Keeping the Internal Audit from Staying on Paper: How to Build a Working Programme

One of the problems certification auditors see most often is that the internal audit is done in a rush a week before the audit and findings are recorded only as "minor nonconformities". Yet the internal audit is the system's self-correcting mechanism. A working internal audit programme rests on five elements.

1. A risk-based annual programme

All processes are audited at least once a year; but risky or troubled processes are reviewed more often. A process with many customer complaints may be audited two or three times a year. The programme is approved by management at the start of the year.

2. Competent and independent auditors

An auditor should not audit the process they work in. A pool of four to six people from different departments who have taken internal auditor training is ideal. In small businesses, an outsourced auditor can be used for independence.

3. Real evidence

Instead of writing "conforms" and moving on, audit forms should state which record was examined, which employee was interviewed and what was observed. A good audit report has evidence for each finding: record number, date, person interviewed.

4. Root cause and closure

If a nonconformity is only corrected it will recur. The root cause is found by asking "why?" five times; the effectiveness of the corrective action is verified at the next audit.

5. Feeding the management review

Audit results, trends and repeated findings are discussed at the management review meeting. The internal audit thus becomes a data source for resource needs and improvement priorities.

Common mistakes

• The audit not covering all shifts
• Audit plans being leaked in advance and "preparation" being made
• Findings being perceived as a tool of punishment
• The same finding being repeated for years

When the internal audit is presented as a learning opportunity rather than an exam, employees share findings instead of hiding them. With our outsourced internal audit service we help you build an independent, evidence-based programme.

A practical model for small businesses

If you do not have a quality team of five or six, choose internal auditors from different departments and apply cross-auditing: sales audits production and production audits purchasing. This method provides independence and also helps employees learn the work of other departments. Once a year an external auditor can be added to refresh the point of view.

A measure of success

In a good internal audit programme half of the findings are "improvement suggestions"; a programme that only counts nonconformities is usually superficial. Asking employees after the audit "what did you learn from it?" is the easiest way to measure the programme's value.