Auditors at high-throughput operations - retail chains, hospital networks, branch banking - face the same wall: a 200-item checklist where 190 items are compliant year after year. Filling every item wastes time; skipping items cheats the program. Between those poles lies exception-based auditing.
The efficiency case is real
Pre-authoring sensible defaults (mostly Compliant) and having the auditor confirm them by exception - tapping only the deviations - genuinely compresses a 45-minute checklist into 10. Teams that adopt it run more audits, cover more sites, and catch more genuine problems because their auditors are not worn down by ceremony.
The integrity risk is real too
The danger: an untouched default is indistinguishable from an inspected confirmation, and reports quietly show items as "compliant" that nobody actually looked at. That is not a data entry shortcut; it is a false audit record. Exception-based auditing is only defensible when the platform keeps the two states apart.
What makes it work
Three mechanics keep the shortcut honest. First, an answer that still holds its authored default is unconfirmed - excluded from scoring and from report totals, and shown as "not inspected" rather than "compliant". Second, confirmation is an explicit act: the auditor either edits each item or taps a bulk confirmation acknowledging the remaining defaults stand as inspected. Both are recorded as events in the audit log. Third, hidden questions - dormant because a conditional rule removed them - are never scored and never counted as inspected, though their answers are retained so a conditional re-show restores them exactly.
What it buys you
Done right, exception-based auditing converts a chore into a judgement: the auditor's scarce attention lands on the exceptions, and the report tells management exactly what was inspected versus what was assumed. The audit trail records who confirmed what and when. That combination - speed plus auditable confirmation - is the whole point. The technique is a decade old; the discipline of making every default provably confirmed is what separates a real audit program from a ritual one.