The internal audit has the potential to become a game changing process, but often, it does not and we see,
- An internal audit programme that delivers little more than perfunctory compliance.
- Weak efforts by internal auditors that go through the motions, and nothing more.
- Internal audit findings that could deliver positive changes, but no actions follow.
These have become the standard for many organisations.
For some companies, it has been that way for years.
The truth
An internal audit is often treated as a box-ticking exercise to satisfy quality standards such as ISO 9001. After internal audits are complete, third-party auditors are usually satisfied the programme and schedule have been followed but rarely review the internal audit reports for real value. Late internal audits, or a time starved internal audit program are not ideal, but so long as the audits are reported, the internal audit process is often considered complete, and everyone moves on.
The concerns
Top management does not commit
Top management is supposed to show commitment to the quality system. One way of showing that commitment is by taking an interest in what goes on within the mysterious world of the internal audit. Some do. Plenty do not.
If senior managers took more notice, and supported the process, making it clear they have an interest in the audit programme and its internal audits, there would certainly be better results and perhaps an up-turn in auditors themselves, feeling valued.
How about a quarterly internal audit review, headed by an MD, for example. I have seen them work. Superb they were. All auditors in attendance, discussing the pros and cons of audit life. That senior member of management thanking the team and taking away those concerns that never seemed to get tackled. Such as, audits being cancelled at the last minute, audit durations getting curtailed because the process and its people cannot afford the time, nonconformities languishing in their open state for months.
The internal audit process is ‘owned’ by the quality department
It is quite common to see many roads of the quality system leading back to the quality department. It is no different with internal auditing. Of course, someone, or department, must facilitate the internal audit process but to leave everything to the quality function and virtually ‘cut the other processes off’, is poor form. I have seen teams of auditors that are entirely from the quality team. This puts strain on resources and worse, weakens the ‘independent’ nature that is desirable for successful outcomes. Of course, if you are certified to ‘ISO9001, Quality management Systems requirements’, this requires an impartial view to auditing, whereas ‘ISO19011, Guidelines for Auditing Management Systems’ mentions auditors should be ‘independent’.
It is going to take decisions by senior personnel to ensure the internal audit process is considered a business wide interest. There will need to be good communication throughout the organisation to sell the concept. Many people simply do not understand the reason for, or importance of, internal audits. Management are well placed to ensure the knowledge of the internal audit process is understood.
Audit schedule does not adapt
The same audit schedule, year on year. It is a bit dull and does not meet the requirements of the most common quality management system standard, ISO9001.
The expectation is that the audit programme and schedule, changes in line with:
- previous results from audits,
- changes affecting the organisation (extremely broad statement),
- the importance of the processes you are going to audit.
Those three items alone are surely going to warrant a few changes from one audit schedule to the next. Other standards also expect a change in schedule when such things as performance trends change. It makes a lot of sense.
Customer complaints, new product lines, cyber risks, regulatory reviews, objectives shift, key people turnover. These are all reasons to change the schedule. That means, increasing or decreasing, internal audit frequency, duration or depth.
Checklists do not change
I am a personal advocate of checklists. They have many positives. Keep you on track. Reduce bias. Ensure you do not forget what to cover. The issue I have, is when they stay the same, audit after audit, we may not be reacting to process changes in sufficient detail. Of course, the internal audits are samples, so you would never be expected to check every clause. Therefore, it is a wise move, to change the questioning occasionally, to bring in items that have not been previously covered, or to include process changes, or items that were weak the last time round.
During internal audit training, we explain how to write checklists and how it is possible to have a different one each time, to accompany the auditee. Keeping the same checklist is OK, but not if they stay the same for too long. Even very technical processes change occasionally, and the checklist needs to be adapted to keep in line.
Review the checklist forms occasionally. Review the questions and the results achieved. Perhaps make the checklist review an element of the Plan Do Check Act cycle of improvement for the internal audit process itself. Talk to auditors, auditees, process owners. Get their opinions on whether they thought the questions were representative of the process. If it is a general checklist, is it too vague. Do some areas require specific questioning. Some ‘special’ manufacturing processes, such as heat treatment or forging, or some specialist processes, such as those that are inspection or calibration related.
Auditors lack internal audit skills
As auditors conduct their initial internal audits, the audits may be thin on coverage and detail. That is ok if there if there is sufficient information to meet the audit requirements. There are no rules about coverage. You just conduct the audit. The internal audit’s content and value will improve as the auditor gains experience and confidence. So, the audit itself, the report and follow up, can be improved on.
I tell all audit trainees to expect their first efforts to have a few gaps. They will look back in 12 months and wonder how the report was ever accepted, with its gaps, and coverage not being ideal. That is OK. They will improve.
When entering the process of internal audits, it is a great idea to shadow those more experienced than you. Review previous reports that have been recommended.
Review processes that you are not familiar with before the internal audit takes place. Process owners or experts will be able to help.
Practice makes perfect. You should be conducting around 4 internal audits a year to hone skills. More is better. One or two is not sufficient.
If you really do not know the process and feel you would struggle to deliver a fair assessment, do not do it. Leave it to someone else.
NCs are not written accurately
Nonconformities are different to internal audit reports in that they need to be correct from the outset.
I see three key issues with auditors and nonconformities
- Auditors are incapable of finding nonconformities.
- Often, due to lack of internal auditing experience, or lack of knowledge of the processes being assessed, auditors walk by nonconformities, as they stare them in the face. They simply do not have the experience of processes or standards, to enable them to relate one to another, and raise findings.
