A regulated business can pass every audit it faces, whether that is an ASQA audit, an NDIS audit, an aged care quality assessment or an ISO 9001 surveillance visit, while nobody in it has a reliable view of how the work actually runs. Those are separate things, achieved by separate means, measured by separate people.
Conflating them is one of the more expensive assumptions in regulated sectors, because it produces a business that feels well governed right up until something moves.
Does passing an audit mean a business is well run?
No. A passed audit shows that the required records exist and met the standard on the day they were tested. It does not show that the work follows those records, which is a separate question that nobody in the assurance cycle is asked to answer.
What an audit actually tests
An audit tests whether required records exist, in the required form, for the required period. That is a real and necessary bar. It is not a statement about how the business operates.
The design of the audit itself explains why. An NDIS verification audit, used for lower-risk providers, is a desktop review of the documentary evidence the provider supplies. An ISO 9001 surveillance audit samples part of the management system rather than all of it. Neither is a fault in the auditor. Each is built to test the record. Each does so efficiently.
A clean audit tells you the record-keeping obligation was met. It does not tell you:
- Whether the recorded process is the one people follow
- Whether the same information is being captured twice in two places
- Whether anyone could answer an operational question without assembling it by hand
- Whether the business would notice a problem before a customer did
Those are operational control questions. Nobody is asking them, because the body that asks questions is asking about compliance.
How the gap opens
It rarely opens deliberately. The usual sequence runs like this.
- A system is selected primarily to satisfy a regulatory requirement.
- It does that job adequately, so nobody revisits it.
- The work itself grows more complicated than the system was configured for.
- People build the difference themselves, in spreadsheets, message threads and personal knowledge.
- The sanctioned system continues to satisfy the auditor while the business runs on the workarounds.
At no point does anyone make a bad decision. Each step is reasonable given the step before it.
What it looks like in your sector
The pattern is the same across very different regimes. These are illustrative composites rather than client stories, grouped by the kind of audit the business faces.
- Training and education (an ASQA audit). Student files, assessment evidence and trainer credentials all stand up to sampling. Meanwhile enrolments, scheduling and trainer allocation run through a spreadsheet one coordinator owns. Nobody can say how many students are behind on placement hours without asking the person who owns it.
- Care and disability services (an NDIS audit or an aged care quality assessment). The incident register, worker screening and service agreements are complete on the day. Shift changes and participant updates live in a group chat, so the record shows what was planned rather than what was delivered. Childcare and allied health services run the same pattern against their own standards.
- Quality and manufacturing (ISO 9001, HACCP). Corrective action logs close on time. The checks that actually catch problems happen on a whiteboard at the line and get typed up before the surveillance visit.
- Transport and logistics (heavy vehicle accreditation and Chain of Responsibility). Fatigue and maintenance records are in order. How loads and schedules are really set is decided by phone between a dispatcher and a driver.
- Financial services (an adviser file audit). Client files are complete and the file review passes. Follow-up on those clients is tracked in individual inboxes.
Different regulator, same shape. The system satisfies the audit. The work runs somewhere else. Growth widens it. Six signals your operating model has fallen behind covers how to spot it early.
The tell
The question that surfaces this quickly is not about systems. It is: where do people actually look when they need to know something?
If the answer is a spreadsheet somebody maintains, a message thread or a particular person, then the sanctioned system is a compliance artefact rather than an operating one. That is worth knowing, because the business is carrying the cost of both.
The second tell is what happens when that particular person is away. In a business with operational control, the answer is a mild inconvenience. In a business without it, the answer is that certain things simply wait.
What it costs
Two distinct costs, on different timescales.
The running cost is duplication. The same information captured twice, reconciled by hand, with a permanent low-grade tax on everyone touching it. That is measurable and it is usually larger than expected.
The exposure is that the record and the reality have drifted apart. An audit examines the record. An incident examines the reality. A business can be entirely compliant on paper while carrying operational risk nobody has visibility of, which is precisely the combination that produces unpleasant surprises.
