Process Compliance Audit: How to Tell If Your Improvement Is Still Holding Six Months On

The Process Compliance Audit tool audits compliance of the process against SOPs, the control plan, and standards to ensure sustained conformance. That is the whole job. You take the documents the project handed over with, you sample the live work, and you record whether the work matches what the documents say.

It belongs in the Sustain phase of RDMAICS because that is where improvements quietly die. Nobody announces the decay. A step gets skipped during a busy week. A new starter learns the old way from the person beside them. A system change makes one control awkward, so people work around it. Six months later the gain is gone and nobody can say when it went.

Use the tool on a schedule rather than on suspicion. Monthly or quarterly works for most processes. Run it the same way each time so the numbers compare. The value is not in any single audit. The value is in the line the audits draw across time, which is the only thing that shows you drift before a customer does.

Use it also after any change to the process, the system or the team. Those three events cause most of the slippage you will ever find.

This article is built on one case, and that case is fictional. It is the sample data that loads with the tool, so you can open the tool and follow along line by line.

The process is accounts payable invoice handling. An improvement project finished some months earlier and handed over five written procedures, each covering one control point in the flow. The auditor has taken twenty transactions for each control and checked them against the relevant SOP.

The five audit items are scanning resolution at or above 200 DPI against SOP-AP-01, OCR quality assurance verification against SOP-AP-02, the three-way match against SOP-AP-03, approval delegation against SOP-AP-04, and payment reconciliation against SOP-AP-05. Five items, twenty samples each, one hundred observations in total.

That shape is deliberate. The audit covers the start of the process, the middle and the end. If drift is happening, it tends to appear at the points where a person has to do something extra, not at the points the system does on its own.

The table asks for seven columns. Audit item, standard, sample, compliant, score, finding and action. Four of those are marked as required: the audit item, the compliant count, the score and the finding. The standard and the action are optional in the form but you should fill them anyway, because an audit without a reference document is an opinion.

In this case each row names the SOP it tests. Scanning DPI points at SOP-AP-01. OCR QA verified points at SOP-AP-02. The three-way match points at SOP-AP-03. Approval delegation points at SOP-AP-04. Payment reconciliation points at SOP-AP-05. Anyone challenging a finding can go and read the clause.

Sample size is twenty for every row. Keeping it equal makes the arithmetic honest, because every item then carries the same weight in the overall rate. If you vary sample sizes across rows, the headline percentage starts to mean something different and you need to say so.

The finding column is where the audit earns its keep. Three rows say Conforming. One says 1 missed. One says 2 manual. Those are observations, not judgements. Write what you saw. The action column then carries what you intend to do: Coach operator for the OCR gap, Update matrix for the delegation gap, and None for the three clean items.

The tool calculates five figures. Items audited is 5. Compliant samples is 97 of 100. Compliance rate is 97 per cent. Items fully compliant is 3 of 5. Items with an action is 2.

Read those in pairs. The compliance rate of 97 per cent is the number a steering group will want. It sounds reassuring. The second pair is the number that actually tells you something: only 3 of 5 items are fully compliant. Put differently, two of your five controls have a hole in them. A high overall rate can hide that, because a single clean item at 100 per cent cancels out a weaker one in the average.

The tool then lists the items below 100 per cent. Approval delegation sits at 90 per cent with a finding of 2 manual and an action to update the matrix. OCR QA verified sits at 95 per cent with a finding of 1 missed and an action to coach the operator. Scanning DPI, the three-way match and payment reconciliation all sit at 100 per cent with no action.

Each item also gets its own card showing the compliant count, the standard, the sample, the finding and the action. The tool offers an AI review that explains the result if you want a written reading of the pattern.

Two signals matter more than the headline rate. The first is the count of items with an action. Here it is 2. If that count rises audit on audit, the process is loosening even while the percentage looks stable, because new items are starting to fail while old ones recover.

The second is the nature of the finding. The OCR item shows 1 missed. That reads like a single lapse by one person on one day. The delegation item shows 2 manual. That reads differently. Two transactions went around the system rather than through it. One lapse is an individual. Two workarounds in twenty is a pattern starting, and the chosen action reflects that: update the matrix rather than coach anyone.

Watch which end of the process the gaps appear at. Both gaps here sit in the steps that depend on a person doing something correctly. Scanning, matching and reconciliation, the three automated or system enforced steps, are clean at 100 per cent. That is the usual shape of drift. Controls that rely on behaviour decay first.

An audit with no decision attached is paperwork. This one supports three.

First, a coaching decision. One missed OCR verification in twenty leads to a conversation with the operator, not a process change. You do not rewrite an SOP because one person had one bad hour.

Second, a document decision. Two manual approvals in twenty suggests the delegation matrix no longer matches who actually holds authority. The action is to update the matrix, which means the standard changes rather than the behaviour.

Third, a scope decision for the next audit. Three items are clean across twenty samples each. You may choose to keep them in at the same sample size for continuity, or to carry them forward with a lighter check and put the saved effort into the two items that moved. Either choice is defensible. Record which you took, because it changes how the next percentage should be read.

The first mistake is auditing against memory instead of a document. If the standard column is empty, the audit cannot be repeated by anyone else and the finding is arguable. Every row here names an SOP for that reason.

The second is reporting the headline rate alone. Ninety seven per cent on its own invites a nod and a move to the next agenda item. Report it together with 3 of 5 items fully compliant and 2 items with an action. Those three numbers together describe the real position.

The third is changing the item wording between audits. If scanning DPI at or above 200 becomes image quality check next quarter, you have lost the comparison. Keep the wording frozen.

The fourth is recording a cause in the finding column. Write 2 manual, which is what you observed. Do not write staff ignoring the matrix, which is a conclusion you have not yet tested. The finding is evidence. The cause comes later.

The fifth is sampling the easy transactions. If you pull twenty invoices that all came from the same supplier on the same day, your twenty is really closer to one. Spread the sample across days, people and volumes.

This tool measures conformance. It does not measure performance. Every one of these five items could sit at 100 per cent while invoice cycle time gets worse, because the SOP itself may be the thing that is wrong. Compliance confirms that people are following the agreed method. It says nothing about whether the agreed method is still the right one.

It does not calculate confidence. Twenty samples per item is a practical number, not a statistically derived one. A 90 per cent score from twenty samples carries a wide margin. Treat the two manual approvals as a signal worth investigating, not as proof that exactly ten per cent of all approvals are non compliant.

It does not find causes. The finding column records what you observed and the action column records what you decided. Neither explains why. If the delegation gap repeats after the matrix is updated, you need an analysis tool, not another audit.

It does not trend by itself. The tool calculates one audit at a time. The comparison across months is work you do, by keeping the items, the standards and the sample sizes stable and by filing each result. Without that discipline, 97 per cent is a single dot with nothing to compare it to.

Finally, it does not act. Two actions are recorded here. Coach operator and update matrix. Whether either happens is a matter of follow through, and the next audit is the only place that will show.