What should a workflow automation audit include?

Most firms of 10 to 50 people did not design their automations; they accumulated them. A Zap someone built for a webinar in 2023, a Power Automate flow from a former office manager, a native sync switched on during a trial. Nobody is sure what runs, who owns it, or what breaks if a login is removed.

The short answer: a useful workflow automation audit answers five questions and ends with a written plan. What automations and connections exist? Who owns each one and which account does it run under? What fails, and how would you know? How does data move between your systems, and which one is the source of truth? And which processes should be automated next, fixed, or switched off? If an audit cannot answer those, it is a tool list, not an audit.

1. A complete inventory

Start with everything that moves data without a person, not only the automation platforms:

• Automation platforms: Zapier Zaps, Make scenarios, n8n workflows, Power Automate flows.
• Native integrations: CRM to accounting syncs, calendar and email sync, practice management connectors.
• App-level rules: email rules and forwards, CRM workflows, form notifications.
• Scripts and macros: spreadsheet scripts, scheduled exports, anything a former employee wrote.

For each item, record what triggers it, what it does, which apps it touches, whether it is switched on, and when it last ran. Expect to find automations that are on but do nothing useful, and some that are off but still assumed to be working.

2. Ownership and the accounts things run under

This is where most hidden risk sits. Each automation runs under someone's account, and each connection to an app uses someone's login.

Check, for every automation:

• Who owns it in the platform, and whether that person still works at the firm.
• Which account each connection uses. A connection made with a personal login stops when that person's account is disabled.
• Whether a second person has access. Microsoft notes that a Power Automate flow becomes orphaned when its owner leaves and no co-owner exists, and may start failing if its connections relied on that person's identity, according to its guidance on orphaned flows.
• Where credentials and API keys live, and who can rotate them.

The target state is simple: every important automation is owned or co-owned by a firm account or by at least two people, and connected with firm-owned logins.

3. Failure history and monitoring

An automation that fails silently is worse than none, because people stop checking the work by hand. The audit should pull each platform's run history and look for:

• Runs that errored, and how often.
• Runs that "succeeded" but did nothing, often a filter quietly stopping everything.
• Whether anyone is alerted when a run fails, and whether that person reads the alert.

Do this early, because history does not last forever. Zapier says it keeps Zap history for a limited window, set out in its data retention article, and Make says the number of days scenario history is stored depends on your plan. Export what you need before it rolls off. For the usual failure causes, see our article on why Zapier automations keep breaking.

4. A map of how data actually flows

Draw the systems as boxes and the automations as arrows. For each type of record (client, matter or project, invoice, appointment), mark:

• Where it is created and where it is corrected: the source of truth.
• Which direction it flows, and whether any two tools write the same record.
• How records are matched between systems: by email, by name, or by a stored ID.
• Where duplicates or rekeying happen, which usually shows where an arrow is missing or doubled.

This map is often the most valuable page of the audit. It shows the gaps (data still copied by hand), the overlaps (two automations doing the same job) and the fragile joints (matching on names). Our guide to syncing data without duplicates covers the fixes that usually follow.

5. Usage and cost

Automation platforms bill on usage: Zapier counts tasks, Make counts credits or operations, and Power Automate has its own licensing for premium connectors. The audit should show, for each platform:

• The plan and what it costs per year.
• Which automations use the most tasks or operations, and whether that usage buys something worthwhile.
• Overlap with features you already pay for elsewhere, for example a native sync that could replace a paid Zap, or an e-signature tool included in your practice management plan.

Record prices from the vendor's own pricing page with the date you checked, because plans change. The aim is not to cut spend for its own sake; it is to know what each automation costs to run against the work it removes.

6. Security and data handling

You do not need a full security review, but the audit should check the basics:

• Which automations carry client, patient or financial data, and through which platforms.
• Whether the platforms involved fit your obligations; for health data in the US, for example, check whether each vendor will sign a business associate agreement before patient data passes through it.
• Which data region each account uses, where that matters to your clients.
• Who has admin rights on each platform, and whether former staff still do.

Where the answer depends on your regulatory position, check with your lawyer, accountant or compliance lead rather than assuming.

7. Process opportunities, not just tool fixes

An audit that only looks at existing automations misses the bigger gain. Interview the people who do the work and ask where they rekey data, chase documents, or copy information from one screen into another. Typical candidates in professional firms are intake, onboarding, document collection, time to invoice, and client reporting.

For each candidate, estimate how often it happens and how long it takes, so the time saved is grounded in your own numbers. Our guide on which processes to automate first has a simple scoring method.

8. The deliverable: a written, prioritized plan

The output should be a document you could hand to anyone, including another consultant. At minimum:

If an audit ends with a sales pitch instead of this, you have bought a proposal.

Questions to ask before you commission one

• Is the fee fixed, and what exactly is delivered?
• Will the work happen inside our own accounts, with access we grant and can revoke?
• Is there a confidentiality agreement before anyone sees our systems?
• Do we own the written report, and can we act on it without hiring the auditor?

How Flow Mesh helps

Every engagement starts with a first call. Our stack audit covers the points above and gives every tool a verdict (keep, configure, consolidate or replace) plus a written scope you own. Work happens inside your own accounts, with an NDA at the start and a DPA on request; any implementation is scoped and quoted in writing after the audit.

Key takeaways

• Inventory everything that moves data automatically, including native syncs, app rules and scripts.
• Check who owns each automation and which logins it runs on; personal accounts are the biggest hidden risk.
• Pull failure history early, before the platform's retention window removes it.
• Map the source of truth and direction for each record type to find gaps, overlaps and duplicate risks.
• Insist on a written, prioritized plan with verdicts and owners, not just a list of tools.