How to Audit a Process You Have Never Seen Before

Walking into an unfamiliar process during an internal audit tests every skill you've developed as an auditor. You cannot rely on past experience, muscle memory, or institutional knowledge of how things supposedly work. Instead, you must become genuinely curious, methodical, and forensic in your approach. This is where competent auditing separates from checkbox compliance. The organisations that excel at internal auditing understand that encountering new processes is not a problem to avoid but an opportunity to audit with genuine objectivity.

Why Auditors Fear Unknown Processes

The discomfort many auditors feel when facing an unfamiliar process is understandable. You worry about asking naive questions, missing obvious problems, or failing to recognise whether something is genuinely broken or simply different from your expectations. There is also the risk of being perceived as incompetent by the process owner who may wonder why you are asking "basic" questions. These concerns are legitimate, but they often lead auditors to take shortcuts that compromise audit quality.

Some auditors lean too heavily on their checklists when they do not understand a process. Others allow the process owner to guide them through in such a way that they never actually form independent conclusions. Some simply document what they observe without understanding whether it makes sense within the organisation's system. None of these approaches produce reliable audit evidence.

The psychological pressure to appear knowledgeable can push auditors towards confirmation bias. If someone confidently tells you "this is how we do it" and you do not fully understand the process, you are more likely to accept their explanation uncritically. This is particularly problematic in complex, technical, or specialised processes where you lack domain expertise.

Prepare Before You Walk Into the Area

Your audit of an unfamiliar process begins long before you step into that area. Preparation is where you build your foundation of understanding and set yourself up to audit effectively.

Start by reviewing the documented process. This might be a standard operating procedure, a process flowchart, a work instruction, or a combination of these. Read it at least twice. The first read gives you the basic flow. The second read allows you to identify questions and gaps. Write down every step that is unclear, every decision point that needs clarification, and every interface with other processes. If the documentation is outdated or absent, this itself is an audit finding worth noting. The requirement to document processes exists precisely because undocumented work is vulnerable to error, inconsistency, and knowledge loss.

Next, map the process to your ISO standard's requirements. If you are auditing under ISO 9001, which processes require documented information? Which require competence verification? Where are there risk points? If you are auditing under ISO 45001, which steps introduce hazards? Where are controls required? If you are auditing under ISO 14001, what environmental aspects emerge from this process? Understanding where your standard applies to this specific process is essential before you audit it.

Identify the key variables and risks inherent to this process. Manufacturing processes have quality variables and safety risks. Administrative processes have timeliness and accuracy risks. Procurement processes have supplier quality and compliance risks. You do not need deep technical expertise, but you do need to understand what could go wrong. Ask yourself: "What would be a problem if it failed?" This question reveals the critical control points you need to examine.

Request background materials from the process owner before your audit. This might include recent audit history, results of recent quality checks, customer complaints related to this process, or process performance data. If the process has never been audited before, that is notable. If it has recurring issues, you need to know what those are. If there have been recent changes to the process, that is a significant audit focus area.

Understand Your Role as an Auditor, Not an Expert

One of the most important mindset shifts for auditing unfamiliar processes is recognising that you are an auditor, not an expert in that process. Your role is not to tell the process owner how to do their job better. Your role is to determine whether the process, as it exists, conforms to the standard and operates consistently.

This distinction matters because it removes the pressure to understand every technical detail. You do not need to become a subject matter expert. You need to understand the process well enough to verify that it works as intended and that the organisation's documented requirements are being followed. This is a much narrower and more achievable scope.

When you encounter something you do not understand, this is valuable information. It may indicate that the process owner themselves does not fully understand their own procedure, or that the documented process does not reflect reality, or that training is inadequate. These are all legitimate audit findings. The fact that you do not understand something is not a failure on your part; it is a signal that you should probe further.

Conduct a Detailed Opening Interview

Your opening meeting with the process owner should accomplish far more than simply introducing yourself and explaining your audit scope. This is where you gather the foundational knowledge that will guide your audit.

Start by asking the process owner to walk you through the end to end process as it actually happens. Do not follow a script or checklist at this point. Let them talk. Ask open questions: "Take me through a typical day in this process" or "Walk me through what happens from start to finish." Listen for inconsistencies with the documented procedure. Take notes on what they describe versus what the documentation says.

