Audits are a risk instrument. Most organisations use them as a search party.

The category error

An audit is part of a risk management strategy, and behaves badly when treated as anything else. Risk management looks forward. Most audit programmes look backward, and then wonder why they keep confirming what everyone already knew.

Some organisations plan well and execute poorly. Others plan poorly and are rescued by the quality of individual auditors. Both mean the programme is not integrated with how the business actually runs.

Five assumptions worth retiring

1. That audits catch problems. They identify; they do not correct. An audit programme relied upon as a safety net produces false comfort and additional work in equal measure. A proactive team will out-detect any schedule.
2. That a certification audit means the system is sound. A certification audit samples part of the organisation, conducted by people who do not know the work as your teams do. If a process is wrong in a way nobody has ever questioned internally, an external assessor is not well placed to discover it.
3. That findings are bad news. Findings are the return on the investment. For internal reviews, more is better. The mistake is not generating them — it is ignoring them. And the issue is almost always the way the work is arranged, not the person doing it.
4. That the plan is adequate because it is complete. Complete is not the same as risk-based. Weight the programme toward what matters most to the client experience and toward wherever issues have already clustered. If an area is both, that is where the attention belongs.
5. That overdue actions are a scheduling problem. They are a credibility problem. Closing them out hurriedly before the next review is worse than leaving them open, because it teaches everyone what the programme is actually for.

Rename it

Changing audit to improvement review is a small change with a disproportionate effect on participation. Where it has been implemented, the shift shows up in an unmistakable form — people begin asking when the next one is due, because they have something they want to raise.

The word audit tells people something is being done to them. Review invites them into it. Note that this concerns your internal language only: certification audits conducted by your certification body keep their name, as does the clause wording in the standard.

Designing the programme

• Assess every department and process against a single question: how critical is this to the client experience?
• Order by that answer, then set frequency and duration accordingly.
• Make the session dual-participation. Both parties should be open about struggles and ideas, and no idea should be off the table.
• Score the responses so that results can be charted, compared across sites and departments, and tracked over time.

A programme built this way stops being an obligation the organisation absorbs, and becomes the mechanism by which it finds out what it does not know.