Understanding the Process Audit
A process audit is one of the most practical and revealing types of audits you can conduct. Rather than checking whether a management system exists on paper, a process audit examines how a specific process actually operates. It follows the work through its steps, asks whether inputs are controlled, verifies that activities happen as planned, and checks whether outputs meet requirements.
On this page
If you have ever sat in an audit and wondered whether the documents on the table reflect what actually happens on the floor, you already understand why process auditing matters. The process audit closes that gap. It gets you out of the filing cabinet and into the work itself.
This article explains what a process audit is, how it differs from a system audit and a product audit, when to use it, and how to conduct one effectively. Whether you are an internal auditor building your programme or a quality manager preparing for a certification audit, this guide will give you a clear and practical foundation.
Process Audit vs System Audit vs Product Audit
These three types of audits are often confused, and the confusion leads to programmes that miss important coverage. Understanding the distinction helps you choose the right approach for the right situation.
What a System Audit Does
A system audit evaluates the management system as a whole. It checks whether the organisation has established, implemented, and maintained a system that meets the requirements of a standard like ISO 9001, ISO 14001, or ISO 45001. System audits tend to move across clauses and functions. They are broad by design. Most certification audits are system audits. They ask: does the management system exist and is it working overall?
What a Product Audit Does
A product audit examines a finished product or output against defined specifications. It asks: does this product meet what it was supposed to be? Product audits are common in manufacturing and are often confused with inspection. The focus is on the output, not the process that produced it.
What a Process Audit Does
A process audit sits between these two. It focuses on a single process or a defined set of related activities. It asks: is this process being carried out as planned, and is it producing the intended results? A process audit follows the flow of work. It looks at inputs coming in, activities being performed, controls being applied, and outputs going out. It also checks that the people doing the work have the competence, resources, and information they need.
In practice, most internal audit programmes benefit from a mix of all three. But the process audit is the one that most directly connects the management system to real operations. It is the type of audit that uncovers the gap between what the procedure says and what actually happens.
Exemplar Global Recognised Training ProviderRTP No. 310970
Why Process Auditing Matters Under ISO Standards
ISO 9001:2015 built the process approach into its core structure. Clause 4.4 requires organisations to determine the processes needed for their quality management system, understand how they interact, apply the criteria and methods needed to ensure effective operation, and maintain documented information to support those processes. The same logic runs through ISO 14001 and ISO 45001.
When you audit against this requirement, you are essentially doing a process audit. You are checking whether the organisation has understood its processes, whether those processes are being run as intended, and whether they are producing the results the organisation expects.
This is why many experienced auditors, including those who conduct third party certification audits, structure their audit around processes rather than clauses. They might spend a morning following the customer order process from enquiry through to delivery, sampling records, interviewing staff, and observing activities along the way. The clause references come later, when they are writing up findings. The audit itself is built around the work.
The Anatomy of a Process
Before you can audit a process effectively, you need to understand what a process actually consists of. ISO 9000:2015 defines a process as a set of interrelated or interacting activities that transforms inputs into outputs. That definition is technically accurate but not particularly useful on its own. In practice, a process has several components that an auditor needs to understand and verify.
Inputs
Inputs are the materials, information, or other resources that enter the process. For a manufacturing process, inputs might include raw materials, customer specifications, and work instructions. For a procurement process, inputs might include purchase requisitions, approved supplier lists, and budget authorisations. An auditor checks whether inputs are controlled, whether they meet defined criteria before entering the process, and whether there is a mechanism to handle nonconforming inputs.
Activities and Controls
Activities are the steps performed to transform inputs into outputs. Controls are the mechanisms that keep those activities within acceptable parameters. Controls might include procedures, work instructions, competence requirements, equipment calibration, environmental conditions, or monitoring at defined points. An auditor checks whether activities are performed as planned and whether controls are actually in place and working.
Outputs
Outputs are the results of the process. They might be products, services, decisions, or information that flow into the next process. An auditor checks whether outputs meet defined requirements and whether there is a mechanism to verify this before outputs leave the process.
Resources
Every process needs resources: people with the right competence, equipment in good condition, adequate time, and suitable work environment. An auditor checks whether the process has the resources it needs and whether those resources are being maintained.
Monitoring and Measurement
A well managed process has defined performance indicators. The organisation should know whether the process is achieving its intended results. An auditor checks whether monitoring is happening, whether data is being collected and analysed, and whether the results are being used to drive improvement.
