South East Training - Business Process Auditing Toolkit
The Business Process Auditing Toolkit is owned by South East Training.
You may use this resource for free on the condition that you include this statement on each page.
Click here for details of South East Training's
Click to download the Business Process Auditing Toolkit
Establish the Purpose and Scope
Which business processes you choose to audit can depend on numerous factors. The most common reason for selecting a process to audit is concern over its capability to deliver the process objectives. An increase in customer complaints or a failure to meet targets for quality or productivity might suggest the need for a systematic investigation. However, there may be other drivers, such as impending change in legislation or the availability of new technology, that give rise to questions about future process capability. In all cases, however, the principal purpose of Business Process Auditing is to assess the economy, efficiency and effectiveness of the process against pre-defined criteria.
With regard to scope, we, at South East Training, suggest that organisations audit processes 'end-to-end'. The most common causes of failure are interfaces between functions, sections or departments. It is only by examining the process from its initiation, for example by receipt of a customer request, through to completion that the audit team can gain a true picture of the health of the process.
Establish the Audit Criteria
Business Process Auditing is a comparative exercise. In all cases the business process auditor is comparing evidence of process performance against a set of pre-defined criteria. Selection of the audit criteria depends on the purpose of the audit. These criteria might include business strategy, corporate policy, business plans, departmental targets, past performance, current performance in other parts of the business or customer expectations.
Nominate the Audit Team
The size and composition of the team depends on the scale and complexity of the processes to be audited, and the amount of time available to the team. From time to time it may be necessary to include within the team auditors with specific technical expertise, such as IT, finance or health and safety specialists.
Obtain Information Required for Planning
In order to develop an audit programme, the auditors need an understanding of the processes to be audited. For organisations that operate management systems conforming to the International Quality Management System Standard ISO 9001, or similar, this might simply mean obtaining a copy of the quality manual and relevant operating procedures. However, many organisations have not documented their processes to the level required by such standards. This, then, requires the lead auditor to conduct some preliminary investigations to ascertain the sequence of activities within the process to be investigated. One option for the auditor is to conduct a business process mapping exercise. The resulting process map provides a template for production of the audit programme and the audit checklists.
Other documents the auditor might request at this stage are previous audit reports, customer complaints and performance statistics.
Establish the Audit Trail and Sample
In constructing the audit programme, the lead auditor needs to consider the most appropriate sequence for the investigation. One option is to follow the end-to-end process from start to finish, selecting samples on the way. Another is to select a process output, say a fulfilled order or completed project by way of a sample, and trace the process back to its origins. These are referred to as downstream and upstream approaches.
Develop the Audit Programme
The audit programme is a timetable stating which functions, sections or departments will be visited and when. The audit programme includes a statement of the audit purpose and scope and the names of the auditors. An example of an audit programme is shown on the Audit Programme page.
Inform the Auditee and Confirm Dates
Business Process Auditing is intended to be a part of a planned business process improvement activity. It is not a witch-hunt or policing activity aimed at catching people out. With this in mind, there is never an argument for the 'surprise' audit. Business Process Auditing is a collaborative activity involving the auditors and the auditees equally. For this reason, the auditee management is always consulted on the best time to conduct the onsite phase of the audit. It is usual to confirm the dates of the audit at least two weeks prior to the visit.
Brief the Audit Team
It is likely that, up to this stage, the planning has been solely in the hands of the lead auditor. If the audit team is composed of more than just the lead auditor, there is the need for a briefing session. This should cover the purpose and scope of the audit and a sharing of all the information collected in preparation of the audit programme.
Audit checklists act as aide memoires for the auditors. They help the auditors maintain the pace and depth of the audit, ensuring nothing is forgotten and the full scope is covered. Having individual audit team members prepare checklists for their own part of the audit is a good way to help them become familiar with the processes or parts of processes they will be investigating. At South East Training we recommend that you do not use pre-defined checklist prepared for previous audits. Your checklists should be unique to your audit. Further information about audit checklists is included on the Audit Checklist page.
Prepare for the Opening Meeting
The opening meeting marks the start of the investigation phase of the business process audit. It is held on site, with the local management, and is chaired by the lead auditor. The audit team should have copies of the following documents available at the meeting:
- The meeting agenda
- The audit programme
- An attendance list
Further information about the conduct of the opening meeting is provided on the Opening Meeting page.
Go back to the Home page.