An Audit Is a Character Analysis

Strip away the frameworks and the acronyms, and an audit is asking a surprisingly human question: can you be trusted to do the right thing when no one's watching?

That's what a certification really represents. Not that a company checked 300 boxes — that it's the kind of organization that actually does what it says it does. An audit is, at bottom, a character analysis of a product and the people behind it.

Which is why character matters just as much on the other side of the table — inside the compliance practice itself.

If your job is to assess whether a health-tech product handles people's most sensitive data honestly, you had better be honest yourself. The whole role runs on trust: the company trusts you to tell them the hard truth, the auditor trusts your evidence, and somewhere at the end of the chain, patients trust that someone took this seriously. Put a corner-cutter in that seat and the entire thing becomes theater.

It's also why "compliance slows us down" gets it exactly backwards. Good compliance doesn't slow you down — it's what lets you move fast without eventually hitting a wall you didn't see coming. What slows companies down is bad compliance: the rubber stamp, the checkbox theater, the "we'll deal with it later" that turns into a fire drill in the middle of a deal.

Compliance teams don't slow companies down. Bad compliance does.

The know-how matters, obviously. But if I'm handing someone the keys to judge whether a company is trustworthy, I want to know they're trustworthy first.