Have you noticed that once you start thinking like an auditor, you just can’t turn it off?

I was speaking with a relative recently who had been given some prescription eye drops. The prescription label which had been stuck onto the pharmacy bag said to apply them 1X per day. When she went to her follow-up appointment, the doctor was concerned that her eyes were not recovering quickly enough and asked her if she had been using the drops. She replied that she was applying them once a day per the prescription.

The doctor seemed stunned to hear this. “Once a Day?!? I wanted you to take them 4X a day, and the printed material on the box says to do it 4X a day.” Fortunately, there was no long-term damage and she now understood the new dosing requirements and is applying them 4X daily… but when I heard the story, my “auditor mode” clicked in immediately.

Fact #1: The doctor clearly intended for her to take the drops 4X per day

Fact #2: The prescription label printed by the pharmacy indicated that they should be taken 1X per day

Fact #3: The manufacturer’s label indicated that they should be taken 4X per day

Given these facts, how did the misapplication arise?

I see at least 3 relevant processes that may have control weaknesses:

  1. The process by which the doctor communicates his intention to the pharmacy
  2. The process by which the pharmacy produces a label based on that doctor communication
  3. The process by which the end user decides how to use the prescription

Obviously process #1 should have controls in place to ensure that the intended dosage is appropriately recorded and communicated.

Process #2 should have controls in place to ensure that the doctor’s intention is reflected in the label, and possibly a special control to confirm dosage requests that differ from the manufacturer’s intention.

And Process #3 could possibly include a control to identify differences between prescription label and manufacturer’s label, or even a direct comparison to a document presented to them by the doctor.

In this case, under-dosing did not come at a serious cost, but for the doctor and pharmacy, such an observation should result in substantial process review and strengthening of controls. It’s possible that those processes already include more strenuous controls for certain medications, and that they are making a conscious time trade-off by under-controlling the eye drop process. I suspect it’s just a happy coincidence that they “got off light” this time.

The tendency of auditors to constantly think like auditors comes with an important practical benefit: When assessing the ability of an auditor to demonstrate “critical thinking” (for example, in a job interview), you can ask the auditor to assess controls in a broad variety of real-world situations. Every auditor routinely finds herself asking “What could go wrong and how could that be controlled?” One of my favorite interview questions asks auditors to describe the controls required for an amusement park ticket sales booth. Most candidates will have a cursory understanding of the role, but few have in-depth experience, so this enables the interviewer to understand how the auditor goes about understanding and analyzing a novel process and its risks.

When you can identify auditors who are “always auditing”, you find auditors who will audit well for your team!