Having been in this sort of situation and having had it thrust upon me, my approach would have been to step back and analyze what's necessary - inventory and document what in place, etc, and to understand what's needed for the audit, then plan on how to bring stuff into compliance. Seems straightforward, but the "how" part can be a bit tricky.