Best Practices for Time Auditing

How to Audit Your Own Time Like a CFO You track every transaction in your business. But when was the last time you audited your own time? If you're in finance, you already know the principle: What gets measured gets managed. Here's a framework I use in my workshops how to run a Personal Time Audit and use AI to reclaim your workflow. ✲ Step 1 ➝ Record your week like a ledger Document everything you do for one full week. Every task. Every meeting. Every "quick" check-in that wasn't quick at all. By Friday, the pattern becomes obvious: You're not short on hours. You're hemorrhaging them on repetition. ✲ Step 2 ➝ Categorize your time Sort your tasks into three buckets: High Value: Strategic analysis, stakeholder collaboration, financial modeling. Medium Value: Reporting, reconciliations, documentation. Low Value: Data entry, formatting, manual updates. Most finance professionals discover that 60-70% of their time lives in the bottom two categories. ✲ Step 3 ➝ Automate your "Low Value" bucket AI tools like n8n, ChatGPT, and Make can handle: ➝ Recurring report generation ➝ Invoice tracking ➝ Expense categorization ➝ Summary commentary Describe your workflow once. Then let it run without you. ✲ Step 4 ➝ Reinvest your saved time Don't fill it with more tasks. Redirect it toward what finance was always meant for: thinking, advising, leading. That's where human judgment compounds. You audit finances to eliminate waste. Audit your time to amplify impact. When was the last time you examined where your hours are actually going?

40 hour audit functions outperform 80 hour ones. The functions still glorifying long hours haven't audited themselves in years. Most audit functions don't run 80 hours because the work demands it. They run 80 hours because the function was never audited. Layer after layer of inherited decisions that nobody re-examined because the team was too busy delivering. Six decisions consistently move the needle on quality and hours. Not technology decisions. Not headcount decisions. Process decisions most CAEs are too close to the work to make. → Annual planning is 60% redundant once continuous monitoring is mature. Most functions run both. Kill the duplication. → The executive summary nobody reads. Three pages of polished prose, replaced by 200 words of risk commentary. Same signal, no theatre. → Second reviews on low-risk testing. Error rates are identical with or without them. The control exists because of one historic incident, not because it earns its cost today. → The Jan–Dec audit calendar. It collides with reporting season every year. Moving fieldwork to a Dec–Nov cycle recovers three weeks of avoidable overtime. → Workpaper formatting. Cap it at 30 minutes per file. Anything beyond that needs a justification. Most of it is performance, not value. → Rework hours. Track them. Rework isn't a quality problem , it's an upstream clarity problem. Most functions never measure it. Quality up 40%. Hours down 20%. Same people. Better design. The audit functions that will still be excellent in five years aren't the ones working hardest. They're the ones that audited themselves with the same rigour they apply to the business.

