Guide · Automation audit
What gets audited before anything is built.
A checklist for owners and operations leaders: what a good automation audit looks at, the evidence each finding needs, and what you should have in hand before anyone builds anything.
Where an example comes from our flagship engagement, a five-center behavioral health network, it is labelled observed. Everything else is our method, not a measured result.
Why audit before you build.
Automation copies whatever process it is given. If the process has a gap, the gap now runs faster and nobody is looking at it.
Build first
- Automates the process as described, including the broken parts
- Finds the real problem after the money is spent
- Adds a tool the team works around
Audit first
- Maps the process as it actually runs
- Fixes the cause, sometimes without building anything
- Builds only what the evidence supports
Observed at the network: the most important fix was a column nobody had added, a record number on the attendance log.
The eight areas, and what to ask in each.
Use it to plan an audit, or to check one someone else is proposing.
How the work really runs
Who does each step, how often, and from which source? What does a real week look like, not the documented one?
EvidenceSit with the person doing it and walk one completed week.Observed at the networkOne operations lead carried attendance into the billing census by hand, more than a day a week (as described by the client).Every system and source
Which systems hold the data, and how can each be read: an API, exports, spreadsheets or paper?
EvidenceA list of sources, each with an owner and how it is accessed.Observed at the networkFour separate EMR instances, each site's own attendance spreadsheet, and a billing workbook.The handoffs
Where is information retyped, exported or emailed from one system to another, and by whom?
EvidenceEach handoff, with who does it and when.Observed at the networkAttendance copied into the billing workbook by hand every week.Identity and matching
Can the same customer, patient or order be matched across systems by a shared number, not a name?
EvidenceA sample reconciliation across two systems.Observed at the networkThe attendance logs carried no record number, only names.Reporting and trust
Which numbers does leadership use, how old are they when they arrive, and do teams agree on them?
EvidenceSource timestamps, and who rebuilds which report.Observed at the networkLeadership questions waited on the census being rebuilt by hand.Exceptions and corrections
What goes wrong, who notices, how is it fixed, and does the fix stick next week?
EvidenceRecent corrections and where each one came from.Observed at the networkSeven people met on Monday and Tuesday to find discrepancies out loud (as described by the client).Data handling and agreements
What sensitive data is involved, which agreements are in place, and who can access what?
EvidenceThe data types, the signed agreements and the access list. In healthcare, a BAA and, where 42 CFR Part 2 applies, a QSOA.Ownership
Who owns each process, who approves a rule change, and who covers when that person is out?
EvidenceA named owner for every process the audit touches.
What counts as evidence.
A finding without evidence is an opinion. These are the kinds of evidence each common finding needs, and what does not count.
| The finding | Evidence that supports it | Not evidence |
|---|---|---|
| It takes too long | A time log, or a walkthrough of one real week | A guess in a meeting |
| Records do not match | A sample reconciliation across two systems | "It feels off" |
| Reports are stale | Source timestamps on the report people use | One complaint |
| It will save money | A measurement over a full cycle after go-live | A vendor's estimate |
Then decide what is worth building.
An audit finds plenty. Each finding is ranked on four things, and some are left alone on purpose.
The first build is the one with the strongest case and nothing it is waiting on. See the priority matrix.
What you should have at the end.
- The findingsEach with its evidence and business effect
- A build scopePrioritized, with what it depends on
- The assumptionsWhat the scope rests on, written down
- An operating procedureYour team can run it without the auditor
- Named ownersOne for every recommended action
If nothing is worth building, the audit should say so.
What an audit should not do.
- Recommend software first. A tool chosen before the process is mapped.
- Promise savings up front. Savings are measured after go-live, not before.
- Skip the people doing the work. The documented process is rarely the real one.
- Hand over slides with no evidence. Every finding should point to what supports it.
- Start building during the audit. Building comes after the scope is agreed.
- Ask for sensitive data before agreements. In healthcare, the BAA comes first.
Questions to ask an auditor.
- Will you sit with the people who do the work, not just the managers?
- What evidence will each finding come with?
- Is the price fixed before you start, and credited toward any build?
- What will we have if you recommend building nothing?
- Who owns the procedure and the documentation afterwards?
- What data do you need, and what agreements come first?
What owners ask about audits.
How long does an automation audit take?
Ours usually take two to three weeks, working on your real files rather than a demo. The length depends on how many systems, sites and processes are in scope.
What does it cost?
We quote it flat after a free 20-minute call, and the audit is credited toward any build that follows. We do not publish prices, because scope varies by business.
Do we have to share sensitive data?
Not before agreements are signed. In healthcare that means a BAA, plus a qualified service organization agreement where 42 CFR Part 2 applies. Much of an audit can start from walkthroughs and samples your team chooses.
Will the audit always recommend automation?
No. Sometimes the fix is a better process, a missing field, or two systems finally talking to each other. If nothing is worth building, the audit should say so.
Is this the same as an internal or financial audit?
No. An automation audit looks at how operational work moves between people and systems. It is not a financial, compliance or controls audit, and it does not replace your accountant or compliance reviewer.
Want this run on your business?
Bring one process to a free 20-minute call. We will tell you which of the eight areas we would look at first.