Process-Based and Risk-Based Auditing

Introduction

Quality auditing has moved beyond checking whether isolated documents exist. Modern auditors examine how work is organized as a system of interrelated processes, how risks are controlled, and whether the system achieves intended results. This approach is particularly important in ISO 9001:2015 quality management systems (QMS), which emphasizes processes, risk-based thinking, customer requirements, performance evaluation, and continual improvement.

A process-based audit follows work from inputs to outputs and examines the interfaces between departments, suppliers, technologies, and customers. A risk-based audit then allocates audit attention according to the significance and likelihood of failure. Together, these approaches help auditors determine not merely whether procedures are followed, but whether controls are suitable, implemented, effective, and capable of producing conforming outputs.

The auditor must remain objective and evidence-based. Risk assessment supports audit planning; it does not justify unsupported conclusions. Similarly, a high-risk process deserves more attention, but every audit conclusion must still be supported by sufficient and appropriate evidence.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Map organizational processes and their interactions.
2. Identify process inputs, outputs, customers, suppliers, controls, responsibilities, and performance indicators.
3. Distinguish process-based auditing from department-based auditing.
4. Apply risk assessment and materiality to audit planning.
5. Design defensible audit samples and test organizational controls.
6. Evaluate control design, implementation, operating effectiveness, and process performance.
7. Document findings ethically and communicate conclusions to management.

1. The Process Approach to Quality Management

A process is a set of interrelated or interacting activities that transforms inputs into outputs. Inputs may include information, materials, customer requirements, human resources, equipment, software, or energy. Outputs may be products, services, decisions, records, data, or waste. A process also has criteria, methods, resources, responsibilities, and measures.

A department is an organizational grouping; a process is a flow of value-creating or control activities. One department may operate several processes, while one process may cross several departments. For example, order fulfilment may involve sales, credit control, production planning, purchasing, warehousing, logistics, and invoicing. A department-based audit may inspect each unit separately and overlook failures at handovers. A process-based audit follows the order across those boundaries.

The process model

A useful process description includes:

Process owners are accountable for process performance, although they may not personally perform every activity. Process operators execute tasks, control owners maintain particular safeguards, and management provides direction and resources. These roles should not be confused during an audit.

Process interactions

Processes interact through inputs and outputs. A purchasing process may provide approved materials to production; production provides conforming goods to dispatch; dispatch provides delivery information to customer service; customer feedback then becomes an input to improvement processes. Support processes such as competence management, maintenance, document control, information technology, and calibration may influence every operational process.

Interfaces are frequent sources of failure because responsibility, information quality, timing, and acceptance criteria may be unclear. An auditor should therefore ask:

• What triggers the handover?
• What information accompanies the output?
• Who accepts it, and against what criteria?
• What happens when the output is incomplete or nonconforming?
• How is the status communicated and recorded?

2. Building and Using a Process Map

A process map is a visual or tabular representation of activities and relationships. It may be high-level, showing the organization’s core, support, and management processes, or detailed, showing the steps within one process.

A practical mapping method is:

1. Define the process purpose and boundaries.
2. Identify the process owner and principal customers.
3. List internal and external suppliers.
4. Capture inputs, activities, decisions, outputs, and records.
5. Identify upstream and downstream interactions.
6. Add controls, risks, resources, and performance indicators.
7. Validate the map with people who perform the work.
8. Compare the documented process with actual practice.

A process map is not automatically accurate because it has been approved. Auditors should walk through a recent transaction, observe work, and interview relevant personnel. This is often called a process walk-through or tracing exercise.

A simple process sequence is:

Requirement received → requirement reviewed → resources planned → work performed → output verified → output released → customer feedback evaluated → improvement action taken

This sequence is illustrative rather than universal. Processes may operate in parallel, contain feedback loops, or use automated decisions. The map should represent reality sufficiently to support risk and control evaluation.