Timing ITGC and ITAC Testing in Internal Audit: In internal audits, getting the timing right isn’t just good practice—it’s critical. Whether you're testing ITGCs or ITACs, when you test can affect the reliability of your results and the overall efficiency of your audit. In reality, ITGC and ITAC testing often runs in parallel, but strategic timing still matters. ITGC Testing: Start Early, Stay Covered ITGCs—controls over access management, system changes, and operations—are often tested during the interim phase, especially in large audits. This helps internal audit teams manage timelines and identify issues early. But if your testing date is more than three months before the period-end, you’ll need rollforward procedures. That means: Confirming with control owners that processes haven’t changed, Reviewing logs and access reports to ensure continued operation, Re-performing tests if major system or personnel changes occurred. Best practice? Test ITGCs within 3 months of year-end to avoid extra work. If that’s not possible, build in rollforward testing to keep your evidence strong. ITAC Testing: Often Parallel, Always Precise ITACs are embedded in business processes—think automated validations, reconciliations, and report-based approvals. While best tested after year-end using finalized data, in practice, ITAC testing often starts alongside ITGCs to meet tight timelines. However, auditors must ensure: The data used is final or substantially complete, System logic or report configurations haven’t changed post-testing, ITGCs related to access and change controls are effective through the testing date. If you test ITACs early, always reassess if re-validation is needed post-year-end. Ideal timing: Conduct core ITAC testing within 2–4 weeks after audit period-end, when reports are final and system conditions are stable. Why ITGC and ITAC Are Linked You can't truly rely on ITACs without first confirming that ITGCs are working. For example: Weak access controls can invalidate user-based ITACs. Inadequate change management raises doubts about report integrity. So, even if testing is done in parallel, conclusions on ITACs must be supported by effective ITGCs. That’s why sequencing and dependency mapping are so important. Internal Auditor’s Approach: Practical and Risk-Based 1. Plan Smartly: Know your control landscape, frequency, and timing of execution. 2. Test Strategically in Parallel: Start ITGCs and ITACs together, but prioritize ITGC completion before concluding on ITAC effectiveness. 3. Use Rollforward Judiciously: For ITGCs tested early or ITACs relying on late data, perform risk-based validations. 4. Document Everything: Keep evidence tied to control execution dates, risk assumptions, and changes in the environment. Internal audit isn’t rigid. In practice, timelines blur and testing overlaps. That’s fine—as long as your evidence is sound, your timing is defensible, and your conclusions reflect the actual risk landscape.

How should an auditor actually plan their day to be effective? This came from a question on my last post. Honest answer? You don’t “control” an audit day. You design a system that works even when things don’t go as planned. Here’s what that looks like in practice: 🕘 Start with control, not inbox If your day starts with Outlook, your priorities are already decided by others. Spend 10 minutes defining: * 1 critical task (moves the audit forward) * 1 support task (follow-ups / coordination) Example: Close revenue control testing > Reply to emails Then open your inbox. 📩 Outlook is a tool, not your job Set a rhythm: * Morning (after planning) * Midday * End of day 👉 Constant checking = constant distraction. ⚡ Use the 2-minute rule If it takes < 2 minutes, do it. * Quick reply * Small update * Sharing a document But don’t let it expand. 🕒 Protect deep work Block 60–90 mins for: * Control testing * Analysis * Drafting observations No calls. No Teams. 👉 One interruption can break your entire thinking flow. 💬 Manage Teams pings smartly Don’t react instantly. Example: Noted, will review post 3 PM. 👉 You stay responsive without losing focus. 🤝 Delegate with clarity * Assign data, walkthroughs, initial testing * Always add context: focus on key risks & exceptions 🎯 Guide juniors in real time Don’t wait for reviews. * Explain why * Share quick examples * Challenge their thinking 👉 Builds judgment, not just output. 📞 Manage internal audit calls Keep them: * Short (15–20 mins) * Structured Focus only on: * Progress * Blockers * Next steps 🤝 Manage client calls (this is critical) Be clear on your ask, keep an agenda, and ask direct questions. Don’t accept vague answers—clarity saves time. After the call: Share MOM 👉 This avoids “We didn’t agree on this” later. 🏢 Client location visits = real insights Don’t rely only on documents. * Observe how work actually happens * Check if controls work in practice Example: On paper: maker-checker Reality: same person doing both 👉 Real findings come from observation, not files. 🕛 Batch follow-ups: Fix 2 slots: * Midday * End of day Track: *Pending items *With whom *Since when 👉 Structured follow-ups = better responses. 🕕 Write as you work If you find something, document immediately: * What happened * Why it matters * Example 👉 Evening recall is never accurate. 🌙 Define a “realistic win” Audit never fully ends. A good day: * 1 control closed * 1 observation drafted * Key follow-ups done 🧠 Avoid fatigue Audit is mentally heavy. What helps: * Breaks between deep work * Mixing tasks * Limiting constant switching 👉 Fatigue comes from interruptions, not workload. 💡 Final thought Effective auditors don’t try to do everything. They: * Focus on what moves the audit forward * Manage people & dependencies well * Protect their thinking time Because in audit— 👉 It’s not about being busy It’s about being impactful #AuditLife #InternalAudit #GRC #Productivity #Leadership #CorporateLife

