Preparing Your Network for a Compliance Audit: Before, During and After
Preparing Your Network for a Compliance Audit: Before, During and After
Most of the value in a compliance audit is decided before an auditor visits a single site. The programmes that change behaviour are the ones where the scope was tight, the sites knew the programme existed, and someone had already agreed what would happen when a failure was found. The programmes that produce a report nobody acts on usually skipped one of those three.
This article sets out what happens at each stage, what your side of the work involves, and the decisions that are much cheaper to make early than late.
Before: what needs to be settled first
Six things. None of them take long, and each one prevents a specific and predictable problem.
Decide what a failure actually means
A checkpoint that reads “staff followed the correct process” will be scored inconsistently by any two auditors, because it asks them to interpret. A checkpoint that names the observable behaviour can be scored the same way every time. This is the single highest-leverage decision in the whole programme, and it is covered in more depth in our guide to designing an evaluation questionnaire.
A useful test: read each checkpoint and ask whether you could imagine a site disputing the finding. If you can, the wording is not finished.
Separate the critical from the desirable
Not every checkpoint carries the same consequence. A programme that treats a missed regulatory disclosure and an untidy counter as equal weight will produce an average that hides the thing that matters. We recommend a short list of critical checkpoints reported individually and never averaged, with everything else grouped.
In practice this list is usually shorter than clients expect. Five or six critical items across a whole programme is common, and the discipline of choosing them is itself useful.
Decide what auditors may and may not do
Auditors work to a brief, and the brief has to be explicit about limits. Whether they may record anything, whether they may complete a transaction, whether they may ask a question designed to test a specific response, and where the line sits between a realistic scenario and one that would misrepresent the situation.
Two constraints shape this. Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, an audit collects personal information about identifiable staff, which brings obligations around what is recorded, who sees it and how long it is held. Separately, any audio or video recording engages state and territory surveillance devices legislation, and those requirements differ between jurisdictions. Recording should not be included in a brief until the position has been assessed for each location where fieldwork will take place. The broader ethical framing is worth reading alongside this in our article on mystery shopping ethics.
Decide whether the programme is disclosed
Some audits are announced, some are not, and some networks run both. Disclosed audits are better for measuring whether a site can perform to standard. Undisclosed audits are better for measuring what happens on an ordinary day. The choice affects what your results mean, and our article on anonymous shopper versus disclosed audit works through the trade-off.
Tell your staff the programme exists
This surprises people, because it feels like it undermines the method. It does not. Undisclosed means individual visits are unannounced, not that the programme is a secret. Staff who learn about a monitoring programme through a disciplinary conversation will regard it as a trap, and the programme will meet resistance for years.
Networks that announce the programme, explain what it measures and why, and say what will and will not happen with the results get materially better cooperation. Our article on getting staff buy-in covers how that announcement is best handled.
Design coverage before you design the report
Which sites, which channels, how often, and at what times of day. A programme that only audits mid-morning on weekdays describes mid-morning on weekdays. If your risk sits in a late shift or a weekend peak, coverage has to reach it.
For larger networks this becomes a sampling question rather than a scheduling one, and the approach differs by network size and structure. Our article on auditing multi-site businesses at scale sets out how coverage is planned when auditing every site every cycle is not practical.
During: what fieldwork looks like
Once the brief is signed off, your involvement drops considerably. Three things are worth knowing about this stage.
Auditors are briefed and calibrated, not just booked
A protocol that has been written but not tested tends to produce surprises in the first cycle. Piloting the instrument on a small number of sites before full rollout usually catches ambiguous checkpoints, missing response options and questions that cannot be answered from a realistic visit.
Expect the first cycle to change the instrument. That is a sign the pilot worked, not that the design failed.
Timeliness matters more than people expect
A report submitted days after a visit relies on recollection. A report submitted the same day relies on observation. Where findings may be used in a corrective conversation, that difference is the difference between a finding that holds and one that gets argued away.
