How do I audit incident response without a real incident?

Three sources beyond a real incident:

1. Tabletop exercise reports. The organization should run at least one tabletop exercise per year, ideally with cybersecurity scenarios (ransomware, data exposure, account takeover). Audit the exercise documentation, the participants, the gaps identified, and the follow-up actions.
2. Detection-to-resolution trace on smaller incidents. Even without a major incident there are typically smaller events: a phishing report from an employee, an alert from the SIEM that turned out to be a false positive after investigation, an outage that triggered the response process. Pick a sample and trace each event from detection through closure.
3. Process design walk-through. Confirm the response plan defines roles, communication paths, escalation, breach notification timelines, and a post-incident review. Confirm trained alternates for each role.

Common findings even when there has been no major incident: the plan was last updated more than 18 months ago, the tabletop exercise had no follow-up actions tracked, alternates were named but never trained, breach notification timelines do not match regulatory requirements for the organization's data.

The biggest mistake is to issue a clean opinion because nothing has gone wrong. Absence of incidents is not evidence of capability.