A facilities lead at a mid-size hospital walked the ground floor with a phone and a notepad. Between the main entrance and the cafeteria she counted eleven QR codes: a parking payment sign, three wayfinding placards, a visitor survey, two vending labels, a donor plaque, and two she could not identify at all. Four opened pages that no longer existed. One opened a page that existed and belonged to a company nobody at the hospital had heard of.
None of that was any individual's fault. Codes get printed by whoever needs one, on whatever timeline, and the person who made them moves on. Two years later there is no list.
An audit produces the list. It is unglamorous work, mostly walking and spreadsheets, and the only way to learn what your printed codes do now rather than what they did the day they were made.
Build the inventory before you check a single link
The inventory is the audit. Everything else is arithmetic on top of it.
Walk the sites. One row per physical code, and the row needs more than a URL:
- A reference you assign, so the code has a name even if nobody named it.
- Where it is, precisely enough that a stranger could find it. "Second floor east corridor, between the elevators and room 214," not "upstairs."
- What it is printed on: poster, laminated placard, vinyl decal, equipment label, vehicle graphic, packaging, menu. The medium decides your options later.
- A photograph of the placement with enough surroundings to identify it.
- The decoded destination, exactly as it comes out of a reader.
- Who owns it now. Not a department. A person.
Two of those columns do most of the work. The photograph settles arguments about which sign someone means. The named owner is what turns findings into fixes.
For anything on packaging or mailed material, you cannot walk to it. Substitute the print records: the job, the quantity, the date, and whether any of it is still in circulation.
Decode a sample and learn what you are dealing with
Take a physical copy, not the artwork file, and decode it with a QR code reader that shows the string before opening anything.
- If the decoded string is the destination URL itself, the code is static. The address is part of the pattern and no dashboard will change it, because no dashboard is involved. That is how a static code behaves by design.
- If the decoded string is a short URL on a vendor's domain or a branded short domain of yours, the scan routes through a redirect. That is the dynamic pattern, and the destination lives in an account rather than in the ink.
One caveat worth writing on the audit sheet: a short link does not prove you can edit it. The account may belong to someone who left, may sit on a free tier that lapsed, or may be with a service that no longer exists. Editability is a separate column from routing, and you confirm it by logging in, not by looking at the URL.
Sample rather than decoding everything. Twenty codes across the age range will tell you which era of your printing used which approach.
Check the destinations automatically
Once destinations sit in a column, testing them is a script or an off-the-shelf link checker.
- Record the status of the first request and of the final URL after redirects.
- Record the full redirect chain, not only the endpoint.
- Run from an ordinary connection, not a filtered corporate network that rewrites or blocks destinations.
- Re-run a week later. Intermittent failures matter more than they look.
Status codes lie in one direction. A 200 means a page answered, not that it answered with your content. Parked domains, vendor "link not found" pages, and generic app store landings all return 200 quite happily. Capture the page title and a chunk of body text so you can see what actually came back.
Pay attention to chain length. A chain that has grown to four or five hops is fragile, because each hop is a separate service that can fail independently. Note whether the hops are permanent or temporary, since 301 and 302 redirects leave very different traces in browser caches.
Signals that mark a code as dead or dying
- A 404 or 410 at the destination.
- A domain that no longer resolves.
- An expired or mismatched certificate, which stops many scans before the page loads.
- A 200 from a page that is obviously not yours.
- A redirect chain ending somewhere unrelated to the original campaign.
- Scans that used to arrive and no longer do, on a placement that is still physically there and still gets foot traffic. Most audits miss this one, because the link checker says the URL is fine.
- The account behind a short link has lapsed, or the vendor shut down its service.
- Physical degradation: sun bleaching, scratches, a newer sign papered over the old one.
Worth stating plainly, because it comes up in every audit meeting: the printed symbol does not wear out with age. A pattern printed in 2019 decodes to the same string today, and codes do not expire on their own. What expires is everything on the far side of that string.
When the destination now belongs to someone else
The worst finding in an audit is not a 404. It is a 200.
A campaign gets its own microsite domain. The campaign ends. The renewal notice goes to an inbox nobody reads. The domain lapses, and it may then be registered by someone who noticed it still receives traffic. Your printed code now sends people to a page you have no control over.
Nothing in an automated check flags this. DNS resolves, the certificate is valid, the page returns 200. Only a human comparing what came back against what should be there will catch it.
So build two habits into the audit. For every destination on a domain you do not currently own, look at the page with your own eyes. For every campaign domain in your registrar, confirm the auto-renew setting and the contact address. A domain attached to print you cannot recall is a permanent commitment, not a campaign expense.
Turn findings into a short list of actions
Sort by exposure, not by ease of fixing.
- Codes on material still in circulation and pointing somewhere wrong come first. A code on packaging that ships daily outranks a poster in one lobby.
- Routed codes you can still edit are the cheap wins. Change the destination, rescan a physical copy, close the row.
- Static codes on a domain you control get a server-side redirect.
- Static codes on a domain you no longer control cannot be fixed at the destination. The options narrow to overlays, reprints, or accepting the loss.
- Codes nobody can justify get retired: taken off the wall, marked archived in the record, and never revived.
Record an outcome on every row. An audit that produces findings without dispositions gets redone from scratch next year.
Set the review cadence while you still care
Quarterly for codes on high-volume packaging and anything tied to payments or safety information. Annually for lobby signage and long-lived placards. On top of that, run a triggered pass whenever one of these happens: a website migration, a domain change, a CMS replacement, a vendor switch, or the departure of whoever owned the codes.
Put the next review on a calendar with a named owner before you close the spreadsheet. Then walk your own ground floor this week with a phone and count how many codes you can account for.
