Why Live Audits?
Vishant Pai
CISA | CISM | Passionate about Risk management, Security, Continuity, Privacy & AI Compliance | Guiding Organisations Through Industry Frameworks & Regulations
Live audits are performed when the process owner or an operator performs his jobs while the auditor observes and verifies process and asks activity related questions while the live job/activity is performed. This must practically happen at the process owner’s work place and work environment.
To reduce the audit delays Process and procedure documents can be requested well before in advance before the audit is conducted.
How should we conduct a live audit?
1. Observe how process owner perform his job, stop him/her and ask “Why” is the particular activity is performed.
2. Secondly ask “why” is the activity performed in a particular sequence. Match the activities and sequence in the process documents. If it matches then not only it helps you to gauge that training is provided to process owner or job owner but also implies that the actors involved follow the process.
It is always advisable to question at least two process/job owner to determine uniformity in understanding of process and procedures. If, there is a difference in understanding an observation can be recorded under lack of training and probably to non-availability of documents.
By asking these two important “why’s” you achieve a lot more and are able to conduct valuable live audits.
It is also suggested to prepare audit reports after the audit is over since the audit is conducted in the midst of a live transaction and auditors must not be the reason to delay the transaction. Having said that it makes sense to perform such audits during a lunch-break or possibly a low volume period.
Live audits in a live environment has far greater advantage than auditing in a meeting room and imagining how process works. Seeing the process and procedures performed by the process owners in live environment is definitely worth a try since a lot more can be accomplished.
Other thing to consider is that an auditor can also unlock the value hidden in these processes by suggesting waste activities and illogical sequencing identified during audits.
Cyber Security Professional
9 年Nice read
Manager Accreditation | Associate Director ISACA GWDC
9 年Yes Vishant, what you have posted is a type of audit methodology called "process walk through", as has been rightly said by Mr. Murthy. It is correct that these audit walk throughs are more objective and authentic but may not be possible in all types of scenarios and circumstances. Having said that, I agree with you that observation of "live" process execution, opens doors for more value adds from auditors.
Veteran in Internal Audit services (Ashok Leyland 38 years and Waycool Foods & Products 2 years)
9 年Dear Vishant, what you wrote is otherwise called as "process walk through". In manufacturing Industry oriented audits, as you said such process walk through really brings out very good observation for process simplification, process correction, cost reduction etc. Similary such exercise is conducted when we migrate to new system or new environment. This is really a valuable exercise all auditors should master such skill to be more effective. as you rightly said, before doing that one must understand the activity / the objective of the process before start reviewing / commenting.