01 · Clarify the assurance question
Clarify the assurance question
An audit compares objective evidence with agreed criteria to determine whether a process or system meets its requirements. In Control, an internal process audit can check whether the improved method is implemented, whether records are reliable and whether the controls remain effective. A product check asks whether an output meets requirements. A system audit asks whether the wider management arrangements support reliable operation. Choose the audit scope from the assurance question rather than using the same checklist for every purpose.
An audit is not a hunt for people to blame. Focus on evidence, requirements and the conditions that enable or prevent conformity. If a release check is skipped, examine workload, equipment, training, instructions, permissions and supervision as relevant. Individuals may need support or accountable follow-up, but an audit finding should state the requirement and observed gap without speculating about motives.
Audits complement operating measures. A chart may show good outcomes while an essential control has quietly been bypassed. Conversely, documented conformity may coexist with poor customer results when the standard itself is inadequate. Audit both implementation and, where in scope, the effectiveness of the process controls.
02 · Plan criteria, evidence and sampling
Plan criteria, evidence and sampling
Define scope, period, criteria and the evidence needed before fieldwork. Criteria can include approved instructions, internal policies, customer commitments and applicable requirements. Use the actual current documents rather than an auditor’s personal preference. Ensure the auditor has suitable competence and enough independence to evaluate evidence objectively. Internal auditing can be independent of the activity without requiring someone unfamiliar with the process.
Choose a sample covering relevant conditions: shifts, carrier services, exceptions, overrides and recent changes. A random sample can support certain statistical inferences when the sampling frame and method are sound. A risk-based judgement sample is useful for investigating vulnerable areas but does not automatically estimate the population failure rate. Document how records were selected and what the sample can support.
Plan to observe work, inspect records and ask operators to explain decisions. No single method is sufficient for every question. A procedure proves the prescribed method; observation shows current practice; event logs show recorded execution over time. Reconcile contradictions. Do not assume a signature, a completed checklist or an electronic event necessarily means the underlying check occurred correctly.
03 · Worked example: release-control audit
Worked example: release-control audit
Fictional Northbank audits its new carrier-service release process six weeks after handover. The criteria require an identity scan, an authorised service match, a verified reprint route and a recorded supervisor override when an exception is released. The auditor reviews 40 selected dispatch records spanning two shifts, observes ten releases and follows five reprint cases backward from the loading record. The sample is deliberately risk-based and is not advertised as a statistical estimate of all dispatches.
Three of the five reprint cases lack the required superseded-label cancellation record. The auditor checks whether the event is absent or merely stored elsewhere. The systems specialist confirms that the cancellation screen does not save a reason when connectivity drops. Operators describe the same condition, and a controlled demonstration reproduces it. The finding therefore identifies a gap in the defined reprint control, supported by records and observed system behaviour.
The report states the instruction requirement, the affected case identifiers, the missing evidence and the verified failure condition. It does not say that the late shift is careless. Immediate action protects any still-active duplicate labels; corrective action addresses the system behaviour and fallback method. The audit has connected evidence with a specific requirement and a useful response.
04 · Write findings that can be acted on
Write findings that can be acted on
A finding should make three things clear: the criterion, the objective evidence and the gap. Separate confirmed nonconformity from an observation or improvement opportunity. Avoid exaggerated language such as “the process never works” when the evidence concerns a limited sample. Include sufficient context for the owner to investigate without exposing unnecessary personal data.
Distinguish correction from corrective action. Correction addresses the immediate problem, such as cancelling an active duplicate label. Corrective action addresses its cause, such as making the cancellation record durable during a connection failure. An email reminding everyone to be careful may be useful communication but does not necessarily remove the cause. Require a reasoned response based on the evidence.
Agree priority using consequence, exposure and control weakness rather than the ease of closing the finding. Northbank treats an unresolved duplicate-label route as more consequential than an outdated noncritical formatting instruction. Avoid combining unrelated issues into one finding merely to reduce the count. Owners should be able to understand and address the distinct gaps.
05 · Verify effectiveness and recognise limits
Verify effectiveness and recognise limits
Follow-up checks whether the action was implemented and whether it addressed the identified cause. For Northbank, installation of a software patch is implementation evidence. A controlled connection-loss test showing retained cancellation records, plus review of subsequent reprint cases, provides effectiveness evidence. The sample should include the failure condition rather than only ordinary successful releases.
Sampling leaves uncertainty. Finding no failures in a small sample does not prove there are none in the population. If an audit randomly checks 30 independent cases and observes no failures, a rough rule-of-three upper bound is about 3/30, or 10%, at approximately 95% confidence under the appropriate assumptions. This illustrative bound does not apply automatically to a judgement sample or dependent records. It shows why “zero found” and “zero exists” are different statements.
Increase coverage or use full-population event analysis when consequences and evidence justify it, while validating the data itself. Full-population logs can still miss unrecorded bypasses. Observation and system testing remain important. Report the scope and limitations alongside the conclusion so decision-makers understand what assurance was actually obtained.
06 · Build an audit programme that learns
Build an audit programme that learns
Schedule audits according to process risk, recent changes, prior findings and operating evidence. Newly introduced controls may deserve early follow-up; stable low-risk areas may need less frequent review. Avoid auditing every process at the same interval simply because a calendar template does so. Coordinate audits with other reviews to reduce duplicate requests and interruption.
Use themes across findings to identify system weaknesses. Repeated obsolete instructions may indicate ineffective release control. Missing exception records across several areas may indicate poorly designed interfaces. The individual findings still need closure, but a wider response can prevent recurrence elsewhere. Verify that a change transferred to another process fits its actual conditions.
Common errors include checklist-only auditing, undocumented sample selection, reporting opinions as facts, accepting action promises as closure and treating conformity as proof of capability. Mature auditing preserves evidence, respectful inquiry and a clear chain from requirement to finding to verified response. Its purpose is dependable operation and learning, not a count of mistakes collected.
07 · Handle conflicting evidence
Handle conflicting evidence
If an operator reports that every override is authorised but the record shows no approver, investigate both possibilities. The authorisation may occur through an approved route that the event log does not capture, or the required decision may genuinely be missing. Ask for the relevant evidence and trace a specific case. Do not resolve the conflict by automatically trusting either the person or the software. In Northbank, this approach distinguishes an interface recording defect from an unauthorised release. Both can be significant, but they require different corrective actions. State uncertainty explicitly until the evidence supports a finding.
Connections
Related methods and phase use
Placed under Control because of the outcome it supports. Use the method in other phases when its purpose and assumptions fit the work; the phase list is a guide to selection, not a compulsory sequence.
Sources
Professional foundations and further reading
The explanation and fictional teaching examples are written for LeanTrainingLab. Linked primary sources provide professional foundations; example values and local conventions are stated in the guide. The accepted toolset draws on Six Sigma+Lean Toolset, second edition (Lunau, editor; Springer, 2013). No book text or examples are reproduced here.