I agree that the best way to "prepare" is to always operate in compliance with internal policies and procedures which should already be compliant with any external regulators. Most regulators initially approve a school based on their documented policies and procedures. If those are actively in force, an audit should not require a last minute scramble to have things in order. However, I often see schools doing that last minute fire drill to obtain and organize items including documents for student files, proof of credentials for faculty files, etc. In addition to diligent monitoring, solid management control mechanisms which either prevent or reduce risk and/or trigger notifications of any compliance breach or exposure can also ensure that things are in place without having to do a lot of additional preparation.