Work-as-Done Audit¶
Field audit — instantiates Enacted-Control Verification and Closure
Reconstructs how a control is actually performed under ordinary and pressured conditions, so the enacted version can be laid beside the documented one.
A Work-as-Done Audit goes to where the work happens and builds an outside observer's record of how a control is really executed — including the steps that get re-ordered, the ones that get skipped, and the informal moves that hold the result together — then lays that enacted picture beside the documented procedure. Its defining move is that the observed behavior itself is the primary evidence, gathered by deliberately sampling the hard conditions where control failure is plausible: night shifts, time crunches, degraded tooling, unusual handoffs. It is not asking whether the control "passes" against its written spec, and it is not asking operators to explain their reasons — it is producing the enacted trace and sorting the differences it finds into safe adaptation versus quietly degraded protection.
Example¶
A regional airline relies on two line-maintenance controls during aircraft turnaround: a pre-departure external walk-around inspection, and a rule that no discovered defect may be deferred without a licensed engineer's recorded sign-off. On paper, training completion is near-total and the checklists are pristine. An assurance team runs a Work-as-Done Audit rather than another records review. They build a sampling frame that deliberately over-weights the stressful cases — the tight roughly-25-minute turns, red-eye arrivals, and shifts where one mechanic is covering two gates — and observe the turnarounds directly, recording what is actually done step by step.
Three gaps surface, and the point of the audit is that they are not alike. On some stands the walk-around checklist is worked out of order but complete — a harmless local re-sequencing. On others the correct torque value for a panel fastener is carried in one senior mechanic's head rather than read from the card — a hidden dependency that vanishes the day he is off. And on the shortest turns the underside inspection is compressed to a glance — a degraded control that removes real protection. The audit's output is a side-by-side trace of documented-versus-enacted with every difference tagged by type, which is exactly what tells the organization to formalize the re-sequencing, engineer the torque spec back onto the card, and treat the compressed inspection as a material finding rather than a paperwork nit.
How it works¶
- Stratify the sample toward difficulty. The frame is built so that pressured, degraded, and boundary conditions are over-represented relative to how often they occur — the opposite of demonstrating the control under ideal conditions.
- Observe, don't interview. The auditor records the enacted sequence as performed: omissions, substitutions, re-orderings, informal compensations. Reasons and tacit intent are explicitly out of scope here.
- Trace against the nominal step list. Each documented step is marked as enacted-as-written, enacted-differently, absent, or substituted, producing a concrete enacted trace.
- Classify every gap. Each difference is sorted — harmless adaptation, compensating practice, hidden dependency, or degraded/bypassed protection — so that trivial drift and dangerous loss are never treated the same.
Tuning parameters¶
- Announced vs. unannounced — unannounced observation captures ordinary work but risks friction; announced sampling is cleaner but invites a staged demonstration. The more the environment can rehearse, the more you lean unannounced.
- Condition stratification — how heavily to over-sample night shifts, high load, and degraded modes. More stratification catches the failures that matter but costs coverage of the routine baseline.
- Dwell time — a snapshot visit versus sustained presence. Longer dwell lets the observed behavior relax back toward normal, at higher cost.
- Observer count — one observer is cheap; two or more with a shared coding scheme reduce single-observer bias but multiply effort.
- Classification granularity — a coarse safe/unsafe split versus a fine typology of adaptation kinds; finer granularity guides closure better but slows the audit.
When it helps, and when it misleads¶
Its strength is catching the drift that paperwork structurally cannot show — the gap between work-as-imagined in the procedure and work-as-done on the floor[n1] — and doing so in a form (a tagged enacted trace) that downstream rating and closure can act on. It is the mechanism that turns "the files are complete" into "here is what actually happens on a short turn."
Its central failure mode is that behavior changes under observation: watched operators perform closer to the book, so a naive audit records a cleaner control than exists. The classic misuse is sampling only the easy cases — day shift, full staffing, a demonstration turn — which manufactures false assurance faster than no audit at all, because it now carries a green stamp. The guarding discipline is to over-sample the hard conditions, keep observation unannounced and dwell long enough that the performance relaxes, and treat any control seen only under clean conditions as unverified.
How it implements the components¶
enacted_control_trace— the observed step-by-step record of how the control is really executed is the trace; it is the audit's primary product.work_as_done_sampling_plan— the difficulty-stratified frame is the sampling plan, deliberately weighting shifts, loads, and degraded modes over polished demonstrations.nominal_actual_gap_classifier— each documented-versus-enacted difference is tagged as harmless adaptation, hidden dependency, or degraded control.