Ask about the people involved. Who performs each step? Are they trained? Do they rotate through different roles within the process or stay specialised? What happens when someone is absent? People dependencies are critical audit points because they represent risk. If only one person knows how to perform a critical step, that is a vulnerability worth documenting.

Ask about the inputs and outputs. What triggers the start of the process? What should the end result look like? What happens if the output is wrong? Understanding the boundaries of the process helps you focus your audit attention on the right areas.

Ask about recent issues. Have there been any mistakes, complaints, or incidents related to this process? If yes, how were they handled? How do you know they will not happen again? If no, ask whether the process owner is confident in that claim. Some people resist mentioning issues because they fear audit consequences, but genuinely allowing people to discuss challenges is where you get reliable information.

Ask about variation within the process. Do you always do it the same way, or are there situations where the method changes? Do different team members perform steps differently? Intentional variation might be appropriate depending on circumstances. Uncontrolled variation might be a nonconformity. You need to understand which situation you are facing.

Observe the Process in Real Time

Observation is where you validate what you have learned from documentation and interviews. Watching the process actually happen, rather than hearing about it, provides evidence that either confirms or challenges the information you have gathered.

Plan to observe the process during typical operations. If at all possible, avoid observing during unusually quiet or busy periods unless the audit specifically concerns peak load scenarios. Ask the process owner to work normally and to act as if you are not there, which they will not manage but should still attempt. Shadowing adds context to steps that are confusing on paper.

As you observe, note discrepancies between what you were told and what you see. This is not a gotcha moment. It is information. The process owner may have described the ideal method, but the operator may work differently. The procedure may stipulate something that nobody actually does. The team may have developed workarounds that make the documented process more efficient. None of these necessarily represent nonconformities, but you cannot know that unless you observe reality.

Pay attention to the physical environment. Are materials organised in a way that makes sense? Are there safety issues visible? Is there evidence of quality control checks happening? Are records being completed contemporaneously or retrospectively? The environment tells you things that interviews cannot.

Watch for decision points and where judgment is required. Does the operator consult a reference guide? Do they phone someone for approval? Do they make the decision themselves based on experience? This matters because it affects whether the outcome is repeatable and controllable. If different operators make different decisions in the same situation, you have identified a control gap.

Document observations in a way that allows you to remember what you saw. Notes like "standard observed" or "process working correctly" are useless later. Better notes: "Operator selected material from bin B because colour matched, no reference standard consulted, colour matching is subjective, no documented guidance provided." This evidence tells a complete story.

Ask Questions That Reveal Understanding

The quality of your questions determines the quality of your audit. When auditing an unfamiliar process, your questions need to accomplish several things simultaneously: build your understanding, verify compliance, and test whether the people operating the process actually understand it.

Use probing questions that cannot be answered with a simple "yes" or "no." Rather than asking "Do you follow the procedure?", ask "Walk me through the steps you performed on this order." Rather than "Are records kept?" ask "Show me where records are kept and explain why you keep them there." These questions force concrete responses that you can verify.

Ask "what if" questions to understand how the process handles exceptions. "What if the material fails the quality check?" "What if the supplier is late?" "What if the customer requests a change mid process?" How exceptions are handled reveals whether the process is robust or fragile. If the process owner has no clear answer to these questions, that may indicate inadequate planning.

Ask questions that verify understanding of the "why" behind the steps, not just the "how." "Why do you perform this step?" "What would happen if you skipped this step?" "How does this step ensure quality?" If someone is simply following a procedure without understanding its purpose, that is a training issue worth noting.

Ask about variation: "Do all operators do this the same way?" "What if you did it differently?" "Are there approved alternatives?" This helps you distinguish between appropriate flexibility and uncontrolled inconsistency.

Ask about interfaces: "What information comes in from the previous process?" "Who depends on your output?" "What happens if you provide something that does not meet requirements?" Processes do not exist in isolation. Understanding how this process connects to the broader system is critical for evaluating its effectiveness.

Gather Evidence, Not Just Impressions

Your audit conclusions must be based on factual evidence, not assumptions or inferences. When auditing an unfamiliar process, you are particularly vulnerable to misinterpreting what you see because you lack experience in that context.

