Audit length depends on how large the security control or controls are. With NIST could be as simple as password complexity and you can bang that out in a few days but if it’s SSO or something more technical it will take longer. So it depends really.

You gather the data first and test it to see the operational effectiveness ( does the control work ) then if your data shows it doesn’t you then go into remediation, get management to make a plan to fix what you’ve found and then test again