DBASC INSIGHTS — OPERATIONAL ASSURANCE
Why passing an audit does not prove operational control
The audit has gone well. Management is reassured. A month later, the same delivery problem returns. What did the audit establish, and what does management still need to know?
By David Bowman — Founder of DBasc and co-founder of Zebsoft
A positive audit result provides useful assurance about the matters examined. Its meaning depends on the scope, criteria and evidence considered. Management needs to interpret that result alongside what is happening in daily operations.
The practical question is whether the organisation continues to deliver its requirements as people, workload and circumstances change. Answering it requires an ongoing connection between operational evidence and management decisions.
What do we mean by operational control?
For management purposes, operational control means having workable arrangements for delivering requirements, recognising departures and responding before their consequences become unacceptable.
That includes clear ownership, suitable resources, understood instructions and evidence that the arrangements are being used. It also includes knowing when the normal process cannot cope and who has authority to intervene.
What can management see today?
Which important controls are overdue or incomplete?
Where are people departing from the agreed process?
Which problems have returned after corrective action?
What has changed that could weaken existing arrangements?
Read the audit conclusion within its boundaries.
Before using an audit result to support a management decision, establish what was covered. Which processes, locations and activities were examined? What period did the evidence relate to? Were there exclusions, unresolved questions or limitations that affect the conclusion?
The phrase “we passed” can conceal those distinctions. A more useful management discussion considers the findings, the evidence behind them and how far the conclusions can reasonably be applied.
A well-directed audit can examine effectiveness and reveal weaknesses that routine reporting misses. Its findings should feed into the wider system of management review, action and follow-through.
Conditions change after the evidence is examined.
An arrangement that worked with an experienced team and a manageable workload may become difficult when a key person leaves or demand increases. A new contract, supplier or operating method can also introduce requirements that existing controls do not adequately address.
Identify the changes that should trigger a review. Ask whether ownership remains clear, whether capacity is sufficient and whether people have the information and skills needed for the revised work.
Assign responsibility for that review when the change is planned. This gives management a chance to address weaknesses before the next scheduled audit.
A completed record needs an operational meaning.
Records are valuable when they show what happened and support a decision. Their existence alone may leave questions about the quality of the activity or the result achieved.
For example, a signed inspection record should be considered alongside what was examined, what acceptance criteria were used and how exceptions were handled. An action marked complete should lead to an identifiable output and, where appropriate, evidence that the original problem has been addressed.
Ask what each important record allows management to conclude. If the answer is only that someone filled in a field, consider whether the process needs clearer criteria or a more meaningful effectiveness check.
BUILD A CURRENT PICTURE
Four areas of evidence to bring into management review.
Delivery and exceptions
Review whether important requirements are being met and where departures occur. Consider missed checks, rejected handovers, overdue approvals and work released through an exception route.
Recurring problems
Look across complaints, errors and rework for repeated causes. Consider whether similar events recorded by different teams point to a shared weakness in the process.
Action effectiveness
Examine whether completed actions produced their intended result. Distinguish issuing a revised instruction from evidence that subsequent work follows an improved and workable process.
Capacity and change
Review changes in workload, personnel, suppliers and activities. Identify where the people, time, skills or equipment required by the process are becoming unavailable or insufficient.
Make sure the measure answers the question.
A completion percentage can hide important differences. A high overall rate may include routine activities while a smaller number of critical controls remain overdue. Management needs enough context to understand the significance of the exceptions.
Define what is included in each measure, how current the information is and what the result should trigger. Review important omissions and uncertainties alongside the reported figure.
Set the review frequency around the consequences and pace of the work. Some issues need attention during the activity itself; others can be examined through periodic review. Give each concern a route to someone with the authority to respond.
ILLUSTRATIVE EXAMPLE
The control worked until the workload changed.
Imagine a business where completed job packs are checked before release. The records examined during an audit show that the checks were performed and identified issues were resolved.
Several weeks later, a new contract increases the workload and the usual reviewer is absent. A backlog develops. Teams begin releasing work while waiting for approval, but the management report only counts completed jobs.
The earlier evidence remains relevant to the period examined. Management now needs visibility of the changed conditions: the approval backlog, the unavailable cover and the departures from the agreed release process.
A practical response would address review capacity, define authorised cover and make unapproved releases visible. A subsequent effectiveness check would examine whether those arrangements cope with the actual workload.
This is an illustrative scenario, not a reported client result.
APPLY DEFINE, COMMUNICATE, ASSURE
Connect assurance to daily management.
Define
Identify the controls that matter, their owners and the evidence needed to judge performance. Check that requirements are achievable with the people, time, skills and resources available.
Communicate
Make reporting and escalation expectations clear. Ensure people understand which departures need immediate attention and who can authorise a decision when normal arrangements cannot be followed.
Assure
Bring together operational records, review findings and audit evidence. Investigate gaps, act on changes and check whether corrective actions produce sustained improvement.
Start with one control management relies on.
Select an important control and ask its owner to demonstrate how it is working now. Review recent examples, any exceptions and the response to them. Consider what has changed since the last formal examination.
Agree what information management needs to receive, how often it should be reviewed and which conditions require escalation. Keep the arrangement proportionate to the consequences of failure and the speed at which intervention is needed.
Use the findings to inform future audit priorities as well as immediate operational decisions. That creates a useful connection between periodic examination and ongoing management assurance.