Problem
Every audit needs populations and samples. The auditor requests a population, the customer provides it, a sample is pulled, the sample is tested. Simple in theory.
In practice: the auditor created a population request, received the full population, made files, and handed them to an ops team. Ops seeded the population, sampled it randomly in a spreadsheet, then uploaded the result back. The source of truth lived outside the product the whole time. Twelve-plus hours per audit, on 100% of audits, mostly manual, held together by a second team whose job was to be human middleware for a spreadsheet.
What was actually broken
Every user asked for something small. A fix here, a field there, an export. Each request was reasonable. Building them would have meant shipping a dozen patches onto a process that was never going to hold.
Four groups touched this process: leadership, the customer, the lead auditor, and the tester. Nobody owned the whole thing, so nobody could see the whole thing. That was the actual problem. Not a missing feature, a missing connection. The process had left the product, so nothing could stay true, and keeping it true was somebody's full time job.
What I designed
The auditor now creates samples directly from the population request. Samples stay connected to their sample requests. The database is the source of truth, so everything stays current without anyone maintaining it. Testing is automated, with AI where judgment helps and deterministic logic where it doesn't.
The interface had to serve four different people without becoming four different products. Leadership needs to see status. The customer needs to be asked once, clearly. The auditor needs control. The tester needs the work to be already done.
The hard part
The happy path was never the work. The work was every case that isn't: no population yet, resampling, samples shared across frameworks, functionality that no longer exists. Each has a different shape, and each one, left unhandled, sends the auditor straight back to the spreadsheet.
The hardest was multi-framework. Two audits running in parallel against different frameworks, drawing on overlapping evidence. The customer should only have to do the work once, because burdening them twice is how you lose their trust. But the auditor shouldn't have to absorb that complexity either, because absorbing it is how you lose the rigour. So the system holds the complexity instead of a person.
My role
I led the design end to end, in close partnership with the PM. We ran the research together: interviews, sessions with auditors and customers, and a map of how the process actually worked versus how it should. That map is where the project turned. I worked directly with engineering on the technical dependencies, because the fix was structural before it was visual. I designed the flows and the screens, we reviewed as a team, and I stayed on it after ship: user testing, correcting, adjusting as real audits ran through it.
What changed
Populations and samples now run inside the platform on 100% of audits. The manual work is automated. The ops team is out of the loop entirely. The source of truth is the product, which means it stays true on its own.
