Quality assurance

QA begins before an audit

Quality work starts with clear standards, usable tools, qualified roles, access supports, training, and release gates. An audit detects how the system performed; prevention reduces the chance of failure.

Design controls at the point of work. A required field, source check, clinical review, access test, or stop condition should have an owner and evidence.

Build a quality register

For each critical workflow, record:

• objective and applicable source
• process owner and decision authority
• inputs, dependencies, and handoffs
• required controls and evidence
• risks and failure modes
• monitoring measure and threshold
• sampling or review cadence
• escalation and immediate stop rules
• corrective-action and validation path
• review date and version

Keep clinical, payer, privacy, legal, workforce, and technology authority distinct.

Set a risk-based review calendar

Review high-risk processes more often and after meaningful change. Triggers can include a new service, payer, site, system, vendor, role, regulation, recurring complaint, serious incident, or failed validation. Stable low-risk workflows can use a lighter cadence with documented rationale.

Maintain one calendar for routine audits, control tests, policy reviews, drills, and sustainment checks. Assign backup reviewers and escalation for overdue work. A missed review remains visible with its risk and age; moving its due date after the fact should preserve the original commitment and the approved reason for change.

Sample evidence for a purpose

Routine samples estimate how a process performs across a predeclared population. Targeted reviews investigate a known concern. Pre-release checks prevent a specific defect from moving forward.

Label the review type, cohort, sample method, period, and exclusions. A targeted sample should not be presented as an organization-wide defect rate.

A fictional release audit

Golden Alder reviews 25 fictional first-service releases from a monthly mature cohort. Its checklist covers qualified staff, clinical clearance, required consent, current authorization when applicable, safe setting, communication access, and schedule match.

Twenty-two meet every defined gate. Release-control completion is 22 of 25, or 88%. Three fail: one lacks current authorization evidence, one has an unresolved staff-location configuration, and one lacks a tested AAC backup requested for the setting.

All three remain held with owners and due dates. The practice treats the findings as system and access work rather than blaming the clients.

Use clear finding states

Separate observation, potential concern, confirmed finding, immediate containment, correction in progress, validation, sustained, and closed. Preserve who made each determination and the evidence.

A reviewer can identify a missing item. The qualified domain owner decides its meaning and required response. Uncertainty should remain visible until resolved.

Protect clinical authorship

QA staff may check whether required assessment, plan, data, review, or signature evidence exists. An appropriately qualified clinician interprets clinical evidence and decides whether goals, dosage, risk controls, or recommendations change.

Software can flag inconsistency or missing fields. It should not auto-rewrite clinical content, create unsupported rationale, or mark a plan clinically appropriate.

Correct the record and the process

Address affected people and records first. A permitted correction should preserve the original content, author, date and time, reason, and audit history under governing policy.

Then investigate why the workflow allowed the problem. Fix the source condition, such as unclear roles, inaccessible tools, duplicate entry, weak training, missing review, or conflicting guidance.

Validate and sustain improvement

Completion of a policy or training is activity evidence. Validation tests whether the process now works in relevant conditions. Define the sample and threshold before testing.

Schedule a later sustainment check. Record recurrence, new failure modes, and remaining risk. Keep the action open when validation fails rather than repeating tests until one favorable sample appears.

Make reporting safe and useful

Protect good-faith reporting and avoid retaliation. Give staff and clients accessible routes to raise concerns. Limit sensitive details in broad dashboards while ensuring accountable owners can investigate.

Show counts, denominator, severity, aging, repeat findings, audit coverage, corrective-action status, and unresolved high-risk cases. A high average score should never hide one serious safety or privacy issue.

Review unintended incentives

QA targets can encourage selective samples, hidden findings, premature closure, or cosmetic corrections. Audit the audit process: sample selection, reviewer agreement, classification changes, late records, and overrides.

Pair compliance measures with client experience, access, safety, clinical outcomes, workforce conditions, and fairness. Quality is broader than a checklist pass rate.

Keep the source in scope

The CASP resources page links organizational and ABA practice materials, some requiring separate access or licensing. It does not prescribe this exact QA system. The framework above is an editorial operating model.