Process performance indicators

Indicators should measure results that matter, not merely activity volume. Useful categories include:

• Conformity: defect rate, complaint rate, right-first-time percentage.
• Timeliness: cycle time, on-time delivery, response time.
• Efficiency: cost per unit, rework hours, resource utilization.
• Reliability: failure frequency, service availability, repeat incidents.
• Customer outcomes: satisfaction, retention, escalation frequency.
• Improvement: corrective-action closure quality and recurrence reduction.

A performance indicator requires a defined numerator, denominator where applicable, data source, frequency, owner, target, and decision rule. For example, on-time delivery should define what counts as “on time,” which deliveries are included, and how cancelled or disputed orders are treated.

An indicator is not proof of process effectiveness by itself. A favorable result may reflect incomplete data, changed measurement rules, or postponed transactions. Auditors should test the reliability of measurement and reconcile reported results to underlying records.

3. Risk-Based Auditing

Risk-based auditing focuses audit resources on matters that could significantly affect conformity, customer satisfaction, legal compliance, operational continuity, financial integrity, information security, or achievement of objectives. Risk-based thinking is broader than preparing a risk register. It should influence process design, control selection, audit scope, sampling, reporting, and follow-up.

Risk terminology

• Risk: effect of uncertainty on an expected result.
• Hazard: a source or condition with potential to cause harm or failure.
• Control: a measure that modifies risk.
• Inherent risk: exposure before considering controls.
• Residual risk: exposure remaining after controls operate.
• Likelihood: possibility that an event will occur.
• Consequence: severity of the result if it occurs.
• Risk owner: person accountable for managing the risk.
• Risk appetite: amount and type of risk an organization is willing to accept.

Risks can arise from process complexity, change, weak competence, supplier dependence, equipment failure, data integrity problems, conflicting objectives, ineffective segregation of duties, or inadequate response to nonconformity.

Risk scoring

Many organizations use a qualitative or semi-quantitative matrix. A common screening score is:

where R is the risk score, L is the likelihood rating, and C is the consequence rating. Ratings must be defined, for example on a scale from 1 to 5. The multiplication is a prioritization convention, not a probability law. It assumes that the organization has deliberately chosen comparable rating scales and accepts that different combinations can produce the same score. A score of 12 may represent a different management concern from another score of 12 if one has high likelihood and the other has extreme consequence.

Where useful, control strength can be considered separately rather than mechanically deducted from the score. A high inherent risk with strong controls may have moderate residual risk, but the auditor must verify the controls rather than assume that their existence reduces risk.

Risk assessment should consider at least:

1. Impact on product or service conformity.
2. Customer, legal, regulatory, health, safety, or environmental consequences.
3. Process complexity and transaction volume.
4. History of nonconformities, complaints, and recurrence.
5. Degree of change, automation, outsourcing, or supplier dependency.
6. Competence and staff turnover.
7. Detectability of failure before release or customer impact.
8. Strength and independence of existing controls.

Risk and audit priority

Audit priority is not identical to operational risk. A low-frequency process may have severe consequences, while a high-volume process may have modest consequences per transaction but significant aggregate exposure. Audit planning should also consider previous audit results, elapsed time since the last audit, changes in objectives, and whether management claims are supported by reliable data.

A risk-based audit plan normally identifies the process, objectives, criteria, risks, controls, evidence sources, personnel, timing, and estimated effort. High-priority risks may require observation, data analysis, larger samples, specialist expertise, or testing at multiple organizational locations.

4. Materiality and Significance in Quality Audits

Materiality is the significance of an omission, error, failure, or nonconformity in relation to users’ decisions or organizational objectives. In financial auditing, materiality is often quantified. In quality auditing, it is usually contextual and may involve safety, regulatory compliance, customer-critical characteristics, brand reputation, or the inability to deliver a required service.

A small number of defective units may be material if they affect safety-critical components. Conversely, a larger administrative error may be less significant if it cannot affect conformity or customer outcomes. Materiality should therefore consider:

• severity of possible harm;
• legal or contractual significance;
• effect on critical characteristics;
• breadth and duration of the condition;
• recurrence and systemic nature;
• detectability before release;
• vulnerability of affected customers;
• reliability of compensating controls.

