Audit a Process Before You Automate It

Map one of your own processes, find the checks that no longer earn their place, and get an honest verdict on whether it is ready to automate.

Act as an experienced internal auditor. I am thinking about automating or adding AI to a process, and I want to audit it properly first so I do not just automate a broken version of it.

The process:
- What the process is: [e.g. "processing supplier invoices", "onboarding a new client", "producing the monthly management report"]
- Who does it today: [roles involved]
- Roughly how often it runs: [e.g. "20 times a week", "once a month"]
- The steps, as best I can describe them: [list every step you can think of, in order, even the small ones]
- What triggers it and what the finished output is: [start and end points]
- Anything that already goes wrong or feels clunky: [e.g. "we rekey the same data twice", "it waits on one person", "or none that I know of"]

Work through it in this order and challenge me where my description is vague:

1. **Map the real process.** Restate the steps in a clean numbered flow. Flag any step where you would expect there to be a hidden sub-step I have not mentioned, and ask me about it.

2. **Risk and controls.** For each step, name the risk it is there to manage and the control that holds that risk in check. Mark each control as either critical (something genuinely bad happens if it fails) or non-critical.

3. **Find the habits.** Identify any checks or steps that look like they survive out of habit: double-checks of something already checked, approvals nobody uses, steps guarding against a problem that may no longer exist. List them as candidates to remove, and say what question I should ask my team to confirm each one is safe to drop.

4. **Find the fragile points.** Highlight where the process is most likely to go wrong, especially manual data entry, judgement calls made under time pressure, and single points of dependency on one person.

5. **Optimise before automating.** Give me the cleaned-up version of the process with the unnecessary checks removed and the fragile points addressed. This is what should be automated, not the original.

6. **Readiness verdict.** Tell me plainly which one applies: (a) ready to automate as optimised, (b) optimise these specific things first, or (c) too unclear to automate yet and needs a deeper look. Justify the verdict.

7. **Data check.** If automation here would put client or financial data through an AI model or third-party tool, tell me what data it would touch and flag anything that should stay inside my own control rather than being sent to an outside service.

Keep it practical and honest. If a step should not be automated at all, say so.