Opening the book…
Aggregates are smooth by construction; they hide the specific cases where a target was met by doing something you would not have approved. Reading the roll-up tells you what people reported, while reading individual cases tells you what they did. Random selection matters because any predictable sample gets prepared for.
Pull a handful of cases at random each period — tickets closed, calls resolved, inspections passed — and work through them end to end against the standard you actually care about. Do it on a schedule people know about but with selections they cannot anticipate. Write down what you found, including when the sample was clean, so the audit itself has a record.
Where the population is small enough to review entirely, review it entirely. Where sampling the work would mean reading confidential material you have no standing to see, use an independent reviewer who does.