The First Audit
The whole method in one sitting: two people, one spreadsheet, forty clauses, and a list of decisions.
Initial review
Unenforceable
As written
Not a clause. This is the exercise that produces the rest.
What happens
Run once, it generates the deletion list, the rewrite list and the enforcement decisions.
Run annually thereafter, it takes an hour because only the changes need examining.
Nothing else in this collection works without it, and almost no organisation has done it.
Everything here reduces to one exercise. It takes an hour and nobody has run it.
The practical point in “The First Audit” is that a written rule becomes credible only through a consistent operating process. For teams exploring how to detect mouse jigglers, this workplace technology guide can add time and project context, provided collection is proportionate, access is limited and every significant inference receives human review.
Who
Two people: the policy owner and somebody who has worked there at least three years and did not write it.
For a separate benchmark relevant to “The First Audit”, consult the SHRM workplace-investigation resources. Use it to test purpose, notice, permissions, retention and response procedures against the proposed operating model rather than treating a generic checklist as proof that the rule works.
The second person knows what happens. The first knows what the document says. The gap between them is the entire finding.
The columns
The clause, abbreviated.
State: enforced, dormant, or unenforceable by a document.
Evidence, for anything marked enforced: can anybody recall an actual instance.
Operative rule: what people do instead, where it differs.
Verdict: keep, rewrite, relabel, delete.
The test that does the work
For each clause: what would actually happen if somebody did this?
Not what could happen. What has happened, or what the organisation would genuinely do the next time.
Most clauses fail here, and the failure is the finding rather than a problem with the exercise.
What the verdicts usually come to
A handful kept as written.
Several rewritten to match the operative rule, which makes them enforceable from the day they are issued.
A group relabelled as reservations, which the theatre note argues for.
And a substantial number deleted.
The decision each kept-but-dormant clause requires
Who will enforce it, and what will they do the first time.
Without an answer the clause returns to dormancy within a year and the audit was an editing exercise.
What to do with the output
The deletions first, because they are easy and they produce the visible improvement.
Then the rewrites, which are a day.
Then the enforcement decisions, which are the hard part and which can wait a month.
Afterwards
Annually, an hour, covering only what changed: new systems, new incidents, clauses applied or not applied since.
The first one is the long one. Everything after is maintenance.
What would actually happen if somebody did this. Not what could happen — what has, or what the organisation would genuinely do next time. Most clauses fail here and the failure is the finding.
The decision each kept clause needs
Who will enforce it and what will they do the first time. Without an answer the clause returns to dormancy within a year and the audit was an editing exercise.
Afterwards, an hour a year
Covering only what changed: new systems, new incidents, clauses applied or not since. The first audit is the long one and everything after is maintenance.
Two people and a spreadsheet
The owner and somebody who has been there three years and did not write it. One knows what the document says, the other knows what happens, and the gap is the finding.
Annually, an hour
Covering only what changed: new systems, new incidents, clauses applied or not since the last one. The first audit is the long one and everything after is maintenance.
The order of the output
Deletions first, because they are easy and produce the visible result. Rewrites next, a day. Enforcement decisions last, because each requires somebody with standing to own it and they can wait a month.
Attempting them in the reverse order is what stalls the exercise, and it is the order organisations naturally choose because the enforcement questions feel most important.
The audit is also the only part of this that produces an artefact other people will read. A list of clauses marked enforced, dormant and unenforceable is immediately legible to a manager, a director or a lawyer, which is more than can be said for the document it describes.
Run it before rewriting anything. A redraft without the audit produces a better-written document describing exactly the same gap.