Looking to do Your Own Internal Auditing? Read This:

‘How can organisations get the maximum value from an internal audit?’ See below for some of the responses from around the world

Most of internal audit time is taken up looking at paper or reading computer reports and only a small amount of time (typically less than 5 per cent) is used for asking people questions. Asking people the questions usually produces the biggest amount of improvement – typically 80 per cent of improvements come from people and 20 per cent from inspection of paper. And does anyone read the paper work anyway?

The important and valuable thing about internal audits is that any improvements or corrective actions must be addressed. If these are not then it was not worth finding them out. They need to be completed in a timely manner and the root cause needs to be determined. If just corrective action is applied then you will see the same fault reoccurring. Only correcting the root cause will lead to permanent improvement. Once improvements have been made they need to be audited to check that the change was correct and that they have not slipped back into old ways.

Internal audits must include talking with all levels from process operators, technicians, management right up to directors. You usually find out more by asking operators about the system than any other group. They will openly tell you why they don’t follow the procedure and even give information that they pass onto each other about running a unit that their managers do not know. Asking operators questions also improves the health and safety environment and quality as the operators feel more involved and responsible for their quality managment system or environmental management system.

Internal audits encourage people to change their behaviour as they have the added work of filling in a request for corrective action and root cause analysis for every item identified and highlights the problem to senior management. It encourages people to identify problems before they are audited and to put them right. Some use internal audits as a way of highlighting to management that an area has a problem.

Rhian Newton Quality Systems Manager Flexsys Rubber Chemicals, UK

By being open, honest and not shooting the messenger. So often I have seen senior managers arguing with an auditor that an issue is not a non-conformance as they tend to be very competitive and fail to see that it is an opportunity for improvement, treating it rather as a failure.

Secondly the auditor needs to have the same level of thoroughness as the external auditor. Many find it difficult to issue a non-conformity report to one of their colleagues – cross site or intra-company auditing can help with this. The support of an external auditor when auditing the internal audit finding scan often be very beneficial and provide the internal auditor with the ammunition to be stricter in future audits.

Murdo Morrison QHSSE manager, Scotland

Today most of the organisations have made their internal audit process as a compliance requirement. This exercise happens before the external audit to ensure that there are no process deviations. What the organisations miss out is the effectiveness of the process. This can be improved by:

• deploying internal auditors who meet the auditor qualification criteria/ fully trained
• ensuring that they understand their role and responsibility
• making them understand how to do process validation , not just verification

The quality team needs to first understand the individual process objectives and verify if the same have been achieved using the metrics and process outputs. If this starts happening, the whole exercise becomes very meaningful, both for the auditees as well as auditors.

Once the processes are validated based on the process objectives, the overall effectiveness will increase dramatically. Most importantly, the organisation will also identify non-value adding processes and get rid of them. The moment the auditors start questioning the objectives and output, the focus will also shift from document verification to process validation. This will send the right signals that auditors are not there to just verify documentation but also judge whether the planned results are being achieved effectively.

M Sridhar Chakravarthi, KPMG quality registrar, India

Internal audits should serve as a potent and value-adding tool to bring continual improvement to the organisation’s effectiveness and efficiency. To be effective, results of audits must be communicated to the concerned areas and must demonstrate commitment to search comprehensively for root causes and formulate realistic and achievable corrective actions. An audit should be periodically conducted to ensure suitability of the system.

Gilbert Llovit Goodfound Cement Corporation, Philippines

I would make the following four recommendations for improving the internal audit function within an organisation:

1. Make the internal audit function/department a cost centre. In other words, they (internal auditors and relevant department) have to demonstrate they are profitable to the organisation. Profitability can be demonstrated by quantifying the costs and benefits obtained out of the results of the internal audits performed.

2. Ensure all auditors can perform integrated audits in order to make them more efficient and effective. Auditors need to be trained on all applicable management systems within the organisation.

3. Members of the audit team need to actively participate in all management review and business planning activities within the organisation. This will ensure they are aware of the business direction and strategies, and be able to incorporate those in their audit process.

4. All audits (whether environmental, quality or safety) need to be performed following a process approach. Inputs, outputs, indicators, resources, support and interactions are all applicable when conducting an audit for a specific process within the organisation. Performing audits by elements of the environmental or safety management systems do not add value to the audit process itself. Use the QMS (Quality Management System) process structure to accommodate the other management systems.

Chris Parra

I have been in the quality business for over 20 years and many things have changed in this time. Internal auditing is one of the topics that has been subject to changes in the standards used. There are various factors that have to be considered to make it effective:

1. The auditors have to be trained not only in auditing techniques and the standard used, but they must know the culture of the organisation, the boundaries between areas, the political divisions etc. Without such knowledge, the auditor is extremely limited and the audit will be of doubtful value. It must be remembered that the culture is constantly changing and the auditors must be made aware of the changes as they take place.

2. Auditors need to be able to view and understand the processes being audited. The auditor has to be able to follow the process in detail and ask pertinent questions. I do not believe that auditors have to have specialist knowledge of an area, but they must be able to understand, at the very least, the macro process. There are, of course, instances where specialist knowledge is necessary but this can be obtained through training or by using specialists to guide the auditors.

3. Each process is only one in a chain, frequently very complex. The auditor must be able to picture the whole or ‘macro’ process in order to understand the contribution that the process being audited makes to the whole.

4. Auditors must be able to visualise the ‘customers’ and the ‘suppliers’ in each process and be able to look for information as to the requirements for each stage in the macro process. The customers may be external and/or internal and all have to be considered. Likewise for suppliers, they may be external and/or internal. The process owners need to be able to demonstrate that they know the requirements of their customers and that they have accurately defined their own requirements to their suppliers.

5. Auditors must throw away the standard checklists for audits. Instead of this checklist culture, use only general headings and let the auditor follow his/her nose during the audit.

6. There must be a ‘champion’ for internal audits. In my organisation, I preach the word about auditing to all the directors and senior managers, convincing them of the usefulness of this practice.

7. Someone has to verify the on-going analyses of observations and, where appropriate, corrective actions. While I prefer that the auditor of an area verifies these points, I oversee this and, if necessary, carry out the verification follow up. This leads to continuous improvements and a very high visibility of the whole improvement process. The process owners perceive the quality of this service, seeing it adding value to their operations.

I am totally committed to internal auditing, on the premise that the audits are carried out to add value to the processes and not merely to satisfy an external auditor. With such commitment, everybody gets the maximum from internal audits and it becomes a ‘win-win’ situation.

Philip Sharland ISD process management and quality assurance, Alcatel Telecom