How to Structure a Process Audit
A process audit follows a logical sequence. The exact steps will vary depending on your context, but the following structure works well for most situations.
Step 1: Identify the Process to Audit
Start by selecting the process you will audit. Your internal audit programme should be risk based, so processes with higher significance, greater complexity, or recent problems should be prioritised. In a quality management context, you might audit the customer complaint process if complaint volumes have been rising. In a safety context, you might audit the permit to work process if there have been near misses involving contractor activities.
Step 2: Understand the Process Before You Arrive
Before the audit, review whatever documented information exists for the process. This might include procedures, work instructions, flow charts, process maps, training records, monitoring data, and previous audit findings. You are not trying to memorise the procedure. You are trying to understand enough about the process to ask intelligent questions and recognise when something does not look right.
A turtle diagram is a useful tool at this stage. It prompts you to think about what goes into the process, what comes out, what activities are performed, what equipment and materials are used, what competence is required, and how performance is measured. You can build a simple turtle diagram from the documented information and then use the audit to verify whether reality matches.
Step 3: Plan Your Audit Questions and Sampling
Prepare a set of open questions that will help you understand how the process works in practice. Avoid questions that can be answered with yes or no. Instead of asking whether operators are trained, ask the operator to walk you through how they know what to do at each step. Instead of asking whether inspections are recorded, ask to see the last three inspection records and then ask the person who completed them to explain what they were checking for.
Plan your sampling approach. You cannot check every record or observe every activity. Decide in advance which records you will sample, which steps you will observe, and which people you will interview. Risk should guide your sampling. If a particular step in the process is critical to quality or safety, spend more time there.
Step 4: Conduct the Audit
Start with a brief opening conversation with the process owner or supervisor. Explain what you are doing and how long you expect to be there. Then follow the process. Walk the floor if you can. Observe activities being performed. Ask operators to explain what they are doing and why. Look at records as they are being created, not just filed copies. Check that the equipment being used is the equipment specified in the procedure. Check that the version of the work instruction on the floor matches the current controlled version.
As you go, take notes. Record what you observed, what you were told, and what you reviewed. Note the specific records you sampled, including their identifiers. This documentation is essential when you write up your findings.
Step 5: Analyse and Report
After the audit, review your notes and identify what you found. Classify findings as conformities, nonconformities, or observations. For any nonconformity, you need to be able to state the requirement that was not met, the objective evidence that demonstrates nonconformance, and the specific clause or documented requirement that applies.
Write your report in plain language. Describe what you found, not just what clause was breached. A good process audit report tells the story of the process as you found it, highlights where it is working well, and clearly describes where it is not.
Common Findings in Process Audits
Certain types of findings come up repeatedly in process audits across different industries and different standards. Knowing what to look for helps you focus your audit time effectively.
The Procedure Does Not Match Practice
This is the most common finding in process audits. The procedure describes one way of doing things, but the people doing the work have developed a different approach, sometimes better, sometimes worse. Either the procedure needs to be updated to reflect current best practice, or the practice needs to be brought back into line with the procedure. Either way, the gap is a finding.
Monitoring Is Not Happening as Required
The process might have defined monitoring points, but when you check the records, you find gaps. Inspections that should happen at defined intervals have been skipped. Data that should be collected is missing. Performance indicators that should be reviewed monthly have not been looked at in six months. This is a very common finding, and it often signals that the monitoring requirements were set without considering whether they were practical.
Competence Records Are Incomplete or Out of Date
The people doing the work may be perfectly capable, but the records that demonstrate their competence are missing or expired. Training records have not been updated. Assessments have not been completed. Authorisations to perform certain tasks have lapsed. This is a documentation finding, but it also raises a genuine question about how the organisation knows its people are competent.
Resources Are Not Adequate
Equipment is out of calibration. The work environment does not meet the conditions specified in the procedure. There are not enough people to perform the monitoring required. These resource findings often point to systemic issues that go beyond the individual process.
Outputs Are Not Being Verified
The process produces an output, but there is no evidence that the output was checked against requirements before it moved to the next step. Products are released without inspection. Reports are sent without review. Decisions are made without the defined approval. This type of finding is particularly significant because it means nonconforming outputs may be reaching customers or creating downstream problems.