Materiality supports decisions about audit depth and escalation, but it does not permit an auditor to ignore a requirement. A minor finding may still indicate a trend or systemic weakness and should be recorded accurately.

5. Auditing Controls

A control is effective only when it is suitably designed, implemented, and operating as intended.

Control design

Design asks whether the control, if performed correctly, would address the relevant risk. For example, a final inspection may detect defects but may not prevent recurrence. A design review, automated validation, approved specification, or mistake-proofing control may address the risk earlier.

Implementation

Implementation asks whether the designed control actually exists and is used. Evidence may include approved procedures, system configuration, training records, authorization settings, and observed practices. A procedure alone is not evidence that the control operates.

Operating effectiveness

Operating effectiveness asks whether the control worked consistently during the relevant period. The auditor may inspect records, reperform calculations, observe work, use system logs, interview personnel, or trace transactions from origin to completion. A control that works only when a particular employee is present may not be robust.

Controls may be:

• Preventive: stop an error before it occurs.
• Detective: identify an error after it occurs.
• Corrective: restore conformity and address causes.
• Directive: establish expectations or authorization.
• Compensating: reduce exposure when the primary control is unavailable.

Auditors should distinguish a control failure from a process outcome failure. A poor result may occur despite a properly designed and consistently operated control; alternatively, a good result may occur despite weak controls. Both control evidence and outcome evidence are necessary.

6. Audit Evidence and Sampling

Audit evidence must be sufficient and appropriate. Sufficiency concerns quantity; appropriateness concerns relevance, reliability, and validity. Direct observation, system-generated records with strong access controls, and independent external evidence may be more persuasive than unsupported statements. Interviews are valuable but should normally be corroborated.

Sampling concepts

Sampling is used when examining every item is impractical or unnecessary. The population must first be defined: for example, all service tickets closed during a quarter, all incoming material lots, or all corrective actions closed in a year. The sample should represent the audit objective and the relevant period.

Common approaches include:

• Random sampling: each population item has a known or reasonably equal chance of selection.
• Systematic sampling: select every kth item after a random start.
• Stratified sampling: divide the population into meaningful groups and sample each group.
• Judgmental sampling: select items based on risk, unusual characteristics, or auditor judgment.
• Haphazard sampling: select without a formal method; it is vulnerable to unconscious bias and should be used cautiously.

A risk-based audit may deliberately select high-value, unusual, late, complaint-related, or exception transactions. Such a sample is useful for testing exposure but cannot be described as statistically representative of the entire population unless the selection design supports that conclusion.

For a simple random sample estimating a proportion, a commonly used planning formula is:

where n₀ is the initial sample size, Z is the standard-normal critical value associated with the chosen confidence level, p is the anticipated proportion, and e is the desired absolute precision. This formula assumes a sufficiently large population, independent selections, and a proportion-estimation objective. If no prior estimate exists, p = 0.5 gives the largest variance and therefore a conservative initial sample size. For a finite population of size N, a commonly used correction is:

These formulas are planning tools, not substitutes for professional judgment. In control testing, the auditor must also specify the tolerable deviation rate, expected deviation rate, confidence requirement, and consequences of an exception. Non-statistical samples may be appropriate where the objective is to understand a process, test a specific risk, or investigate an identified exception.

Exceptions and extrapolation

An exception should be investigated for cause, extent, and effect. One exception does not automatically prove that every item is defective, but it may indicate a systemic control weakness. The auditor should avoid unsupported extrapolation and explain the basis for any conclusion about the population.

7. Conducting a Process- and Risk-Based Audit

Planning

The lead auditor establishes objectives, scope, criteria, timing, team competence, confidentiality requirements, and reporting arrangements. Criteria may include ISO requirements, internal procedures, customer specifications, statutory obligations, contractual terms, and process objectives.

