audit-checklist.md
What we collect and ask during every audit.
- Tool inventory: every SaaS system involved, who owns admin access, which have APIs
- Process walkthroughs: sessions with the people who actually run the process, not their manager
- Volume and frequency per process: items per day or week, peak periods
- Error and rework rates: how often things go wrong, and the usual causes
- Time accounting: who does the work today, and how many hours per week it takes
- Exception patterns: every edge case and how it’s handled today
- Access and security constraints: SSO, API keys, data-handling rules, anything off-limits
- Success metric definitions: the baseline numbers we’ll re-measure after handover