Operations audit checklist that maps workflows, records and archives

What an operations audit checklist should cover

An operations audit should trace each core workflow from the trigger that starts it to the outcome that ends it, then test capacity, controls, systems, vendors and the metrics leadership uses to run the work. The step most checklists skip is the record each workflow leaves behind: which system holds it, how many years of it survive and who can export it.

For a fractional COO that is one extra column on a workflow map you are drawing anyway. It answers three questions at once: whether the company can survive a system change without losing history, whether it keeps what its own policies say it keeps, and whether its operational records run deep enough to support a data license with AI developers through SourceX.

How to run the audit in a fractional engagement

1. Agree scope with the CEO. Pick the five to eight workflows that carry the business, such as quote-to-cash, procure-to-pay, order-to-delivery, ticket-to-resolution, project delivery and hire-to-retire.
2. Interview each process owner. Ask them to walk through the last real example, not the documented version.
3. Watch the work in the systems. Sit with the people doing it while they share screens. You are observing, not exporting.
4. Map each workflow with a records column. For every step, note the system of record, the earliest year of complete history and who holds admin rights.
5. Score and rank the findings. Work through the checklist below, then rank fixes by impact and effort.
6. Deliver the readout. Present findings to the CEO and leadership team with an owner and a date for each fix.

Owners who want a lighter annual version can use the business health check template, which asks a shorter set of the same records questions.

The operations audit checklist

Workflows and ownership

• Each core workflow has a named owner who can describe it end to end.
• The documented process matches what people actually do, checked against a recent real case.
• Handoffs between teams have a defined trigger and a defined output.
• Exceptions and escalations follow a written path rather than one person everyone calls.

Capacity and quality

• Cycle time is measured for each core workflow, not estimated.
• Rework, error and complaint rates are tracked and reviewed at least monthly.
• Bottleneck roles are known, and cross-training covers each one.

Controls and approvals

• Approval limits for spend, discounts and refunds are written down and enforced in the system.
• Segregation of duties exists for payments, payroll changes and vendor setup.
• Access to core systems is reviewed when people join, move or leave.

Systems and integrations

• A current list of every system in use exists, with an owner and a renewal date for each.
• Integrations are documented, including manual re-keying between systems.
• Spreadsheets that run critical steps are identified and backed up.

Vendors and outsourced work

• Critical vendors have contracts on file with service levels and exit terms.
• Work done by outsourcers or contractors is identified, along with who owns the output.

Metrics and cadence

• Leadership reviews a short weekly scorecard, and each metric has an owner.
• Targets are set from historical data rather than guesswork.

Records and archives

• For each core workflow, the system of record is named: CRM, ERP, helpdesk, project tool, shared drive, email, Slack or Teams.
• The earliest year of continuous history is recorded for each system.
• Retired platforms, such as the old ERP, the previous helpdesk or a former file server, still exist and someone can log in.
• Each SaaS renewal or cancellation date is checked for whether ending the subscription would delete history, and exports are scheduled before that date.
• Records created by contractors, agencies or clients are flagged separately from records employees created.
• Customer contracts and the privacy policy are checked for promises about how customer data may be used.
• Call recordings are matched to the notices callers and staff were given.
• The person who could authorize a decision about company records is named: owner, CEO, CFO or another authorized representative.

Who owns records that contractors or clients created?

Ownership is the line most likely to change the answer. Work an employee prepares within the scope of employment is generally a work made for hire owned by the employer, while commissioned work from an independent contractor qualifies only in listed categories and with a signed written agreement, as the Copyright Office explains in Circular 30 on works made for hire. SOPs, code or reports written by contractors may therefore need an assignment before the company could license them.

Client-owned material is a separate problem. Agencies and outsourcers often work inside their clients' systems or hold data under client contracts; the explainer on who owns CRM and campaign data walks through that split. This is general information, not legal, tax or financial advice. The company's own counsel should confirm ownership before any licensing discussion.

How to read the results

Untidy history is not automatically worthless. The question of whether messy company data is still worth licensing explains why buyers often weigh outcomes and context above neat formatting.

Red flags to record in the readout

• Archives were deleted, or a past tool was cancelled without an export.
• Most records are consumer personal data or protected health information.
• The same data was already licensed to someone else for AI training.
• The company never reached 50+ full-time employees at peak (contractors excluded).
• A court, trustee, assignee or lender controls company assets and has not been involved.
• Nobody inside the company can run an export from the core systems.

Any one of these is a reason to keep licensing out of the readout and focus on the operating fixes.

Raising a licensing screen with the CEO

If the records layer looks strong, keep the conversation factual and separate from your audit fee.

If the company runs on EOS, the IDS example for deciding whether to license company records shows how a leadership team can work through the question. Once the CEO agrees, you make the introduction and nothing more; you never export, upload or describe the records yourself. SourceX qualifies the company, guides the data inventory, agrees one all-in price and the terms, and manages buyer review, contracting and delivery, with redaction and de-identification rules agreed before any work starts.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, and the reward becomes payable only after the buyer pays and SourceX receives its fee. Rewards are not guaranteed, and the reward comes out of SourceX's fee rather than the client's proceeds. Disclose the relationship to the CEO and check your engagement letter; the fractional COO playbook covers timing across a retainer.

Next step

Add the records layer to your next operations audit. When a client's history looks deep and controlled, check the baseline on who qualifies, then register as a partner and send the CEO your referral link.