A process audit checks one business process from start to finish and asks whether it runs the way it was designed and delivers the result it is meant to deliver. It is narrower than a system audit and closer to the work than a management audit. You pick a process, follow real transactions through it, and report where it breaks, wastes effort or leaks risk.
Last reviewed: 17 October 2026. Facts checked. We ran a web search on process audit definitions and ISO 19011. One source we found says processes are sub-parts of a system, so a process audit usually sits inside a system audit. A CQI/IRCA article notes that ISO 19011 mentions the process approach but has no formal definition of "process audit". We did not open the ISO 19011 text itself, and the CQI page returned an error when we tried to open it. The step list below is practitioner guidance, not a standard.
What a process audit is
There is no single official definition. Most sources use the term for an audit of one process against its documented procedure, its objective and good practice. Quality teams often use it for ISO-style checks. Internal audit teams use it more loosely, and the result overlaps with an operational audit.
The process can be anything with inputs, steps and an output: purchase to payment, order to cash, hiring, month-end close, customer complaints, batch release in a factory.
How it differs from neighbouring audits
| Audit | What it looks at | Typical question |
|---|---|---|
| Process audit | One process, end to end | Does this process work as designed and meet its objective? |
| System audit | A whole management or IT system | Is the system as a whole set up and operating? |
| Financial audit | Financial statements | Are the statements fairly presented? |
| Compliance audit | Adherence to a rule or law | Did we follow the rule? |
| Operational audit | Operations, including efficiency | Is it sound and efficient? |
Sources differ on where process audit ends and operational audit begins. In practice the line is the unit of scope. A process audit has a named process. An operational audit can cover a whole function. For the wider family see types of internal audit.
When to run one
- A process produces repeat errors, rework or complaints.
- A control failed and you need to know if the cause is the process.
- A new process, system or outsourcing arrangement went live.
- Management wants assurance on a high-risk process before a certification audit.
Steps to run a process audit
1. Define the process and the objective
Write the start point, end point, owner and purpose. "Purchase requisition to vendor payment, owner: head of procurement, objective: pay only for goods received at the agreed price."
2. Get the documented procedure
Collect the policy, SOP, flowchart, system roles and any service levels. Note where documents are missing or out of date. That is a finding already.
3. Walk through the real process
Ask the people who do the work to show you, not describe it. Follow one transaction from start to finish. Record each step, the person, the system and the evidence it leaves. Our walkthrough memo generator gives a format.
4. Map risks and controls
For each step ask what could go wrong and what stops it. List the control, who performs it and how often. A risk and control matrix builder can hold this.
5. Test a sample, or the whole population
Pick transactions across the period. Check each against the procedure: right approval, right amount, right time, evidence on file. Where data allows, test all transactions with a simple rule instead of a sample.
6. Measure the result
Ask whether the process meets its objective. Use measures that already exist: turnaround time, error rate, rework, backlog. Do not invent targets. Compare with what management set.
7. Find root causes
If a step fails, ask why. The cause is usually unclear ownership, a missing control, a system gap or a rushed deadline. A simple "5 whys" chain, asking why five times, is one way to do it.
8. Report and agree actions
State the finding, the evidence, the risk, the cause and the fix. Agree an owner and a date with management. Use the internal audit report template.
Process audit checklist
- Process, owner, start, end and objective written down
- Procedure and flowchart collected and dated
- Walkthrough done with the people who do the work
- Risks and controls listed for every step
- Sample or population tested against the procedure
- Result measured against the objective
- Exceptions traced to a root cause
- Actions agreed with an owner and a date
- Follow-up planned
Common mistakes
- Auditing the document, not the practice. The procedure may be perfect and ignored.
- Scope too wide. A process audit that tries to cover three processes covers none well.
- Only testing the normal path. Look at exceptions, overrides and manual workarounds.
- No link to risk. Choose processes from the risk assessment, not from habit. The annual plan generator helps with this.
Frequently Asked Questions
What is the difference between a process audit and a system audit?
A process audit looks at one process. A system audit looks at the whole system the process belongs to, for example a quality management system or an IT system. Processes are parts of a system, so process audits often feed a system audit.
Is a process audit the same as an operational audit?
They overlap. Both ask how work is actually done. A process audit usually has a named process as its scope. An operational audit can cover a function or a group of processes and often goes further on efficiency.
Who can perform a process audit?
Internal audit, a quality team or an outside firm. The auditor should not own the process being audited, so the findings stay independent.
How long does a process audit take?
It depends on the size of the process and how much evidence exists. We do not give a standard duration. Set it in the audit plan after the walkthrough.
Does a process audit give an audit opinion?
Not in the way a financial audit does. It gives findings, a conclusion on the process and recommended actions.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error