How to Run a Pre-Audit Dry Run in Half a Day (Step-by-Step)

The most useful half-day a management system ever gets is the one where somebody deliberately tries to break it before an auditor does. Not a document review. Not a gap analysis against a checklist. A dry run: someone walks in, asks the questions a surveillance auditor asks, and writes down what actually happens.

I have lost count of the organisations who spend six months tidying documents and still collect findings on the day, because the findings were never going to come from the documents. They come from the gap between what the system says and what the people do. You cannot read that gap off a procedure. You have to go and look.

Why passive document review misses the findings

Reading your own procedures is reassuring, which is exactly the problem. The document was written by someone who understood the process, so it describes the process correctly. Reading it back confirms what you already believe.

An auditor does something different. They pick a real job, a real month, a real person, and follow it end to end. The question is never "do you have a calibration procedure". It is "show me the calibration record for this instrument, and now show me what happened when it came back out of tolerance". That second question is where systems fall over, and no amount of re-reading the procedure surfaces it.

A dry run works because it copies the method rather than the checklist.

The half-day, step by step

Before you start: pick your tracer threads (15 minutes)

Choose three or four real things that happened in the last six months and can be followed all the way through. A customer complaint. A new starter. A piece of equipment that failed. A supplier that let you down. A design change. Write the reference numbers down. These are your threads, and you will pull each one from beginning to end.

Pick recent and slightly awkward. The clean example proves nothing you did not already know.

Hour one: follow the thread, not the clause

Take the first thread and ask, at each step, "what should have happened, and what evidence exists that it did". Follow it across departments. The complaint arrived somewhere, was recorded somewhere, was investigated by someone, resulted in an action, and that action was verified by someone else. Each of those is a handover, and handovers are where evidence goes missing.

Write down what you cannot find within two minutes. If it takes you longer than that in your own organisation, it is not going to appear faster with an auditor watching.

Hour two: talk to the people doing the work

This is the part that gets skipped, and it is the part that finds the most. Ask an operator to describe how they do a task, then compare that with the work instruction. Ask a supervisor what they do when something goes wrong. Ask a recent starter what induction they received.

You are not testing people, and it is worth saying so out loud before you start, or you will get the answer they think you want. You are testing whether the system describes reality.

Hour three: the awkward corners

Go straight to the areas that are quietly weak. In most SMEs that means the same short list: actions raised and never verified as effective, a management review that recorded decisions but not their outcomes, training records for competences nobody has reassessed since induction, and any process that depends on one person who happens to be good at their job.

Check your last external audit findings too. A finding that was closed on paper and has drifted back is a far worse look than a fresh one.

Hour four: write it up as findings, not as a to-do list

Record what you found in the language your system already uses — nonconformity, observation, opportunity for improvement — with the objective evidence attached. A to-do list gets absorbed into everyone's inbox. A finding enters your corrective action process, which is itself a thing the auditor will want to see working.

This has a second benefit. Demonstrating that you found and closed your own problems is a strong signal to an auditor. It shows the system is being used rather than maintained.

What a dry run will not do

It will not make you compliant, and it will not substitute for your internal audit programme — it is a rehearsal, not a replacement. If your internal audits are themselves a paperwork exercise, a dry run will show you that, which is useful, but it will not fix it.

It also will not help if you run it the week before the audit. Findings need time to be corrected and, more importantly, time for the correction to generate evidence that it worked. Six to eight weeks out is about right. Close enough that the picture is current, far enough that you can do something about it.

If you want a second pair of eyes

Half of the value is simply having someone in the room who did not build the system. If that is hard to arrange internally, borrow someone from another department, or another business entirely. I run these across Portsmouth, Southampton and the wider Solent area for organisations preparing for surveillance or Stage 2, and the pattern holds almost everywhere: the findings were always available to be found. Nobody had gone looking in the way an auditor goes looking.