Audits based on actual risks

An audit programme should give more attention to processes with significant exposure and change.

Repeating the same sample each year can overlook critical areas.

What evidence would you look for first?

A process change, repeated anomaly or new interface may call for different questions from last year. The audit programme should explain why priorities were selected. Observations, interviews and records need to be connected: finding an up-to-date document is not enough to understand how the process actually works.

To make review useful, distinguish observations from interpretations and information still to be gathered. An understandable conclusion connects criteria, evidence and the process concerned. Sampling limitations also deserve space, so the report supports informed decisions rather than offering general reassurance. Follow-up can then examine the effect of agreed actions.

For the next discussion, choose a concrete situation and ask which evidence would help explain it. Follow up the observations by making ownership of open questions visible and explaining how feedback will be provided to the people involved.