Fieldwork will surface things you did not ask about
Auditors regularly notice conditions outside the scope: an unrelated safety issue, a broken process nobody had reported, information being given that contradicts your own material. A programme should have a route for those observations to reach someone, separate from the scored checkpoints, so they are not lost simply because there was no box for them.
After: turning findings into change
This is where programmes most often stall. The fieldwork is done, the report arrives, and nothing happens because nobody agreed in advance who would act.
Findings need an owner before the first report lands
Every finding should have a defined route: who receives it, who is accountable for the response, what timeframe applies, and who confirms it was closed. Agreeing this before the first cycle avoids a report circulating for weeks while people work out whose problem it is. Our companion article in this series looks at how ownership and sign-off are structured.
Separate the site conversation from the network conversation
A single site missing a step needs a conversation with that site. The same step being missed at a third of sites is not a site problem at all. It usually means the process is unclear, the training did not land, or the requirement is impractical as written. Treating a systemic pattern as a series of individual failures is the most common way a network burns goodwill and fixes nothing.
Feed findings into training rather than filing them
Real audit findings, de-identified, are far better training material than hypothetical scenarios, because staff recognise the situations. Our article on training staff using real feedback covers how to do this without making the material feel punitive.
Re-audit to test whether the fix worked
A corrective action that is never re-tested is an assumption. Building a follow-up check into the next cycle for any site with a critical failure closes the loop and tells you whether the response was effective or merely documented.
What happens when a site disputes a finding?
It will happen, and a programme that has not planned for it tends to handle the first case badly and set a precedent it regrets. A dispute is not a sign the audit failed. It is usually a sign that either the checkpoint was ambiguous or the site has information the auditor did not have.
A workable process has three features. There is a defined window in which a site can respond, so disputes arrive while the visit is still recent. The response goes to someone other than the person who will decide the corrective action, so the review is not simply a confirmation. And the outcome feeds back into the instrument, because a checkpoint that gets disputed repeatedly is telling you something about its wording rather than about the sites.
Where a dispute turns on what was actually observed, the quality of the original record decides it. That is the practical reason evidence standards matter, and it is the subject of the fourth article in this series. Our guide to what a good report contains covers the reporting side of the same question.
What your side of the work involves
A realistic view of the internal effort, because it is usually underestimated at the scoping stage and rarely at the delivery stage.
- Scoping input. Someone who knows the obligations well enough to define what compliant looks like. This is the largest single ask and it cannot be outsourced.
- Sign-off on the brief. Including any legal or privacy review your organisation requires.
- Site list and access details. Trading hours, locations, channel details, anything that affects scheduling.
- An internal announcement. Short, but it needs to come from you rather than from us.
- A named recipient for findings. With authority to act, not just to forward.
- A review point after the first cycle. To adjust the instrument while it is still cheap to change.
A realistic sequence
Every programme differs, and we scope timing with you rather than working to a fixed template. The order, however, is consistent.
- Scoping conversation, establishing which obligations are in scope and where each comes from.
- Draft instrument, with checkpoint wording circulated for comment.
- Legal, privacy and jurisdictional review where recording or sensitive handling is contemplated.
- Internal announcement to your network.
- Pilot on a small number of sites, then revise the instrument.
- First full cycle of fieldwork.
- Reporting, with critical findings escalated separately from the main report.
- Corrective action, then a follow-up check in the next cycle.
We deliberately do not publish indicative durations for these stages, because they depend on network size, how many jurisdictions are involved and how quickly internal sign-off moves. We will give you a schedule when we scope your programme.
Getting started
The most useful preparation you can do before speaking to any provider is to write down the obligations where a failure would matter most, and note what evidence you currently hold that each is being met. That list drives everything else. We work with networks across regulated and franchised sectors to build programmes around those obligations rather than auditing everything and diluting the finding. To talk through what preparation would involve in your network, request a quote or discuss your project.
