Internal Process Audits for Property Teams
A property process audit tests whether work is actually done the way it is written. How to plan, sample and close findings so the exercise changes something.
Ask a property team whether work orders are closed with evidence and the answer will be yes. Pull ten closed work orders and count — a different activity, and usually a different answer, because two were closed with a phone call and one was closed by the contractor in the parking lot.
A property process audit is that act of pulling the ten records. It tests whether the work is done the way the written process says it is done, using evidence rather than recollection, on a sample you chose in advance. Done properly it is the cheapest quality lever a portfolio has; done badly it is a morning of theatre everyone learns to game.
Key takeaways
- A process audit tests compliance with a defined process using sampled records; an inspection tests condition, and the two answer different questions.
- Publish the test and the pass condition before anyone is sampled, then report themes rather than individuals.
- Cross-site auditing beats self-auditing, because the person who owns a step cannot credibly verify it.
- Findings need a classification, an owner, a date and a named verification method, or the same finding returns next quarter.
- One process audited well per quarter is worth more than twelve glanced at.
What is a property process audit?
It is a structured check that a documented process is followed, evidenced at the point of work, and producing the outcome it claims. It is internal, it uses your own standards, and its output is a short list of verified gaps.
Four activities get confused. An inspection records the condition of a building or the standard of cleaning. A process audit tests whether a procedure was executed and recorded. A compliance audit tests against external statute or certification. A vendor audit applies either to a contractor's work. The evidence differs, so they should not share a template: an inspection produces a score and photographs, an audit produces a sampled list, a result per item and a findings log. Where the programme sits in the operating model is covered in property management operations.
Why do self-audits turn into theatre?
Because the questions are written so the answer is yes, the sample is chosen by the auditee, and findings have no route to closure. Each is a design choice, and each is fixable.
The familiar pattern: a template arrives, someone fills it in from memory in twenty minutes, every answer is yes, and the cover sheet says compliant. Nothing was sampled and nothing changed, so next year produces the same result. The IIA's Global Internal Audit Standards set out the independence and evidence expectations behind internal audit, and they scale down to a portfolio: no marking your own work, and conclusions resting on something a third party can inspect.
What should you audit, and what should you leave alone?
Audit one to three processes per quarter, chosen for risk and for how easy the evidence is to retrieve. Leave anything technical to the professionals licensed for it.
- Work order closure: evidence attached, correct category, closure authority observed
- Inspection cadence: scheduled visits completed, scored and reported on time
- Key and access control: issue, return and reconciliation records
- Vendor document currency: insurance certificates, licences, clearance letters
- Incident and near-miss follow-up: actions raised, owners assigned, dates met
- Seasonal readiness: winter and summer checklists completed before the deadline
- Capital plan updates: findings entered with cost, photo and date
How those processes are documented in the first place is covered in writing SOPs for building operations.
Scope note: Auditing a fire system, an electrical installation, a pressure vessel or a structural repair requires a licensed professional. The process audit can confirm that a certificate exists and is current; it cannot confirm the engineering behind it.
How do you write an audit test?
Write each test as a question, a piece of evidence, a sample size and a pass condition. If you cannot state the pass condition in one sentence, the test is not ready.
| Process | Test question | Evidence | Sample | Pass condition |
|---|---|---|---|---|
| Work order closure | Was closure evidenced at completion? | Photo, note or signed sheet | 15 random closures | 100% carry evidence, 95% within SLA |
| Inspection cadence | Were scheduled inspections done and reported? | Dated reports | Last 3 months | 90% of scheduled visits evidenced |
| Key control | Do issued keys reconcile to the register? | Register and signature log | All fobs and keys | Zero unreconciled items |
| Vendor documents | Is every active vendor compliant today? | Certificate register | All active vendors | Zero expired certificates |
| Incident follow-up | Did each incident produce an owned action? | Incident log and tracker | All incidents in period | Every action has owner and date |
"Is the process followed" cannot be audited. "Does every closure record carry a photograph taken on site" can, and it produces a number you can act on.
How do you sample records credibly?
Draw the sample from the system, not from the auditee's suggestions, record every item selected, and keep the list. The credibility of the exercise rests on that list.
- Export the full population for the period, then select at random — not the first ten
- Record every selection, including those that passed, with the evidence seen
- Never substitute a record because the chosen one was unavailable; that is a finding
- Keep a copy of each artefact inspected, or a screenshot with a timestamp
- State the sample size and the population size in the report
Fifteen items is a practical default for a stable, low-risk process. If the first five fail, stop and treat the whole process as failing; widen the sample only to quantify.