Review records systematically. If the process should produce records, examine a sample. Do they show evidence of the documented steps being followed? Are they completed correctly? Are they reviewed and approved as required? Do they show dates, times, and identification of who performed the work? Records are your trail of evidence that the process happened as it should.

Verify competence. If the procedure requires people to have specific training or qualifications, confirm that the people performing the process actually have that training or qualification. Look at training records, certification documents, or competence assessments. Do not accept someone's verbal assurance that they are trained; look at documentation.

Test whether materials, equipment, and environment meet requirements. If the process requires specific equipment or facilities, verify that they exist and are suitable. If materials must meet certain specifications, verify that incoming materials are checked. If environmental conditions are important, verify that they are monitored.

Examine equipment and tools. Are they maintained? Are they the correct equipment for the purpose? Do they have valid calibration if calibration is required? If someone tells you "that machine is reliable," verify it. Look at maintenance records, calibration certificates, and repair history.

For processes involving decisions or judgments, examine the criteria used. If someone must determine whether something is acceptable, is there a standard, specification, or reference they consult? Or are they working from memory and experience? The former is more reliable and repeatable; the latter is vulnerable to inconsistency.

Gathering audit evidence that stands up to scrutiny means collecting facts that can be verified, traced, and understood by anyone reviewing your findings later. It means avoiding conclusions that rest on assumptions about how things work.

Identify Where Standards Apply Within This Process

Once you understand the process itself, connect it explicitly to your audit standard. Different areas of the standard apply to different processes, and this is particularly important when auditing something new to you.

If you are auditing under ISO 9001, you need to determine which clauses apply. Does this process involve documented information that needs to be controlled? Clause 7.5 applies. Does it involve staff who need to be competent? Clause 7.2 applies. Does it involve customer property or external provided processes? Clause 8.4 applies. Does it produce records that need to be kept? Clause 8.5.1 applies. Some processes trigger multiple requirements; others trigger few. Your audit scope should reflect what actually applies.

For ISO 14001, determine which environmental aspects this process generates. Does it use energy, water, or materials? Does it produce waste? Does it generate emissions? Does it have the potential to affect the environment? If yes, you need to audit how the organisation is managing those aspects and whether they have identified the impacts properly.

For ISO 45001, identify hazards in the process and verify that the organisation has identified them and established appropriate controls. Common hazards in operational processes include physical hazards, ergonomic hazards, chemical hazards, and human factors hazards. Verify that hazard identification was done systematically and that controls are appropriate to the risk level.

Understanding what your specific standard requires for internal audits ensures you are not randomly checking things but systematically verifying conformity to defined requirements.

Document Observations Clearly and Completely

Your observation notes during the audit are critical. They provide the raw material for your conclusions and your audit report. When auditing an unfamiliar process, clear notes are even more important because you may need to revisit them later to verify your understanding or to discuss findings with management.

Include the date, time, process owner's name, and everyone present during observations. Include exactly what you observed, not your interpretation of it. "Two staff members processed orders without reviewing the quality checklist" is an observation. "The process is chaotic and nobody checks quality" is an interpretation. Observations stick to facts; interpretations invite debate.

Note the sample size of what you observed. "I observed three orders processed over a 90 minute period" is meaningful. "I observed the process" is vague. If the process owner says something is exceptional, note that in your observations so your findings can distinguish between normal operation and unusual circumstances.

Record who told you what. If someone makes a claim, note their name and title. If different people provide conflicting information, document that conflict. It may indicate inconsistent training, unclear procedures, or uncontrolled variation in how the process is performed.

Include the evidence source for each observation. "Confirmed by examining maintenance record dated 15 March 2024" is stronger than "maintenance records are kept." Reference specific documents, records, or conversations. This allows anyone reading your audit notes later to verify your conclusions if necessary.

Resist the Temptation to Fake Understanding

Auditors sometimes feel pressure to project confidence and expertise, especially when auditing something outside their normal scope. This pressure leads to mistakes. You might nod along to something you do not actually understand, or ask follow up questions using jargon you are not entirely sure about, or make conclusions based on guessing rather than evidence.

The antidote is simple: ask for clarification. If someone explains something and you do not understand, say so. "Can you explain that in simpler terms?" or "I want to make sure I understand, so let me repeat back what I heard..." or "I am not familiar with that terminology; what does that term mean in your process?" Professional auditors ask these questions routinely. It is not a sign of weakness; it is a sign of professional rigour.