Process Auditing in Practice: A Real Example
Consider an internal audit of the calibration process at a medium sized manufacturing business. The procedure requires that all measuring equipment used in product inspection be calibrated at defined intervals, that calibration be performed by an approved external provider, and that equipment found to be out of tolerance be quarantined and a nonconformity raised to assess the impact on previous measurements.
During the audit, the auditor walks through the calibration process with the maintenance supervisor. They review the calibration register and find 14 pieces of equipment listed. Three of them are overdue for calibration. When the auditor asks about this, the supervisor explains that the approved external provider has had a long lead time and the equipment is still in use. No nonconformity has been raised. No assessment of impact has been done.
The auditor then goes to the production floor and finds two of the three overdue instruments actively being used in final product inspection. They sample five inspection records from the past three weeks and find that all of them were completed using one of the overdue instruments.
This is a significant finding. The process is not being followed. The controls are not working. Products may have been released based on measurements taken with equipment of unknown accuracy. The auditor has clear objective evidence and can write a well supported nonconformity that explains exactly what was found and why it matters.
This is what a good process audit looks like. It does not just check whether a calibration register exists. It follows the process and finds out whether the process is actually working.
Process Auditing and the Internal Audit Programme
A well designed internal audit programme will include process audits as a core component. Rather than auditing every clause every year, consider structuring your programme around the key processes of your management system. Identify which processes carry the most risk, which have had problems in the past, and which are critical to achieving your quality, environmental, or safety objectives. Allocate audit time accordingly.
This approach aligns well with the risk based thinking that ISO 9001, ISO 14001, and ISO 45001 all require. It also produces more useful findings. A process audit that uncovers a genuine gap in how a critical process operates is far more valuable than a clause by clause review that confirms documents exist.
If you are building or reviewing your internal audit programme, the article on process based vs clause based auditing explores this distinction in more detail and will help you think through how to structure your approach.
For those wanting to understand how the process approach connects to ISO 9001 requirements specifically, the article on the process approach explained with examples provides a strong foundation.
Exemplar Global Recognised Training ProviderRTP No. 310970Getting the Most Out of Process Audits
A few practical points that experienced auditors have learned through doing this work.
First, spend time on the floor. Documents tell you what should happen. Observation tells you what does happen. The most valuable part of a process audit is often what you see when you walk the process rather than what you read at the desk.
Second, talk to the people doing the work, not just the managers. Operators, technicians, and frontline staff often know exactly where the process breaks down. They deal with the problems every day. Ask them what makes their job harder. Ask them what they do when something goes wrong. You will learn more in ten minutes with an operator than in an hour reviewing procedures.
Third, follow the evidence wherever it leads. If you find a gap in monitoring records, ask why. If the answer points to a resource problem, follow that. If it points to a training gap, follow that. Process audits are most useful when they get to the root of why a process is not performing as intended, not just the surface symptom.
Fourth, be specific in your findings. Vague findings produce vague corrective actions. If calibration records show three overdue instruments, say so. Name the instruments. Reference the records. Give the process owner something concrete to work with.
For auditors who want to sharpen their evidence gathering skills, the article on how to gather audit evidence that stands up to scrutiny covers the practical techniques in detail.
Building Your Process Auditing Skills
Process auditing is a skill that improves with practice. The more processes you audit, the better you become at understanding how work actually flows, where controls tend to fail, and how to ask questions that get honest answers rather than rehearsed ones.
Formal training accelerates this development significantly. An internal auditor course that covers the process approach, audit planning, evidence gathering, and finding classification will give you the foundation you need to conduct process audits with confidence. If you are looking to go further and conduct audits on behalf of a certification body or as a lead auditor managing an audit team, a lead auditor course builds on that foundation with more advanced techniques and practical exercises.
At Audit Workshop, our internal auditor and lead auditor courses across ISO 9001, ISO 14001, and ISO 45001 are built around practical auditing skills. The training is delivered by Dilawar Laghari, who has conducted over 500 external certification audits across Australia and internationally. The courses cover process auditing in detail, including how to plan a process audit, how to use turtle diagrams, how to conduct effective interviews, and how to write findings that drive real improvement. If you want to audit processes effectively, not just check documents, our training is designed for exactly that.
You can also explore the article on how to become an ISO internal auditor if you are at the beginning of your auditing journey and want to understand the path ahead.