One of the delegates on my course last month shared that her executive has 42 one-to-one meetings every month. Let that sink in. That’s more than two per working day. And that’s before you factor in board meetings, team meetings, client meetings, email, strategy, travel, decision-making, and let’s be honest, basic breathing room. How is any other work getting done? This isn’t uncommon. Calendars fill slowly and silently, one well-meaning meeting at a time. But when no one is stepping back to assess the full picture, the result is calendar chaos - and strategic paralysis. That’s why quarterly calendar audits should be standard practice for every high-level assistant. Not just to tidy the calendar. To protect time. To align effort with outcomes. To make sure the calendar reflects your executive’s business priorities, not just the demands of others. Here’s how to do it: 1. Export or map the last three months of the executive’s calendar. Track every meeting. Categorise each entry. Use labels like: • Strategic leadership (vision, planning, innovation) • Operational oversight (status updates, project check-ins) • People management (1:1s, coaching, development) • Stakeholder engagement (clients, partners, board) • Execution time (thinking, prep, decision-making, writing) • Admin & low-value meetings (logistics, approvals, unnecessary invites) 2. Analyse the data. What percentage of time is spent in meetings? How many are high-value? How many could be shortened, delegated, or removed? 3. Compare it against priorities. Does the time spent reflect what the business needs from your executive this quarter? Or is the calendar working against their actual goals? 4. Present a brief report. Show the patterns. Make smart recommendations. Propose alternatives: consolidated meetings, alternate cadences, delegate handovers. 5. Have the conversation. “This is how your time is currently being spent. Is this how you want to be spending your time next quarter? If not, I can help you reset it.” Because this isn’t about scheduling. It’s about performance, clarity, and leadership bandwidth. Assistants - if you’re looking for ways to operate at a higher level, start here. Because the calendar is where your executive’s strategy impact lives or dies. 🔁 Repost to share 👉 Follow me Lucy Brazier OBE for administrative profession related content and inspiration.

I've sat in more than 50 audits across GCC & Europe (ISO 27001, SOC 2, SAMA etc..) You rarely fail for missing a piece of evidence... You fail because the proof is scattered, outdated, ownerless, or can't be found (while the person providing it swears they submitted already) To avoid this: 1- Pick one system of record for evidence (SharePoint or Google Drive, etc.). No WhatsApp, Teams DMs, or email threads as “evidence.” 2- Create one folder per Framework. Create sub folder per control group. Use a clean name for files, {ControlName}{YY-quarter(e.g. Q1)} 3- Assign one named owner per domain (Access, Assets, Change, Incident). Give each an audit response cheat sheet: what to show, where it lives, who to pull in (good luck with getting other teams doing it!) 4- Run a pre-audit dry run: fresh eyes click every link, open every file, check dates/signatures, and tie each piece of evidence to the control ID. Time-box to 2 hours. Ask the team: “If we were audited tomorrow, where would you point the auditor to?” 5- Automate refresh: exports/screenshots as needed (monthly?), owner sign-offs, and expiry checks so proofs don’t go stale. Simple fix: Make evidence hygiene the product, not an afterthought. Or simply save yourself the headache, at Vamu we automate a large part of this, and map controls to owners and time-stamped proofs so the folder is clean by default. But you can start with the list above this week. Audits are won (or lost) in the evidence folder.

