Guide · checked October 2026
How to run a clinical audit, step by step
Run a clinical audit in four stages, as HQIP sets out: plan it (aim, objectives, evidence-based standards, method, stakeholder sign-off), measure current practice against those standards, put changes in place, and then show that the improvement has lasted, usually by repeating the data collection.
Before you collect anything
HQIP's Best practice in clinical audit (2020) describes clinical audit as a quality improvement cycle that measures care against agreed and proven standards and then acts to bring practice into line with them. It also says audit should be used only when it is the most suitable method. If you want to find out what a service achieves without a standard to compare against, that is service evaluation, not audit.
Every audit needs a clearly stated improvement aim, objectives and a named clinical lead. Where the lead is a rotating junior doctor, HQIP says a more senior clinician should oversee the work so it is not lost at changeover. Where possible, the stakeholder group should sign off the aim, objectives, standards and method before data collection starts.
The four stages
- Preparation and planning: choose the topic, write the aim, pick evidence-based standards that are clearly referenced, define the sample and the data set, and settle information governance.
- Measuring performance: collect only the data needed to measure compliance, using a piloted data collection tool, and analyse it against the standards.
- Implementing change: agree numbered recommendations and a SMART action plan with named owners.
- Sustaining improvement: check the change worked, usually with a repeat data collection done in exactly the same way, and decide whether to re-audit or monitor.
Information governance and records
HQIP says audits must comply with data protection law and data security rules across sample identification, data collection and analysis. Its reporting guide adds that personal confidential data should be anonymised at the earliest possible stage and that the full report should be kept for at least five years, in line with the Records Management Code of Practice.
Write the method down in full. HQIP's point is practical: if the method is recorded, the repeat cycle can be done the same way, and any unavoidable change can be reported alongside the results.
Common mistakes
- Starting data collection before the standards and method are agreed.
- Collecting extra fields "while you're there". HQIP says data not needed to measure compliance should not be collected.
- Treating the first report as the end. HQIP says the cycle is not complete until there is evidence the action plan improved quality.
- Calling a project audit when there is no standard to measure against.
Where Oriel fits
Oriel is an on-premises audit platform in pilot. You describe the audit in plain words and it writes a plan saying what it will read, where, and which part of your procedures applies; nothing runs until a person approves it. It then checks every case rather than a sample, through FHIR, DICOMweb or HL7 v2 connectors, a CSV or XLSX import, or on screen where a system has no interface.
Each finding comes with its evidence and a suggested outcome that a named person agrees or changes. Oriel drafts the report in your department's template and can save the audit as a pack, schedule or workflow so the next cycle runs the same way. It is shown on a fictional demo hospital with synthetic data only.
Questions
Who should lead a clinical audit?
HQIP says each audit needs a named clinical lead, with a more senior clinician overseeing the work when the lead is a rotating junior doctor.
How much data should I collect?
Only what you need to measure compliance with the standards. HQIP's guidance says other data should not be collected.
When is an audit finished?
When there is evidence that the action plan improved quality, usually from a repeat data collection using the same method.
Sources
Official pages, checked October 2026. Guidance changes, so check the current version before you rely on it.
General information for healthcare managers and clinical teams, checked October 2026. It is not legal, regulatory or clinical advice; follow the current official guidance and your organisation's own policies. No patient data is used in these examples. Oriel is a working prototype shown on a fictional demo hospital with synthetic data only. It is not a medical device and is not for clinical use. It drafts and flags for people to decide; it does not diagnose or change clinical records. A clinical safety case and information-governance approval come before any use with real patient data. Oriel is a working name.