Who should audit whom?
Pair sites so the auditor does not own the process under test, and rotate the pairing each cycle. Independence is what separates an audit from a self-assessment.
The workable patterns are simple: the property manager audits a neighbouring site, the regional manager audits the manager, and the operator audits a process they do not perform. In a small portfolio a peer swap is enough, provided the test is defined in advance and results go to the same place for everyone.
Auditing your own site is a review — useful, but not evidence of assurance.
What do you do with findings?
Every finding gets a classification, an owner, a due date and a verification method, then gets tracked to closure in one list.
Classify by consequence: major where the process has effectively stopped or a safety obligation is unsubstantiated, minor where it is done but not evidenced, and observation where it works but is fragile. Major findings get an action within five working days, minors within the quarter, observations at the next review.
The verification method matters more than the due date. "Evidence to be re-tested at next quarter's audit" is a verification method; "actioned" is not. Where a finding repeats from an earlier cycle, escalate it to the portfolio manager and cite the earlier reference.
How do you keep it from becoming a blame exercise?
Publish the test, sampling method and pass condition before the audit, then report themes. Process audits work when the team believes results will be used to fix the system.
Three habits carry this. Agree the tests at the start of the cycle, so nobody is measured against a rule invented that morning. Report results as counts and themes — "closure evidence was missing on 4 of 15 sampled orders, all from one vendor" — which points at a fix rather than a person. And close the loop loudly: when a finding produces a change, say what changed, because that is what makes the next audit welcome.
A team that hides records will beat a bad auditor every time; the remedy is a track record of findings turning into fixes.
What evidence should the audit itself leave?
An audit needs its own file: the test sheet, the sample list, evidence copies, the findings log, closure evidence and a one-page report. Without that file it is an anecdote.
Keep the file as long as you keep inspection records, and put the report in front of the owner quarterly with three numbers: audits completed against plan, findings by classification, and findings closed on time. Trends across those three show whether the programme works — the same logic as auditing the inspection programme itself.
Illustrative audit cycle
The calendar below shows sequencing, not a standard; build yours around your reporting rhythm.
| Week | Activity | Output |
|---|---|---|
| 1 | Agree two processes and write the tests | Signed test sheet per process |
| 2–3 | Export populations and draw samples | Sample lists with dates |
| 4 | Fieldwork and evidence collection | Completed test sheets, artefacts |
| 5 | Classify findings and assign owners | Findings log with dates |
| 6 | Report to the portfolio manager, publish themes | One-page report |
| 7–12 | Remediation and verification | Closure evidence per finding |
Two processes a quarter gives eight audits a year, enough to cover the main operational risks without consuming a manager's month. Chasing twelve produces twelve shallow tests and no closures.
Frequently asked questions
What is the difference between a process audit and an inspection?
An inspection records the condition of a building, area or standard at a point in time. A process audit tests whether a defined procedure was carried out and evidenced. Both use samples and produce findings, but only the audit tells you whether your system works as written.
Should managers audit their own buildings?
They can review them, but that is not an audit. For assurance, pair sites so the auditor does not own the process under test, and rotate the pairing so nobody audits the same site twice running.
How large should an audit sample be?
Fifteen records is a practical default for a stable process, with the population size stated in the report. If early items fail repeatedly, stop and treat the process as failing rather than expanding the sample until the result improves.
How do I stop repeat findings?
Give every finding a verification method as well as a due date, escalate repeats to the portfolio manager with the earlier reference, and treat a repeat as a sign the process needs changing rather than the person.
Do I need software to run internal audits?
No, but you need a record that survives staff changes. A shared findings log works at small scale; once you run several sites and multiple cycles, a tool that keeps dated evidence saves more time than it costs. That is also the condition for continuous improvement in facilities operations.
Where the audit earns its keep
A process audit is a small, disciplined habit: pick a process, write the test, sample the records, log findings, verify closure. It costs a few days a quarter and produces the one thing an owner cannot get from a good story — evidence that the system works.
NeatScore supports the evidence side: define the checklists your processes depend on, inspect against them with photos per item, keep dated records per site and report consistently across a portfolio. Inspections run offline and sync when you reconnect, so the record exists even where there is no signal. Try it free for 14 days, or see pricing.
Not a substitute for regulated audit. Statutory audits, fire system verification, regulated maintenance and financial audit fall outside a property team's internal scope. Confirm any external obligation with your provincial regulator and your auditor before relying on an internal result.