Planning should identify critical interfaces and select audit trails. An audit trail is a traceable path through records and activities. For an order process, the trail may run from customer requirement to contract review, planning, production, inspection, release, delivery, invoicing, and complaint handling.

Opening and information gathering

At the opening meeting, the auditor confirms scope, methods, communication channels, safety requirements, and access to personnel and records. The auditor then combines document review, interviews, observation, sampling, and data analysis. Questions should be open and neutral, such as “Show me how this requirement is verified” rather than “You always verify this, don’t you?”

Testing and evaluation

For each significant risk, the auditor identifies the expected control and obtains evidence that it is designed, implemented, and effective. The auditor should compare three perspectives:

1. Intended process: what the standard or procedure requires.
2. Actual process: what personnel and systems do.
3. Achieved result: what performance data and outputs demonstrate.

Differences between these perspectives may reveal undocumented practice, ineffective implementation, obsolete documentation, or a performance problem.

Findings and conclusions

A well-written finding contains the condition observed, objective evidence, the applicable criterion, and the significance or risk. It should be factual, precise, and free from personal blame. Findings may be classified according to the organization’s defined scheme, such as major nonconformity, minor nonconformity, observation, or opportunity for improvement.

A major finding commonly involves failure to meet a significant requirement, widespread or systemic failure, or a condition that threatens the QMS’s ability to achieve intended results. Classification must follow agreed audit criteria rather than the auditor’s personal preference.

Follow-up

Corrective action should address immediate correction, root cause, action responsibility, completion date, and effectiveness verification. Closing an action because a procedure was revised is insufficient if the underlying cause remains or the process result does not improve. Follow-up may include repeat sampling, trend analysis, observation, or review of recurrence.

8. Worked Example: Auditing an Order-to-Delivery Process

An illustrative manufacturer receives approximately 2,000 customer orders each month. Complaints have increased because promised delivery dates are missed. Management reports an on-time delivery rate of 96%, while customer service records suggest a lower rate.

Process analysis

The process owner maps the sequence: order receipt, contract review, credit approval, production planning, material availability check, manufacture, final inspection, dispatch, and customer notification. Key interfaces occur between sales and planning, planning and purchasing, and dispatch and customer service.

The audit identifies three principal risks:

The scores prioritize audit attention but do not replace investigation. The material-shortage risk receives attention because of its high score and direct effect on delivery. The reporting risk is also important because unreliable data may cause management to make poor decisions.

Control testing

The auditor selects a defined population of orders from the previous quarter. A stratified sample includes standard orders, urgent orders, late orders, and complaint-related orders. For each selected order, the auditor traces the requirement through contract review, planning records, material availability, production status, release records, and dispatch evidence.

The auditor discovers that the reported 96% indicator excludes orders whose promised dates were manually changed after the original commitment. The measurement definition is therefore incomplete. In addition, three of 25 reviewed orders lacked documented evidence of a complete requirements review. Two had later changes that were not communicated to production planning.

Conclusion and action

The evidence supports a finding concerning unreliable performance measurement and weakness in contract-review controls. The appropriate corrective action is not simply to remind staff to complete forms. Management should define the original commitment date, control changes to promised dates, require complete review evidence, and reconcile the performance indicator to source data. Effectiveness should be checked over subsequent months by independently recalculating the indicator and reviewing changed orders.

Learning points

The case demonstrates that:

• the audit trail crosses several departments;
• risk scores help prioritize, but evidence determines findings;
• an apparently favorable indicator may be misleading;
• process interfaces can be more important than departmental boundaries;
• sampling should reflect the audit objective and risk;
• corrective action must address measurement definitions and system causes.

9. Technology, Data Analytics, and Emerging Practice

Digital QMS platforms can provide workflow records, approval histories, electronic signatures, training status, nonconformity trends, and audit trails. Process-mining tools can reconstruct actual process paths from event logs and identify rework, bottlenecks, unauthorized sequences, and long delays. These tools strengthen risk-based auditing when data are complete and reliable.

