For the auditor
You need to know what was done, by whom, and whether the record can be trusted.
| Who this is for | You are the person who has to establish what happened, by whom, and whether the record of it can be relied on. |
| What you need | Read access to the record; no administrative rights. |
| What you will not find | A certification. A standard certifies your organisation's management system, not a vendor's product. What this record gives you is the evidence your own management system requires. |
Your first task: establish which properties of the record hold by construction and which do not, before you read a single trail. Reading a trail without that distinction is how a trail gets overstated.
The walk, in order
| Go here | Because |
|---|---|
| What the record guarantees | Which properties hold by construction, and which of the three kinds of record carries which strength. Reading the trail without this distinction is how a trail gets overstated. |
| Where the evidence lives | What is written down, which files are only views over it, and what you can read with ordinary database tooling. |
| Tracing one change backward | The walk-through to run in the room, from a merged change back to the decision, the order and the cost. |
| Checks you can run yourself | The verifications that do not depend on trusting the machine that produced the record — and the two ceremonies a human performs by hand. |
| What this does not prove | The limits, stated as limits. Start here instead if your job is to find the gap rather than to confirm the story. |
If a framework is driving your questions
The questions a framework makes an auditor ask takes each framework down to the handful of concrete questions somebody has to answer with an artefact, and says which artefact answers each one — including the ones where the honest answer is to ask for it by name.
Two things you will need from elsewhere
| Go here | Because |
|---|---|
| Who the actors are | How a person or a machine is identified, and what that identification is worth. The actor name on a decision is only as good as the enrolment behind it. |
| What the record is called | The vocabulary the record uses. Reading it without this section is guessing. |
The limits you should establish early
- The product certifies nothing. A standard certifies your management system; what this gives you is evidence your own system requires.
- Some checks depend on trusting the machine that produced the record, and some do not. Checks you can run yourself separates them, and names the two ceremonies a human performs by hand.
- Where a guarantee has not been measured on your platform, the page says so rather than generalising from another one.
One thing to settle before the audit, not during it
Agree with your operator which query or which surface produces your period evidence. The record is complete enough to produce it and it lives in a store you control, but the artefact your working papers accept is something to define once, in advance, rather than to discover in the room.