I still hear CS leaders asking for more headcount and while I’m not saying it’s unnecessary… I am asking: Do you actually know where your team’s time is going today? Most leaders don’t. Few have ever done a true top-down and bottom-up analysis of how their team spends their time. Let’s be real, not all customers are created equal: Customers in onboarding or their first year often need more engagement than a year-3 customer. At-risk customers might require deep partnership while healthy ones can thrive in lighter-touch models. Some industries are seasonal, March may look nothing like August. If your CSMs manage commercial motions, their time flexes with the customer’s buying cycle. And then there’s the invisible time suck: ❗ Hunting for answers because documentation is poor. ❗ Rebuilding data that lives across 20 systems. ❗ Spending hours creating “insights” instead of delivering them. Before you ask for more heads, do your homework and see what can be optimized first. That’s how you staff responsibly. Here are 5 things you should do before putting in that request with Finance or HR: 1️⃣ Conduct a Time Audit Track where CSMs actually spend time for 2–4 weeks. Don’t assume. 2️⃣ Segment by Customer Profile Map time allocation by ARR, stage, and health to spot imbalance. 3️⃣ Identify Operational Gaps Pinpoint where inefficiency (tools, process, data) eats hours. 4️⃣ Redefine “High Touch” Calibrate your engagement model by value, not volume. 5️⃣ Run a Capacity Model Use data to prove your case for more headcount — or optimization. You might find you do need more people but you’ll also know exactly why and where the leverage is. So before you ask for more … Ask where the time is going.

Here’s a simple thought exercise that’ll buy you back hours of your life (and maybe make you richer). I call it the Time-Energy-Dollar Audit. Try this: 1. 𝗟𝗶𝘀𝘁 𝗼𝘂𝘁 𝘆𝗼𝘂𝗿 10 𝗺𝗼𝘀𝘁 𝗰𝗼𝗺𝗺𝗼𝗻 𝘁𝗮𝘀𝗸𝘀. (𝗪𝗼𝗿𝗸, 𝗹𝗶𝗳𝗲, 𝘄𝗵𝗮𝘁𝗲𝘃𝗲𝗿 𝗲𝗮𝘁𝘀 𝘆𝗼𝘂𝗿 𝘁𝗶𝗺𝗲.) 2. 𝗖𝗿𝗲𝗮𝘁𝗲 𝘁𝗵𝗿𝗲𝗲 𝗰𝗼𝗹𝘂𝗺𝗻𝘀 𝗻𝗲𝘅𝘁 𝘁𝗼 𝗲𝗮𝗰𝗵 𝘁𝗮𝘀𝗸. (𝗘𝗻𝗲𝗿𝗴𝘆, 𝗪𝗲𝗮𝗹𝘁𝗵, 𝗧𝗶𝗺𝗲.) 𝗘𝗻𝗲𝗿𝗴𝘆: Assign a color—green (energizing), yellow (neutral), red (draining). 𝗪𝗲𝗮𝗹𝘁𝗵: Assign a dollar value to each task. (Is it making you money? Or costing you? Or are you investing?) 𝗧𝗶𝗺𝗲: Estimate how long each task takes. (5 min? 2 hours? A whole day?) 3. 𝗦𝗼𝗿𝘁 𝘆𝗼𝘂𝗿 𝗹𝗶𝘀𝘁. 𝗜𝗱𝗲𝗻𝘁𝗶𝗳𝘆: • High-dollar, low-time tasks (maximize these). • Low-dollar, high-time tasks (cut, delegate, automate). • Red-energy tasks that drain you (rethink or remove). 4. 𝗗𝗲𝗰𝗶𝗱𝗲 𝘄𝗵𝗮𝘁 𝘆𝗼𝘂’𝗿𝗲 𝗼𝗽𝘁𝗶𝗺𝗶𝘇𝗶𝗻𝗴 𝗳𝗼𝗿—𝘁𝗶𝗺𝗲, 𝗲𝗻𝗲𝗿𝗴𝘆, 𝗼𝗿 𝗺𝗼𝗻𝗲𝘆? 5. 𝗧𝗮𝗸𝗲 𝗮𝗰𝘁𝗶𝗼𝗻: Double down on your strengths by optimizing for energy, money, and time. Instead of going by 'urgency', identify high-value moves that align with what fuels you and gets results. Switch it up every few months. (Life changes—so should your priorities.) 𝗛𝗲𝗿𝗲'𝘀 𝗮𝗻 𝗲𝘅𝗮𝗺𝗽𝗹𝗲: Say you value wealth, but you’ve been putting off depositing a check because you’re “too busy.” Depositing the check might feel like a low-energy, low-time task—but it directly aligns with your goal of building wealth. In the Time-Energy-Dollar Audit, this falls into the high-dollar, low-time quadrant, making it an easy win. Taking a few minutes to complete this task doesn’t just put money in the bank—it reinforces the habit of prioritizing actions that grow your wealth. Audit your task list, chart it out, and suddenly you see the where you’ve been wasting time. Get into your zone of genius. Less guessing, more doing. Get your time back. Follow Jonathan Z. Cohen for posts on mindset, fitness, and personal growth.