Artificial intelligence may assist with anomaly detection, document comparison, trend analysis, and audit-plan prioritization. However, AI-generated outputs require human validation. Risks include biased training data, false positives, opaque reasoning, privacy breaches, and automation bias. Auditors remain responsible for professional judgment, confidentiality, and the accuracy of reported conclusions.

Data analytics should be governed through access control, data-retention rules, validation of extraction logic, version control, and protection of personal or commercially sensitive information. A dashboard is not evidence merely because it is sophisticated; the auditor must understand its source, definitions, transformations, and limitations.

10. Challenges, Ethics, and Good Practice

Common challenges include poorly defined processes, excessive documentation, departmental defensiveness, inconsistent risk scales, weak data quality, limited auditor competence, and pressure to soften findings. Auditors should maintain independence, avoid auditing their own work where possible, declare conflicts of interest, protect confidential information, and report significant conditions even when findings are unpopular.

Good practice includes:

• audit processes rather than organizational charts;
• begin with objectives and risks, not checklists alone;
• follow actual transactions across interfaces;
• use multiple evidence sources;
• distinguish a control’s existence from its effectiveness;
• define populations before sampling;
• document selection methods and limitations;
• consider both negative evidence and successful performance;
• write findings that are precise, proportionate, and traceable;
• verify corrective-action effectiveness;
• use audit results for learning and improvement rather than blame.

A checklist remains useful as an aide-mémoire, but it should not dictate the audit at the expense of process understanding. The strongest audits combine conformity assessment with evaluation of whether the QMS is capable of achieving intended outcomes.

Chapter Summary

Process-based auditing examines how interrelated activities transform inputs into outputs across organizational boundaries. It considers process purpose, suppliers, customers, responsibilities, resources, controls, risks, and performance indicators. Process maps and audit trails help auditors understand interfaces where information, materials, and accountability may be lost.

Risk-based auditing directs effort toward significant exposures, using likelihood, consequence, history, complexity, change, and control strength as planning considerations. Risk scores are prioritization aids rather than objective measures of probability. Materiality is contextual and may depend on safety, legal obligations, customer impact, systemic extent, or detectability.

Effective control evaluation considers design, implementation, and operating effectiveness. Reliable conclusions require sufficient and appropriate evidence obtained through observation, inquiry, inspection, reperformance, data analysis, and sampling. Sampling must have a defined population and objective, and conclusions must not exceed what the selection method supports.

Professional audits compare intended processes, actual practices, and achieved results. They report objective findings, protect independence and confidentiality, and verify that corrective actions address causes and produce sustained improvement. Digital tools and AI can support audit analysis, but human judgment and governance remain essential.

Key Terms

Process: Interrelated activities that transform inputs into outputs.

Process owner: Person accountable for the performance and results of a process.

Process interaction: Relationship in which one process supplies or receives an input or output from another.

Input: Requirement, material, information, or resource introduced into a process.

Output: Product, service, decision, record, or result produced by a process.

Control: Measure that modifies or manages risk.

Inherent risk: Exposure before controls are considered.

Residual risk: Exposure remaining after controls operate.

Likelihood: Possibility that an event will occur.

Consequence: Result or severity if an event occurs.

Risk owner: Person accountable for managing a specified risk.

Materiality: Significance of a condition in relation to objectives or users’ decisions.

Audit trail: Traceable sequence of evidence across activities and records.

Sampling: Examination of selected items from a defined population.

Preventive control: Control intended to stop an error before it occurs.

Detective control: Control intended to identify an error after it occurs.

Operating effectiveness: Degree to which a control works consistently as intended.

Nonconformity: Failure to meet a requirement.

Corrective action: Action taken to eliminate the cause of a nonconformity and prevent recurrence.

Process indicator: Defined measure used to evaluate process performance or effectiveness.

