We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" or base document for different aspects of compliance as they would be defined by common audits such as ISO 27002 or SAS 70. Anyone who has experienced compliance document hell and come out alive... please tell me where you found some help.
You can get some good templates from SANS
There are a number of software packages that can help automate this process and generate reports. nCircle and IBM are two big players in the compliance management software arena.