How Do You Conduct an Operational Audit of a Small Service Business?

The steps from scope to report

The GAO standards call scope “the boundary of the audit,” covering “the necessary documents or records, the period of time reviewed, and the locations that will be included.” For an owner-led company it fits in one paragraph, written before anyone pulls an export. Then the steps run in order:

• 1. Write the question and the scope: one question about money, such as where inquiries and finished jobs stall before they become cash, plus the period, the crews or locations, the systems, and what is out.
• 2. Write what should happen at each step: calls returned the same business day, quotes followed up within a set number of days, invoices out within a set number of days of completion. The GAO standards call these criteria, “the required or desired state or expectation.” A step with no rule is already a finding.
• 3. Pull the exports for the period.
• 4. Trace 20 to 30 recent jobs end to end, including a few that went badly, recording each date, who acted and in which tool.
• 5. Count the whole period: inquiries against replies, quotes against follow-ups, completed jobs and their change orders against invoices, invoices against payments. Each match is covered step by step in the guide to revenue leakage.
• 6. Take a snapshot of what is waiting at each step today, as the next section describes.
• 7. Talk briefly with the people who do the work, to explain what the records show. A conversation can say why a step waits; it is not the evidence that it does.
• 8. Write the findings, price each one, give each fix an owner, and put the fixes in order.
• 9. Read the report with the person who decides, and set the first weekly check before the meeting ends.

The EPA’s Lean toolkit says the power of value stream mapping, a process-mapping method, “lies in walking the plant floor, talking to workers, and closely observing how a product is actually made from start to finish.” In a service business, the trace in step 4 is the walk, and the floor is the call log, the job board and the invoice history.

How to find the bottlenecks: where work waits and who owns each step

A bottleneck in a service business is a pile: work that has finished one step and not started the next. The trace shows the days between steps for each sampled job, and the longest gaps point at the hand-off to look at. A snapshot shows how big each pile is now.

Next to each pile, write the name of the person who owns it: not a department, not “the office,” not “whoever is free.” If the honest answer is the owner of the company, write that down too; a step that waits for the owner’s approval is a pile with the busiest person in the building at its front. A step with no name, or with two, is a finding of its own.

For the snapshot, pick one day and count each pile, with the age of its oldest item:

• Inquiries with no reply yet.
• Quotes sent with no follow-up date, and quotes past their follow-up date.
• Signed jobs not yet scheduled.
• Finished jobs not yet invoiced.
• Invoices past their terms, and short-pays with no dispute on file.

A rough rule turns each pile into time: the number waiting, divided by the number arriving in a typical week, is about how many weeks each item waits. Illustrative example, with hypothetical numbers: a company counts 46 quotes with no follow-up date, the oldest 38 days old, and it sends about 15 quotes a week, so the pile holds roughly three weeks of work with nobody’s name on it. The first bottleneck is where a large, old pile meets a step nobody owns, and the guide to business process improvement covers fixing that one process by hand.

What the report looks like: findings in dollars, an owner, an order of work

A useful report is short. It opens with a one-page summary that ranks the findings by dollars, then the findings, then the order of work: a large leak with a cheap fix goes first, and anything that needs new staff or new software goes last. It closes with what the audit did not check and where the records were thin, which the GAO standards ask auditors to describe so that readers are not misled. The site publishes a worked sample of the report, built on an invented company.

Each finding follows the four elements in the GAO standards: criteria, which is the rule; condition, which “is a situation that exists”; cause, “the factor or factors responsible for the difference between the condition and the criteria”; and effect, the consequence. The standards ask auditors to “relate the instances identified to the population or the number of cases examined and quantify the results in terms of dollar value or other measures.” A small company adds the fix and its owner, and GAO calls recommendations effective when they are “addressed to parties with the authority to act.” One finding then reads in seven lines:

• Expected: the rule for this step.
• Found: what the records show, as a count out of the cases examined.
• Why: the cause, from the trace and the conversations.
• What it costs: dollars per month or per year, with the arithmetic shown.
• The fix: one action, written as a rule.
• Owner: one named person with the authority to make the change.
• How we will know: the weekly number that should move, and when it gets counted again.

Illustrative example, with hypothetical numbers. Expected: every new caller answered or called back the same business day. Found: of 410 new-caller calls in the quarter, 63 went to voicemail, and 22 of those have no callback recorded. Why: after 4 p.m., calls roll to a voicemail box nobody is assigned to check. What it costs: answered new callers booked about one time in four, at an average first job of $650, so 22 unreturned calls come to about $3,575 for the quarter, or roughly $14,300 a year if the quarter was ordinary. The fix: every message returned by 10 a.m. the next business day and logged. Owner: the customer service lead, by name. How we will know: each Friday, voicemails against logged callbacks.

How long it takes, and in-house or an outside reviewer

The calendar depends less on headcount than on the records: how many systems hold them, whether each one exports cleanly, and how many locations are in scope. With one office and three or four systems, plan an in-house audit as a few weeks of part-time work: a week to scope and pull the exports, one to two weeks to trace and count, and a few days to write and read out the report. That is a plan, not a benchmark; a system nobody has the login for adds time.

In-house works when one person can get every export, has the hours, and is not counting a step they run. The GAO standards name threats to an auditor’s independence, among them the self-interest threat, that “a financial or other interest will inappropriately influence an auditor’s judgment or behavior,” and the familiarity threat, where a close or long relationship leads to “a position that is not objective.” An office manager counting their own invoice delays has a stake in the answer, and one counting a longtime colleague’s has a relationship to protect, so swap the counting.

An outside reviewer is worth paying for when the records sit in systems nobody inside can export, the team disagrees about where work waits, the owner’s own approvals are part of the delay, or nobody has the hours. Ask for read-only access, the method in writing before work starts, a dollar figure and an owner on every finding, and a report the company keeps.

What should happen in the 30 days after the report

The 30 days after the report decide whether the findings become rules people follow.

• Days 1 to 5: each finding gets its owner’s agreement, a start date and one weekly number. Start the first one to three fixes from the top of the order, no more, each written as a rule: who does what, by when, and where it is recorded.
• Weeks 2 to 4: run each fix by hand. On the same day every week, each owner reads their number aloud: how many items are waiting and how old the oldest one is. The Friday Ledger is a one-page sheet built for this kind of count.
• Day 30: count each fixed step again over the last four weeks, against the same length of time from the audit period. If the number moved, the next fix starts. If it did not, the cause in the finding was wrong, and the trace goes back on the table.
• Throughout: no new software in the first month. A tool can carry a rule once the rule holds by hand, such as a required field or an alert when a quote passes its follow-up date; AI can be one of those tools later, at a step that already works.

Run the same counts again in a quarter. The second run should be shorter, because the exports, the rules and the owners already exist.

When not to run one, and where the Review fits

Skip the full audit when one problem is obvious and one person can fix it this month. Skip it in a cash crisis, when every hour belongs to collecting what is already owed. And if calls, quotes and jobs are recorded nowhere, start recording them first; an audit before that is a guess.

The Revenue Review is this method run from outside: two weeks, read-only access to the company’s own records, and up to three short team interviews. It ends in a written report with every leak priced and the fixes ranked, plus a 90-day plan, both the company’s to keep. The next step is a free 20-minute call, where we say whether the in-house version above is enough, which it may well be.