action owner and target date

This helps distinguish between simply having a document and being able to demonstrate that a requirement is consistently implemented.

Trace forward from real business records

Audit preparation should not only start with policies and move downward. It should also start with actual supplier, material or transaction records and trace the process forward.

For each sample, consider whether:

• The supplier was properly identified and classified
• Source information was complete and kept current
• The risk assessment used the required information sources
• High-risk issues were escalated through the defined process
• Decisions received appropriate approval
• Mitigation measures were followed over time
• Supporting evidence could be located efficiently

Sample testing frequently reveals operational gaps that are difficult to identify through document review alone.

Completion is not the same as closure

Corrective-action plans often treat an updated document as evidence that an issue has been resolved. In practice, updating a document is usually only one part of the corrective action.

A complete corrective-action cycle should include:

• A clear description of the issue and its root cause
• Specific actions and target dates
• Defined owners and approvers
• Evidence of implementation
• Verification that the action was effective
• An updated risk assessment where necessary
• Escalation of significant matters to management review

An issue should normally be closed only after the effectiveness of the corrective action has been verified.

Make audit readiness part of normal management

The strongest audit preparation does not begin shortly before an audit. It embeds audit requirements into routine management.

Companies can conduct periodic sample testing, self-assessments and cross-functional reviews focused on:

• Changes involving high-risk suppliers and sources
• Missing evidence and record quality
• Overdue corrective actions and escalations
• Employee responsibilities and training effectiveness
• Issues requiring management decisions

When policies, records, employee understanding and actual practices remain aligned, audit readiness becomes a natural result of an operating due diligence system rather than a last-minute project.

Conclusion

The purpose of RMAP audit preparation is not to prove how many documents a company has. It is to demonstrate that the company can consistently identify risks, make decisions, take action and verify results.

Instead of producing large volumes of additional material before an audit, begin with several real business samples. Test the complete evidence chain, identify inconsistencies and address the gaps that genuinely affect system effectiveness.

If your company is preparing for an RMAP audit, conducting a gap assessment or developing a responsible-minerals due diligence program, contact Alex Xue through this website to discuss a practical path forward.