If you encounter technical terminology you do not know, ask about it directly. "In this process, what exactly is a 'spec review'?" If you get a vague or circular answer, keep probing. Vague explanations often indicate the process owner themselves does not have complete clarity, which is valuable audit information.

If you observe something that does not make sense to you, ask why it is done that way. Do not assume you are simply missing context. Sometimes the answer reveals important information about the process. Sometimes the answer is "nobody has ever questioned it" or "that is just how we have always done it," which indicates the process has not been critically reviewed in a long time.

When the Process Is New to the Whole Organisation

Occasionally you will audit a process that is new not just to you but to the organisation. A recent acquisition introduces new processes. A new capability is being built. A new product line uses a completely different approach. In these situations, your audit faces additional complexity because the organisation itself may not yet fully understand how the process should work.

In these cases, focus your audit on whether the organisation has documented the process, established the necessary controls, and trained people who will operate it. You are evaluating whether the organisation has prepared adequately for the process to function reliably, not whether the process is yet running perfectly. Organisations need time to mature processes. Your audit should verify that they have taken the right steps to make that maturation possible.

Look particularly carefully at the design phase. Did someone actually think through all the steps, decision points, and requirements before launching the process? Or did they launch it and sort out the details as problems emerged? The former represents planned, competent process design. The latter suggests inadequate planning.

Verify that competence has been assessed and addressed. New processes require people to learn new skills. Did the organisation provide training? Did they verify that people understood it? Did they allow supervised operation initially, or did they expect people to get it right immediately? The maturity of the implementation approach tells you a lot about the likely success of the process.

Build Your Audit Conclusions Systematically

Once you have gathered all your evidence, you need to connect it to your audit standard to reach conclusions. This is where your preparation and understanding of the standard becomes critical.

For each area of the standard that applies to this process, ask yourself: "Does the organisation conform to this requirement?" Base your answer only on evidence, not on assumptions. If you do not have sufficient evidence to determine conformity, that itself may be an audit finding because documentation or evidence should exist.

Distinguish between nonconformities and observations. A nonconformity is a clear failure to meet a requirement. The organisation has not done something the standard requires, or has done something the standard prohibits. An observation is something worth noting that may indicate a risk or opportunity for improvement, but does not constitute a definite breach of requirements. Understanding the difference between findings, observations, and nonconformities ensures your audit report accurately represents what you found.

Consider context when evaluating conformity. If an organisation has recently implemented a process and people are still learning, that is different from an organisation that has been running the same non conforming process for years. Both might have the same finding, but the context affects how serious it is and what corrective action should address it. Age and context of a nonconformity matter for your audit report.

Look for patterns. If you observe something once, it could be a one off mistake. If you observe the same issue multiple times or with multiple people, it indicates a systemic problem. Pattern is an important part of your audit evidence.

Document Your Audit Report Accurately

Your audit report is your final product. It must communicate your findings clearly enough that someone who was not present at the audit can understand what you found and why you concluded what you did. This is even more critical when auditing unfamiliar processes because your report is the only way to convey what you learned.

For any finding in an unfamiliar process, be especially careful to explain the evidence clearly. Do not assume your reader understands the process the way you now do. Explain: the requirement from the standard, what should be happening, what you observed, and why this represents a nonconformity or observation. Documenting observations clearly ensures that management understands what needs to change and why.

Include enough detail that the findings are defensible. If the certification body reviews this audit, they need to be able to trace your conclusion back to the evidence. This is particularly important for serious findings in areas where your expertise was limited going in.

Acknowledge what worked well. If you observed good practices in an unfamiliar process, say so. This provides positive feedback and helps the process owner understand that you are being objective, not just critical.

Offer clarity on what corrective action should address. While you are not responsible for solving the problem, you are responsible for defining what the problem is with sufficient clarity that management can solve it effectively. If something is unclear or ambiguous, your findings will not drive meaningful change.

Audit Workshop offers accredited ISO Internal Auditor training that covers internal audit planning, execution, and reporting in depth. Our courses are recognised by Exemplar Global and designed for working professionals who need practical skills they can apply immediately.