Audits can miss the gap too. In 2017 ASIC published Report 515, which re-reviewed 160 client files that large financial advice licensees had already audited. In 25 per cent of them the licensee's auditors found no areas of non-compliance and ASIC's reviewers found some. The audit process was fully effective in 18 per cent. That was one regime and one sample, but it shows what a passed audit can and cannot be relied on to prove.
For owners and directors the exposure can be personal. Under the Heavy Vehicle National Law an executive of a company with a safety duty must exercise due diligence to make sure the company meets it. Due diligence includes ensuring the business has and uses the resources and processes needed to manage those risks. A clean audit file does not verify that.
The upside sitting beside it
This is not only a risk story, which is how it usually gets told in regulated sectors.
When the compliance record and the working record become the same record, an entire category of duplicate effort disappears. The capacity released is generally already funded, already staffed and immediately available. It needs no procurement.
There is a second gain that gets overlooked. A business whose operating record is trustworthy can answer questions about itself quickly, which changes what it can commit to. Being able to say yes to something with confidence is a commercial capability, not an administrative one.
That shows up in tenders, in funding conversations and in due diligence. An organisation that can produce a clear operational picture on request is treated differently from one that needs three weeks to assemble it, regardless of which is actually better run. The record becomes part of how the business is valued.
How to measure the gap yourself
The distance between your record and your reality can be established in an afternoon, with no external help and no project. Start with three questions you can answer today.
- The trace test. Take one recent case, order or client from end to end. Count every place the same fact was entered. Three or more means you are running parallel records, whatever the system diagram says.
- The three-people test. Ask three people in different roles where they look for the current position on something. Compare the answers. If they differ, the sanctioned system is not the operating record.
- The outage test. Ask what would happen if the sanctioned system were unavailable for a day. If the honest answer is "not much", that is the finding.
| Where to look | What to pull | The calculation | What it tells you |
|---|---|---|---|
| The sanctioned system | Logins per user per week, records created per user | Weekly active users ÷ licensed users | Whether it is an operating system or an audit artefact |
| Microsoft 365 and Entra | Spreadsheets updated in the last thirty days that hold operational data | A count, by function | The shadow system, sized |
| Teams channels | Where operational decisions get made and never recorded elsewhere | A count of decisions with no system record | Where the real coordination lives |
| Audit or incident history | Findings raised, against issues the business had already spotted internally | Self-identified ÷ total findings | Whether you find things before an auditor does |
| Any recent audit | Hours spent assembling evidence for it | Assurance hours ÷ 12 months | The cost of the gap, already paid, usually by someone senior |
These are standing metrics with alert thresholds rather than a one-off exercise.
The one number to track
- Hours spent assembling assurance in the last twelve months. Audit preparation, board packs, funder questions, tender responses
Assurance hours ÷ senior FTEgives you the share of your most expensive time spent proving things rather than running them- If it runs to weeks of senior time, that is the running cost of the record and the reality being different things
The control worth introducing
- One system is the operating record for each function. Written down and agreed
- Then measure how often people go somewhere else for the answer
- A system nobody consults is a cost with a licence attached
Where your number will mislead you
- Assurance hours are almost never booked as such, so the first figure you produce will be too low. Ask the people who did the work rather than reading a timesheet
- A clean audit history can mean strong control. It can equally mean an auditor looking at a record that no longer describes the business
- The outage test flatters any system that is genuinely only needed monthly. Run it against a system used daily
Where do your people actually look?
Not which system you are supposed to use. Where somebody goes when they genuinely need to know the current position on something.
If the honest answer is a spreadsheet, a message thread or a particular person, then you are carrying the cost of two systems while getting operational control from neither. That is worth knowing before an auditor, a funder or an incident asks the question for you.
The Free Health Check scores governance, risk and systems in about three minutes. If you want to know how far your record and your reality have drifted apart, a diagnostic is designed to find exactly that.