Review Questions

Short Answer Questions

1. What is the difference between a process and a department?
2. Identify four elements that should appear in a process description.
3. Distinguish inherent risk from residual risk.
4. What are the three dimensions of control evaluation?
5. Why should an auditor define the population before selecting a sample?

Long Answer Questions

1. Explain how process interactions can create quality risks and describe methods an auditor can use to examine them.
2. Discuss the advantages and limitations of using R = L × C as an audit-prioritization method.
3. Explain how materiality should be applied in a quality audit where safety, customer, and regulatory consequences differ.
4. Compare preventive, detective, corrective, and compensating controls, giving one example of each.
5. Describe the complete sequence of planning, conducting, reporting, and following up a process-based audit.

Analytical / Application Questions

1. A service organization reports 98% on-time completion, but excludes reopened cases from its calculation. Analyze the measurement risk and propose an audit approach.
2. A high-volume purchasing process has few recorded defects, but depends on one supplier and has recently changed its enterprise system. Develop a risk-based audit scope and sampling strategy.
3. During an audit, interviews indicate that staff bypass an approval control during urgent orders, although the final output is usually conforming. Evaluate the control and recommend proportionate corrective action.

Multiple Choice Questions with Answers

Question 1

Which feature most clearly distinguishes a process-based audit from a department-based audit?

A. It examines only documented procedures.

B. It follows activities and interfaces across organizational boundaries.

C. It excludes support functions from the audit scope.

D. It focuses exclusively on employee performance.

Correct Answer: B. It follows activities and interfaces across organizational boundaries.

Question 2

In the screening equation R = L × C, what does C represent?

A. Control cost

B. Compliance frequency

C. Consequence

D. Corrective-action time

Correct Answer: C. Consequence

Question 3

Which question primarily evaluates a control’s operating effectiveness?

A. Was the control approved by management?

B. Would the control address the identified risk if designed correctly?

C. Did the control operate consistently during the relevant period?

D. Is the control described in the quality manual?

Correct Answer: C. Did the control operate consistently during the relevant period?

Question 4

Which sampling method divides a population into meaningful groups and samples each group?

A. Stratified sampling

B. Haphazard sampling

C. Single-case sampling

D. Unrestricted interviewing

Correct Answer: A. Stratified sampling

Question 5

Why is a favorable performance indicator not, by itself, proof of process effectiveness?

A. Indicators are never relevant to auditing.

B. The data may be incomplete or based on changed measurement rules.

C. Auditors may only use interview evidence.

D. Performance targets cannot be used in ISO-related audits.

Correct Answer: B. The data may be incomplete or based on changed measurement rules.

Question 6

Which is an example of a preventive control?

A. A complaint investigation after delivery

B. A monthly report of rejected products

C. Automated validation that blocks an incomplete order

D. Rework performed after inspection

Correct Answer: C. Automated validation that blocks an incomplete order

Question 7

What should an auditor do first when planning a sample?

A. Select the most convenient records.

B. Define the population and audit objective.

C. Choose the largest possible sample.

D. Exclude unusual transactions.

Correct Answer: B. Define the population and audit objective.

Question 8

Which condition is most likely to be material in a quality audit?

A. A harmless typographical error in an internal memo

B. A minor delay in a noncritical filing activity

C. A failure affecting a safety-critical product characteristic

D. A preference for one document format over another

Correct Answer: C. A failure affecting a safety-critical product characteristic

Question 9

What is the principal purpose of an audit trail?

A. To replace process mapping entirely

B. To trace activities and evidence from an input or requirement to an output

C. To rank employees by performance

D. To eliminate the need for interviews

Correct Answer: B. To trace activities and evidence from an input or requirement to an output

Question 10

Which statement about AI-assisted auditing is most appropriate?

A. AI outputs require no human review if generated from organizational data.

B. AI can support anomaly detection, but its outputs require validation and governance.

C. AI may be used to disclose confidential records for better analysis.

D. AI automatically establishes the materiality of every finding.

Correct Answer: B. AI can support anomaly detection, but its outputs require validation and governance.