A Work-as-Done Audit does not judge the control against its written specification or hazard intent (nominal_control_specification, control_intent_and_hazard_link, control_effectiveness_evidence_rule) — that is Control Performance Walkdown; and it does not elicit operators' reasons or the hidden slack they spend (independence_and_no_blame_safeguard, reserve_consumption_signal) — that is Operator Shadowing and Contextual Inquiry.
Related¶
- Instantiates: Enacted-Control Verification and Closure — the audit supplies the enacted-behavior evidence the whole verification loop is built on.
- Consumes: Near-Miss and Deviation Review can point the sampling frame at the controls most worth auditing.
- Sibling mechanisms: Operator Shadowing and Contextual Inquiry · Control Performance Walkdown · Document-to-Practice Trace Matrix · Process-Mining Nominal-Actual Comparison · Line-of-Defense Sample Reperformance · Corrective Action Effectiveness Retest · Safeguard Bypass Probe · Exception, Waiver, and Override Log Review · Near-Miss and Deviation Review
Editorial Notes¶
Form Classification¶
Form family: Assessment, Review & Assurance
Rationale: Work-as-Done Audit operates as a bounded evaluation of existing evidence or work that produces a finding or disposition because it reconstructs how a control is actually performed under ordinary and pressured conditions, so the enacted version can be laid beside the documented one.
Independent corroboration: The frozen evidence defines Work-as-Done Audit as 'Reconstructs how a control is actually performed under ordinary and pressured conditions, so the enacted version can be laid beside the documented one', so its operative form is Assessment, Review & Assurance.
Nearest alternative: Analysis, Modeling & Optimization — Work-as-Done Audit includes features of an analytical, modeling, inference, comparison, or optimization procedure that derives insight or a solution, but its defining operation is a bounded evaluation of existing evidence or work that produces a finding or disposition.
Review outcome: Independent reviewer agreement; medium confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Reconstructing actual control performance under routine and pressured conditions and comparing it with written procedure is human-factors and safety-engineering analysis of work-as-done. ICAO's Human Performance Programme explicitly investigates the gap between expected and actual work so systems and procedures can be redesigned around operating reality.
Related originating lineages:
- Accounting & Auditing — Accounting, auditing, and controlled-resource stewardship has a distinct contributing or parallel lineage for the mechanism's defining operation: reconstructs how a control is actually performed under ordinary and pressured conditions, so the enacted version can be laid beside the documented one.
- Ethnography & Qualitative Methods — Ethnography and qualitative comparative inquiry has a distinct contributing or parallel lineage for the mechanism's defining operation: reconstructs how a control is actually performed under ordinary and pressured conditions, so the enacted version can be laid beside the documented one.
- Medicine & Healthcare — medicine_healthcare contributes clinical medicine, public health, and recovery practice to this mechanism's defining operation—Reconstructs how a control is actually performed under ordinary and pressured conditions, so the enacted version can be laid beside the documented one—without displacing the selected primary historical lineage.
- Organizational & Management Science — Organizational design, management, and operational governance has a distinct contributing or parallel lineage for the mechanism's defining operation: reconstructs how a control is actually performed under ordinary and pressured conditions, so the enacted version can be laid beside the documented one.
- Systems Thinking & Cybernetics — Systems science's feedback, boundaries, stocks, flows, and regulation tradition supplies an independent formative lineage for the mechanism's work as done audit logic.
Review resolution: The blind reviewers disagree on primary lineage (organizational_management versus engineering_design). Authoritative or primary research supports engineering_design as the best historical origin: Reconstructing actual control performance under routine and pressured conditions and comparing it with written procedure is human-factors and safety-engineering analysis of work-as-done. ICAO's Human Performance Programme explicitly investigates the gap between expected and actual work so systems and procedures can be redesigned around operating reality. The cited International Civil Aviation Organization, Human Performance Programme directly supports the mechanism's defining operation. All independently supported contributing domains are retained without an arbitrary cap. origin_mode=cross_disciplinary_synthesis records lineage, while domain_reach=multi_domain records later applicability separately from provenance.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Researched adjudication after independent review; high confidence.
Sources consulted:
Notes¶
[n1] The distinction between work-as-imagined (how a task is described in procedures and training) and work-as-done (how it is actually performed under real constraints), central to Erik Hollnagel's Safety-II and resilience-engineering work. The whole premise of this audit is that the two routinely diverge and only the second produces real protection. ↩