Most businesses waste 20+ hours weekly on tasks that should be automated Here's my framework for identifying your highest-leverage automation opportunities: 1. TIME AUDIT Look for tasks consuming 4+ hours weekly. This is the lowest-hanging fruit. For us, this included: • Campaign monitoring and reporting • Client onboarding processes • Response categorization and routing • Client campaign opportunity assessments Automation impact: Recovered 15+ hours per week across our team 2. REPETITION CHECK Identify processes done 10+ times daily. High-frequency tasks compound inefficiency rapidly: • Creating client folders/documents/portals • Data transfers between platforms • Email validation workflows • Performance reporting updates and alerts • Client CRM entries & workflows Automation impact: Eliminated 80% of ANY manual data entry 3. ERROR TRACKING Target tasks with 5%+ error rates. Human error isn't always a training issue, it's also a system issue: • DNS record configurations • Client data collection • Campaign setup procedures • Lead categorization • Deliverability and infrastructure monitoring & reporting 4. ANALYSIS CHECK Find processes causing 3+ hour delays. Bottlenecks kill momentum: • Waiting for deliverability placement test results • Campaign approval processes • Campaign copy structure • Client reporting generation Automation impact: Cut average wait times from hours to minutes 5. DATA VOLUME Identify where you're handling 1000+ data points manually. Humans aren't spreadsheets: • Lead list management • Domain health monitoring • Multi-touch sequence tracking • Campaign performance metrics 6. ROI POTENTIAL Prioritize tasks with 3x+ automation payoff Not all automations have equal value: • Client onboarding (8x ROI) • Campaign monitoring (5x ROI) • Domain rotation management (4x ROI) • Response handling workflows (3.5x ROI) The most successful operations aren't just automating tasks, they're automating entire workflows. At OutboundLeads, we've built automation systems using Make, n8n, Airtable and other various tools that have allowed us to scale revenue 3X without adding headcount. What's the highest-leverage process in your business that still hasn't been automated?

Get Real Data from the Gemba - 5 Best Practices for Conducting a Time Study Time studies are one of the most practical, low cost, and insightful tools for observing and documenting the Gemba. Whether it’s part of a Lean Six Sigma project or a standalone investigation, time studies let you see the truth of how work gets done. But a successful time study takes more than just a stopwatch. Here are 5 proven best practices to make your time study accurate, valuable, and ready to drive real improvement: ✅ 1. Scope the Workstation Clarify exactly what’s in and out of scope. Defining these details up front leads to cleaner, more actionable data. ✅ 2. Do Your Homework Before collecting any data, observe without documenting. Talk with operators, identify work elements, and understand the value-added vs. non-value-added elements. This pre-study time builds clarity. ✅ 3. Prepare Decide which shifts and how long you’ll observe. (don't skip the night shift) Think carefully about how you'll document the findings in real time. ✅ 4. Conduct the Study with Discipline Stay out of the operator’s way. Let them work as usual Ask clarifying questions after. ✅ 5. Report with Visuals Don’t just dump raw data—make it meaningful. Use Pareto charts, histograms, and time breakdowns. Categorize activities into Value-Added and Non-Value-Added Time studies are the easiest, fastest way to documenting what’s really happening on the floor. When done right, they provide insights no spreadsheet or meeting room ever could.