Skip to content

SOP-085 — Internal audit (conformance assessment)

Guide

SOP-085 — Internal audit (conformance assessment)

SOP · owner: Quality & Risk. Layer: SOP/Runbook (docs/canon.md). The second-line conformance procedure: assess a process / policy / standard / output set against its stated standard, issue a frank cited verdict, route findings to owners. Q&R assesses; it does not redesign (Process Engineer’s lane).

Interface Contract

  • Inputs: artifact / process / output set for assurance ← from <authoring agent/unit> · trigger: review requested
  • Inputs: cross-cutting risk finding ← from COO · trigger: briefing posted
  • Inputs: binding arbitration call ← from <COO / Principal> · trigger: arbitration decided
  • Outputs: audit findings + verdict → to <owning agent/unit> · trigger: review passed
  • Outputs: approved audit report → to Archivist · trigger: artifact approved
  • Handoff trigger (in): an owner hands a process/output for independent conformance assessment, or a cross-cutting finding is routed to Q&R
  • Handoff trigger (out): the verdict (Pass / Pass with conditions / Does not pass) and cited findings are issued to the owner who can act on them
  • Definition of Done before handoff:
    • [ ] Stated standard named (SOP / policy / rule / quality bar); if none exists, that absence is logged as a finding
    • [ ] Every finding cites a specific artifact / line / rule and carries a severity (Critical / High / Medium / Low)
    • [ ] A single verdict issued — Pass / Pass with conditions / Does not pass — not a list of considerations
    • [ ] Findings routed to owners (proposals, not directives); open findings logged to the control-gap registry (SOP-086)
    • [ ] Report handed to the Archivist (artifact approved); 0 drift
    • [ ] Learnings captured to docs/knowledge/ if any

Purpose

Give the org independent evidence that a stated process or standard is actually followed — not self-attested. Keep the gap between stated and actual visible, owned, and closing. This is the core second-line act.

When to use

  • A wave / artifact set is handed in for the four-test sample (run SOP-087 as the sampling sub-procedure; this SOP is the audit wrapper).
  • A standing audit fires per reports/audit-schedule.md (policy conformance, control-gap follow-up, “are we following our SOPs”).
  • A control failure is suspected and needs a frank, cited verdict.
  • A cross-cutting risk is routed from the COO log and needs assessment + logging.

Flow

flowchart LR
  A["1. Define scope<br/>+ name the standard"] --> B["2. Gather evidence<br/>(read; don't self-report)"]
  B --> C["3. Assess conformance<br/>per criterion"]
  C --> D["4. Rate severity<br/>C/H/M/L"]
  D --> E["5. Verdict<br/>Pass / w-conditions / Does not pass"]
  E --> F["6. Route to owners<br/>(proposals) + log gaps"]
  F --> G["7. Hand to Archivist<br/>'artifact approved'"]
  classDef s fill:#1d4ed8,color:#fff,stroke:#1e3a8a
  class A,B,C,D,E,F,G s

Text fallback: define the scope and name the stated standard → gather evidence by reading the artifacts (never self-reporting) → assess each criterion (Conforms / Partially / Does not conform) with cited evidence → rate each finding’s severity → issue one verdict → route findings to the owners who can act on them and log open gaps to the control-gap registry → hand the report to the Archivist.

Steps

  1. Define scope and criteria. Name the process / policy / standard / output set. Name the stated standard it is assessed against (an SOP ID, a policy, a Golden Rule, the four-test bar). If no stated standard exists, that is itself a finding.
  2. Gather evidence. Read the standard, the actual outputs, process records, agent definitions, commit history, archive entries. Use Grep/Glob to surface all relevant files. Do not rely on self-reporting — open the artifact yourself.
  3. Assess conformance. For each criterion: Conforms / Partially conforms / Does not conform, each with specific citable evidence (file:line, artifact, rule ID). Name the gap precisely; do not hedge a finding into “an area for improvement.”
  4. Rate severity. Each finding: Critical (blocking; remediate before the next gate) · High (next sprint) · Medium (this quarter) · Low (opportunistic).
  5. Draft the report. Structure: (a) scope + criteria, (b) method, © findings by area with severity, (d) one verdict — Pass / Pass with conditions / Does not pass, (e) prioritized recommendations with named owners.
  6. Route findings to owners. Findings go to the people who can act: process design → Process Engineer; delivery → PMO; rules → Golden Rule; HR policy/defs → HR; archive conformance → Archivist. Findings are proposals, not directives (independence). Emit review passed with the verdict. Log open findings to the control-gap registry (SOP-086).
  7. Archive. Hand the final report to the Archivist (artifact approved); confirm 0 drift.
  8. Track remediation. Follow up open findings at the next audit cycle or the agreed date (reports/audit-schedule.md).

Roles / approvers

  • Q&R Director runs the audit and issues the verdict (sole reviewer; independent).
  • Owning Lead(s) act on findings (remediate); Q&R does not edit their artifacts.
  • Principal / COO is escalated only when a Critical finding is unaddressed by the owner after a reasonable window, or when a finding implicates the Principal’s own decision (JD Reporting).

Guardrails

  • Cite or it is not a finding. A finding without a specific artifact / line / rule is an opinion (charter Operating rule 3).
  • One verdict, three values. Pass · Pass with conditions · Does not pass — never a list of considerations with no conclusion.
  • Do not redesign. Q&R identifies a process is broken or absent; Process Engineer fixes it. Hand findings back as proposals (charter boundary).
  • Do not run the archive sweep (archive-manifest.sh) — audit whether it is run; the Archivist runs it.
  • Stay in lane — security/privacy → Security (Principal until seated); strategic → Innovation/CPTO; delivery plan → PMO. Route, don’t absorb.
  • No self-attestation closes a phase (R11). Director approval is recorded but is not an independence proof; the Q&R sample (SOP-087) + the scripted gate are the proofs.
  • Links to canon, never restates it (CONTRIBUTING.md).

See also: docs/units/quality-risk/charter.md · SOP-086 (risk register) · SOP-087 (four-test sample) · master plan §1.3/§7/§9 · interface-contract-spec.md §3.1 · docs/handoff-triggers.md.