Clarify the starting question
Define the decisions the audit should inform: assessing access controls, reviewing continuity or examining governance. An explicit scope avoids collecting too much information and producing unfocused conclusions.
Gather useful documents
The IT organisation chart, application map, policies, procedures, inventories and continuity plans are a starting point. Supplement them with evidence of implementation: access reviews, tickets, meeting notes and test results.
Identify the right stakeholders
Involve the people responsible for the activities being reviewed and plan for their availability. Discussions should establish how things actually work, beyond written procedures.
Prepare for what follows the audit
Plan a presentation that distinguishes findings, risks and recommendations. Assign an owner and a realistic deadline to each agreed action.