Guide
Keeping origin records audit-ready
Plain steps for a collector or consultant who has to show, for any shipment, where every input came from.
General information, not audit or legal advice. Published .
1. Choose one audit unit
Decide the unit an auditor will ask about, usually the shipment, and tie every origin record to it through one link that never changes.
From our work: the container was the audit unit, tied to the bill of lading, with its assigned collection orders as the traceability link.
2. Capture the record where it happens
Record each collection at the site, on the document the office will file, and get the site's confirmation there. A record retyped later is a second record that can disagree with the first.
From our work: the driver app rendered the same document the office printed and captured the site's signature on the phone, without individual ERP accounts for drivers.
3. Know where every record lives
If records sit in more than one system, such as an old one and a new one, or a spreadsheet beside the ERP, list each one and the dates it covers. The evidence has to cover all of them, with no gap and no overlap at the switch-over.
From our work: the evidence spanned two systems with separate databases, one holding the earlier records and one the later.
4. Set the checks before you build the pack
Write down what must tally, such as counts, weights and links, and the threshold at which you stop. Decide this before generating anything, so the result cannot shape the test.
From our work: before generation, we set reconciliation checkpoints as thresholds for stopping.
5. Check completeness against the source
Count from the source records, not from the pack. A pack that is checked only against itself proves only that it agrees with itself.
From our work: all 12 checks passed, with completeness re-derived from the source databases.
6. Give the auditor read-only access
An auditor who can read and print, but never create or edit, can look at anything without changing it.
From our work: we set up a read-only auditor login that could read and print but never create or edit.
7. File the pack where it is expected
Deliver the pack into the folders the audit will use, named the way the auditor will look for them, ahead of the audit.
From our work: the pack was delivered into the operator's audit record folders.
Questions?
Email info@simplicityideatech.com with the step you are on. A written reply within two working days.
The notes above come from one past project: audit evidence for a certified operator.