Process Audit Checklist: How to Audit a Workflow Before Adding AI
A process audit tells you how a piece of work really gets done, what it costs and where it breaks. It's the step most firms skip before buying automation or AI, and the reason many of those purchases disappoint. Use the checklist below on one workflow and you'll know what to fix, what to automate and what to leave alone.
What is a process audit?
A process audit is a structured review of one workflow from start to finish. It asks four questions: what are the actual steps, how long do they take, where does work stall or go wrong, and what risks does the process carry?
It's different from a financial audit or a compliance inspection. Nobody is checking boxes for a regulator. The point is to see the work clearly enough to improve it. In practice, a process audit starts with mapping the process: drawing the steps, people and tools in order. Our process mapping page covers that in detail.
An internal process audit is simply one your own team runs. That works well if the person leading it doesn't own the workflow, since owners tend to describe how things should work rather than how they do.
The process audit checklist
Tick each item once it's done for the workflow you're auditing. There are 18 items across five stages. Do them roughly in order.
How to run the audit in a week
- Day 1: pick and scope. Choose a workflow that runs often and annoys people. Agree where it starts and ends.
- Days 2–3: walk it. Sit with the people who do it. Watch real cases. Write every step, including the unofficial ones.
- Day 4: measure. Time several runs and count rework. Put a dollar figure on one finished task using the cost-per-task method.
- Day 5: assess. Mark each step as delete, simplify, automate, AI-assist or keep. Write down the risks.
The output is a one-page map with times, costs and a short list of changes ranked by hours saved.
Risk assessment in a process audit
A risk assessment process audit looks at what could go wrong as well as what's slow. For each step, ask: what happens if this is wrong, late or skipped? Who would notice, and when? Pay most attention to steps that touch money, client data or deadlines, and to steps only one person knows how to do.
This matters even more before adding AI. An AI step that drafts a client letter needs a clear human check. One that only sorts internal requests may not. If you're planning AI use, our AI policy template includes a risk scorecard for each use.
Operations audit: finding the hours your team loses
An operations audit is the same idea applied across several workflows at once, to find where the week goes. For a small firm, keep it simple:
- Ask each person to log their time in 30-minute blocks for one normal week, by task, not by client.
- Group the log into workflows: intake, delivery, billing, scheduling, reporting, internal admin.
- Rank the workflows by total hours and by how often people say they are frustrating.
- Run a full process audit on the top one or two.
Process audit software and time-tracking tools can help with the logging, but a shared spreadsheet is enough for a team of under twenty. The value is in the conversation the numbers start, not the tool.
Common findings in small-firm audits
Every workflow is different, but some patterns come up again and again when you walk the work rather than read the procedure:
- The hidden step. Someone keeps a private spreadsheet or sends a reminder that isn't written down anywhere. If they leave, the process quietly breaks.
- The double entry. The same details are typed into two or three systems because they don't connect.
- The approval queue. Work waits for one senior person to glance at it, even when the risk is low.
- The vague start. Work begins without the information it needs, so the first few steps are spent chasing.
None of these needs AI to fix. Spotting them is the main job of the audit.
Automation assessment: what the audit tells you
Once the audit is done, sort the changes:
- Delete: steps nobody needs, such as duplicate approvals or reports nobody reads.
- Simplify: one template instead of five, one owner instead of a shared inbox.
- Automate: repeatable, rule-based steps. Our business automation checklist scores them.
- AI-assist: steps involving reading or writing, with a person checking the output.
- Keep: judgement, relationships and anything a client pays a person for.
Most audits find that the first two categories save as much time as the last three, at no cost. That's why we audit before we automate.
Frequently asked questions
What is a process audit?
A structured review of one workflow that records the real steps, times, costs, failure points and risks, so you can decide what to change.
What's the difference between an internal process audit and an external one?
An internal audit is run by your own team. An external one is run by someone outside the business, who often spots unofficial steps and assumptions insiders no longer notice.
How long does a process audit take?
For one small-firm workflow, about a week of part-time effort: a day to scope, two days to observe, a day to measure and a day to assess.
What is an operations audit?
A broader review of where a team's time goes across several workflows, used to decide which processes to audit and improve first.
Do I need process audit software?
Not for a small team. A shared spreadsheet and a simple flow diagram are enough. Software helps when you audit many processes repeatedly.
Should we audit before adding AI?
Yes. An audit shows which steps to delete or simplify first and which are actually suited to AI, and gives you a before-cost to measure against.