Most compliance audits concentrate on whether an organisation is following its documented procedures. Policies are reviewed, records are sampled, controls are tested and findings are recorded. This is essential work, but it can leave an important question unanswered: what happens when employees repeatedly have to work around the rules to get the job done?
A process might appear compliant on paper while relying on a steady stream of informal exceptions in practice. A manager approves an urgent purchase outside the normal system. A customer verification step is completed retrospectively. A member of staff uses a shared login because the correct access has not been granted. Each incident may have an understandable explanation, but together they can reveal a control environment that is not working as intended.
The Information Hidden in Exceptions
Exceptions are often treated as administrative inconveniences rather than valuable audit evidence. If the required paperwork is eventually completed and the immediate problem is resolved, the underlying issue may never receive further attention.
However, repeated exceptions can indicate that a procedure is impractical, a system is poorly configured or staff have been given conflicting priorities. Employees may be expected to meet demanding turnaround times while also following approval processes that make those targets difficult to achieve.
A useful compliance audit should therefore examine not only whether exceptions were authorised, but also why they occurred. Are the same departments requesting retrospective approvals? Do particular transactions repeatedly bypass the usual checks? Are certain controls being overridden by the same roles?
These patterns can be more revealing than an isolated procedural failure.
Sampling the Workarounds, Not Just the Paperwork
Traditional audit sampling often focuses on completed transactions and the evidence attached to them. A more investigative approach looks at the journey each transaction took, including changes, overrides, rejected approvals and subsequent corrections.
For example, an audit of purchasing controls might compare purchase orders with invoice dates, approval timestamps and changes to supplier details. The objective is not simply to find missing documents. It is to establish whether the control operated at the right point in the process and whether the organisation can demonstrate that decisions were properly authorised.
The same principle applies to data protection, financial controls, customer onboarding and employee access management. Audit trails can show what happened, but interviews with the people doing the work often explain why it happened.
Combining the two creates a clearer picture of whether a control is genuinely effective or merely producing the appearance of compliance.
Turning Findings into Better Controls
An audit finding has limited value if the response consists solely of reminding employees to follow the existing procedure. Where workarounds are widespread, the organisation needs to investigate whether the process itself requires redesign.
That might mean introducing clearer approval thresholds, improving system permissions, removing unnecessary duplication or creating a formal route for urgent decisions. In some cases, stronger supervision or additional training will be appropriate. In others, the control needs to be changed so that the compliant route is also the practical one.
Auditors should also distinguish between deliberate circumvention, genuine mistakes and systemic weaknesses. Treating every exception as misconduct can discourage staff from reporting problems, making the organisation less able to identify emerging risks.
A well-designed compliance audit does more than confirm that policies exist and records are complete. It tests whether controls work in the conditions employees actually face, identifies the reasons they are being bypassed and helps management address the causes rather than the symptoms.
Sometimes, the most important audit finding is not that someone broke the rules. It is that the business has quietly developed a way of working in which following the rules has become the exception.
Photo by Kelly Sikkema.
