How I Audit a Business the Same Way I Audited Banks

For four years at the FDIC, I was a Financial Institution Specialist — a bank examiner. I walked into banks and credit unions, examined their operations, and wrote the report. Are the controls working? Are the processes sound? Where are the risks that nobody's watching?

Before that, I was an Observer/Controller-Trainer in the Army. Same job, different context. Evaluate a unit during a training exercise. Watch how they operate under pressure. Identify the gaps between what they think they're doing and what they're actually doing. Write the after-action review.

I spent twenty years evaluating whether organizations could actually execute — not in theory, but in practice, under real conditions.

Now I do the same thing for local businesses. The target changed. The methodology didn't.

What a bank examiner actually does

Most people think bank examiners look at balance sheets. We do. But the real work is examining how the institution operates — its processes, its controls, its decision-making.

You walk into an institution and ask: if something goes wrong here, will the system catch it? Is there a process for this, and does anyone follow it? Where are the gaps between what management says is happening and what's actually happening on the ground?

You're not looking for a single catastrophic failure. You're looking for the accumulation of small gaps that, combined, create risk. A control that exists on paper but isn't enforced. A process that depends entirely on one person remembering to do it. An escalation path that nobody has tested.

The institutions that scored well weren't the flashiest. They were the ones where the mundane stuff worked reliably, without anyone needing to think about it. Hours were posted correctly. Disclosures were complete. Customer complaints had a documented response process. The boring things.

How that maps to a local business

When I audit a local business's online presence, I'm doing the same thing: walking through the operation from the outside and checking whether the systems work.

I'm not evaluating their marketing strategy. I'm evaluating whether the basic machinery of finding and converting a customer actually functions.

I start with how someone finds them

Open Google. Search for what they do in their city. Do they show up? Where do they rank? Is their listing complete — hours, photos, description, correct category? How do they compare to the top three competitors in the same search?

This is the equivalent of checking a bank's public-facing disclosures. Is the information that customers see accurate, complete, and current?

Then I check what happens when someone reaches out

I fill out the contact form. I call the phone number. I submit a booking request if they have one. Then I wait.

Does the form send a confirmation? How long until someone responds? If I call and get voicemail, is there an auto-text? If I book something, do I get a confirmation with details?

This is the equivalent of testing a bank's customer-facing processes. The policy might say "respond within 24 hours," but does it actually happen?

Then I check the follow-up systems

If someone inquires but doesn't convert, is there a follow-up? If someone books but doesn't show, does anyone reach out? If someone becomes a customer, are they asked for a review?

This is the equivalent of examining a bank's exception handling. When something doesn't go as expected, does the system catch it — or does it fall through the cracks?

Then I check for consistency

Does the phone number on the website match the Google listing? Do the prices match across platforms? Are there duplicate pages, broken links, outdated information?

This is NAP consistency — name, address, phone — and it's the local business equivalent of a bank's data integrity. Small inconsistencies that seem trivial individually but compound into real visibility problems.

What makes this different from a marketing audit

Marketing audits typically start with strategy: Who's your target audience? What's your brand positioning? What channels should you be on?

I start with operations: Does the stuff that's supposed to work actually work?

You can have the best marketing strategy in the world, but if someone fills out your form on Saturday and doesn't hear back until Tuesday, the strategy doesn't matter. The leads are leaking out of a broken pipe. Fixing the pipe comes before optimizing the flow.

The report

Every audit produces a written report with the same structure:

1. How prospects find the business — every path a customer might take to discover them
2. Where the leaks are — specific, documented findings with evidence
3. What should happen instead — concrete fixes, not abstract recommendations
4. Priority order — what to fix first based on impact and effort

No jargon. No fifty-page deck. Just: here's what I found, here's what it means, here's what to do about it.

The same format I used at the FDIC. The same format I used in the Army. Observe, document, prioritize, recommend.

Why this matters now

The AI conversation has everyone focused on the future — what tools to adopt, what to automate, what's coming next. That's important.

But for most local businesses, the present is broken. The Google listing is incomplete. The contact form goes nowhere. The follow-up is manual and inconsistent. These aren't future problems. They're current ones, costing real money every week.

Fixing them doesn't require a consultant with a strategy deck. It requires someone willing to look at the business from the outside, document what they find, and tell the truth about it.

That's what examiners do. That's what I do.