- Auditors are incapable of writing nonconformities.
- Auditors lack the knowledge of what makes a complete, written internal audit nonconformity.
- For this, I would be looking to higher authorities on the subject or speaking with more experienced auditors. Find training. Lead and internal audit training packages have ‘writing nonconformities,’ as modules. Tell the tutor you would like detailed coverage, then honest feedback, when you write your nonconformity and keep writing them until you are proficient.
- Auditors are scared to raise nonconformities.
- Cultural issues often mean nobody wants to see nonconformities. I conducted internal audits for company whose operations manager almost collapsed when I presented an audit report with 3 nonconformities! “I don’t want any of those,” he announced. I left the week after.
Auditors are not traffic wardens
A traffic warden’s job is to identify offending situations. That is not what our internal auditors should look for. You will never get a thank you from a traffic warden. “Well done mate, that is great parking!” That’s a phrase we will not hear.
The internal audit process is supposed to assess for conformity. That should be in our internal audit scope. One of the reasons for the audit. We should not go looking for the defective stuff. However, improvement opportunities and nonconformities are occasionally highlighted and need to be reported. See them as chances to improve. Count the value of the change, e.g. as a cost of poor quality, and sell what you do.
I have met a few auditors that love themselves. Egocentric. Incredibly sad. They try to catch people out. Make us feel nervous. A chap I met used to stand on his tiptoes when he found an issue. Got himself all excited. Do not be that person.
Lack of objective evidence
I see many 3rd party audit reports that simply summarise what was found. That is probably ok, but internal audits could, and should, have more detail, including objective evidence.
‘I went to the maintenance department, and it was satisfactory’. I have read that in reports. It lacks detail or any evidence that you were even there. Record measuring equipment serial numbers, sales personnel training document references, material types and supplier names, purchase order numbers, document revision levels. This is all sound objective evidence.
Audit reports take too long to write up
‘When will you have that report done’?
We have heard that one before. Then two weeks later, it is done. That is, if you can remember everything you covered. It is good discipline to create reports straight away, but that is not always easy. If you can create a ‘leaner’ way of auditing, it will change the audit dynamic.
Recently I asked AI to ‘create me a ten-point internal audit checklist for a torch assembly process, in line with and including the clause numbers of ISO9001’. The result was quite good. I slightly modified the questions and removed some I felt were not needed, then added others I wanted to cover. I saved a chunk of time. Of course, the resulting offer is only going relate to ISO9001 and it cannot add in the questions that you would like to ask about the local processes and their documents. It was a particularly good place to start.
These days I use a tablet and type my notes as I go. Then when I am finished, it takes about 15 minutes to tidy things up. It seems to work for me. Try it.
Nonconformities are not owned
This is a common issue, but every finding is potential gold.
Nonconformities sit languishing and often never get addressed. Then the third-party auditor spots them during a surveillance audit. Or the nonconformity takes months to conclude when a few weeks or even days should have been enough.
The most successful internal audit programmes I see, are those that have clear and visible owners, sponsors, champions. The profile is high within the organisation. They are well communicated and actioned. Each finding has a clear owner and a proper action plan, and issues are examined to their conclusion.
Bonus. No objectives set for the internal audit process
An internal audit follows a process in a typical Plan Do Check Act style, but they often have ups and downs. Normal.
Processes usually have objectives, so why should the internal audit process be any different? It can be dangerous having quality objectives for internal audits as the audit outputs themselves can be altered to achieve targets. But, with good intentions, measurable objectives allow us to monitor progress and spot trends. Some of the simpler objectives could be,
- Audits completed on time (to review commitment to audit programmes)
- Audit findings closed (demonstrates management commitment)
- Total audit cycle time (from start to finish to check audit efficiency)
- Number of audit hours per person (to monitor and improve competency)
I am sure you will think of others
Senior managers should know
A well briefed, understanding, and results driven senior manager or management team should be aware of the potential benefits of a well drilled internal audit programme. If they are not, they should be shown. Without their support, you will struggle to make the positive impact the internal audits and their results deserve.
How to ‘find the value’ (See CQual Blog 1)
Internal audits create value when skilled auditors identify nonconformities and opportunities for improvement, and management follows through with action plans until change is delivered. When those improvements are clearly communicated, everyone can see their value to the business.
It really happened 01
A 2nd party supplier had a stale old internal audit programme that had not changed in at least 5 years. During an audit I raised a nonconformity, and, with me being the customer, I was allowed to give advice on what could work to make the process more effective.
We went through ISO9001’s requirements, and I highlighted that it was quite simple to follow but required commitment. The supplier re-created the internal audit programme and delivered some fantastic results. Each year after that the programme was tweaked to reflect exactly what was going on in the company.
It really happened 02
A client of CQual’s used a small team of people to conduct their own internal audits, which I think is the best option. However, the audits they had done over 10 years were single page summaries with scanned attachments and an average number of nonconformities for each year of 1. Yes 1, per year. Now, that would be OK in a well-managed quality system, but they had issues. However, they asked if I could manage the programme, conduct the audits and train their people to take over the running of the whole thing. 17 nonconformities were found in the first 6 months during audits that only took around 90 minutes each.
The last word
The internal audit process can be a beautiful thing.
Sell, sell, sell. It is a fantastic opportunity to change what we do, for the better.
I am happy to answer any questions. Use LinkedIn through replies to posts or direct contact.
This was written by a simple guy who genuinely believes internal audits can deliver great things, and that the process does not have to be complicated or time and resource heavy.
The author also has done, and still does, actual internal audits, today.