Does Your Organization Really Benefit from Internal Audits? Time for a Change?

[AndyN]

I'd like to get some feedback from Covers about their views about internal auditing. From my constant involvement here and with many organizations, I feel it's time for the internal audit 'model' which is commonly in use today (like RABQSA course requirements) to be segmented and quite seperate from external (supplier/registrar) audit training (typically Lead Auditor training).

I'm sure this will be controversial......

Thanks for everyone's participation.

Andy

[RCBeyette]

Perhaps you can explain what you mean by 'model' so that any respondants are speaking the same language (and people who just view can follow along and potentially gain insight from this thread).

Why do you feel that there should be a distinct separation in the training? Or are you discussing the separation of the internal audit methodology from the external audit methodology?

I admit that I don't see the relationship between the poll and the original post.

[Jennifer Kirley]

Ditto RCBeyette.

Think of the three branches in government. I am thrilled to be a part of a process from the ground up in which auditing is changing from a justice system model to a sort of internal consultancy.

In my wanderings I can help people to connect the dots as they might not because of their process focus.

The executive branch can benefit by seeing how all the various efforts are contributing to the common goal (of reducing prices, etc).

High level managers can understand how to focus strategic efforts because, for example, adding a couple of staff members to this department can free up their highly paid people for R&D in product, or to break some new ground how about R&D for service we provide our customers? They may be too detail or objective driven to have a firm grip on this concept.

Middle managers can receive data that this or that improvement effort succeeded or missed expectations in areas outside their departments. They may be getting this information in part already, but if they aren't asking all the needed questions their data may have holes and--presto--misguided initiatives may result.

Supervisors can understand how their group's efforts have impacted the process by designing an efficiency gain or other improvement and managing its progress. They could be encouraged to view their contributions as parts of a whole system and less than a series of successful actions.

Workstation personnel could get a better sense of how their immediate efforts impact results later. By getting a sense of how to gauge doing things well and adopt a rather constant vigilance in "How might we improve this process?" they can become a part of the solution if they aren't already.

This is possible to do but it fundamentally moves away from the compliance auditing model. The movement process involves changing the focus on both large and small scales, ranging from the QMS focus itself to process mapping with a PDCA focus and a means to communicate meaningful results feedback in healthy ways.

This isn't for everyone. Auditing to such things while maintaining necessary compliance vigilance can become a muddle in my head.

I am in the process of designing a model that includes the necessary elements to prove value to process owners, train for repeat performance, win hearts and overall provide the vehicle (as a set of user-friendly tools and methods based on an existing quality-focused culture) for ratcheting the organization to the next higher performance level.

[ScottK]

I've done internal and external auditing and really don't see much difference of substance in the methodology.

As far as they are benficial?
That's all up to upper management, isn't it?
If they take them seriously then they will be beneficial. If they see them as a necessary evil, not so much. If they seem them as a non-priority then not at all.

So maybe the question would better phrased as "does your management support an audit program"?

The best audit process in the world will be ineffective if it's not supported.

[AndyN]

O.K - so here's my reason for asking:

Quality systems auditing - the implementation - is generally based on training which has its origins in supplier evaluations, back in the 80's. The process; planning, conducting, reporting and follow up, often doesn't address the role the organization's management has in determining the need for the audit. Sure, we know management might have to respond to audit findings, but there's much more to it than that.

The focus is normally on maintaining compliance to a set of requirements (which management generally don't care to understand) and delivers reports which are (in my experience) not tied to important business/customer satisfaction issues. In short, the fundamentals of internal audits are based on the auditor acting like an outsider who turns up, finds things to report, requires corrective actions and then 'leaves'.

This is the 'model' I'm refering to. I believe that as a result, audits are not supported by management, auditing isn't seen as a career progression, etc etc. the list is extensive.

Since many audit programs are set up based on what is taught in classes (Internal auditor, Lead Auditor) the teaching 'model' should be changed..........and hence the RABQSA requirements and the need for clear distinction of external compared to intenal audits. Sure some of the basics are similar (at a fundamental level) but in most respects a complete overhaul is necessary to start elevating the value of audits, past mere compliance.

Andy

[Crusader]

I voted Yes - measureable benefit....etc. Not so sure it's "measurable" but audits do take priority and are important to us. I guess that should put my poll answer in the middle of those two "Yes" answers! We do compliance auditing exactly as Andy described. I cannot think of any audits in the past 8 years where a "measurable" outcome resulted from an Internal or an External registrar audit. Sure there have been "Opportunities for Improvement" (OFI's) identified and acted upon but measureable? ...Nope.

FYI: My internal auditors do not like the Process Approach and therefore do not volunteer to audit anymore. They feel the "section auditing" was more effective. So, I end up doing all auditing except where I cannot audit myself. Internal Auditing here is voluntary it is not mandated...we all wear multiple hats and leaving your job to audit is difficult for many here. All of my auditors are from other departments and none of them report to me.

[AndyN]

In Reply to Parent Post by Discordian

I've done internal and external auditing and really don't see much difference of substance in the methodology.

Thanks for the comment - this is exactly my point - the methodology is the same because the roots of the training are the same..........

Andy

[Bev D]

In Reply to Parent Post by Discordian

I've done internal and external auditing and really don't see much difference of substance in the methodology.

which is Andy's point...

As far as they are benficial?
That's all up to upper management, isn't it?
If they take them seriously then they will be beneficial. If they see them as a necessary evil, not so much. If they seem them as a non-priority then not at all.

So maybe the question would better phrased as "does your management support an audit program"?

The best audit process in the world will be ineffective if it's not supported.

True enough - as far as it goes. but this is really an iterative and evolving process - as ISO 2000 intended.

initially, INTERNAL auditing is primarily about compliance; and for the purpose of achieving of registration it is value add...

However, after registration is achieved merely auditing for compliance is not very value add at all - in *my* opinion and expereince. and it therefor rapidly loses active support from management in many cases. It becomes nothing more than a police action or at worst it's perceived as "tattling"

I think the question really is: is internal auditing - as it is typically performed as compliance based - value add? if not, why not? or if so, why?
and the logical next question is how to make internal auditing more value add? Andy - correct me if I've gotten it wrong.

As for management support - yes it is necessary but not sufficient in itself. After all "management" doesn't always know what is the best approach to take. That's why they hire subject matter experts: us. we need to recommend and implement and demonstrate better ways of doing things. This is what gains effective management support. It's a bit of a chicken and egg thing. It's iterative.

When I was a Quality Manager I required my internal audit teams to perform effectivness auditing and de-emphasized compliance auditing after registration.

an example: at one of my previous jobs my lead auditor became 'enthralled' with a finding in the packout process. The procedure had a 'throwaway' line that the operator was to perform a certain aspect of the process while seated on a swivel chair. The operators didn't do this - they stood. They could have performed the operation while seated but chose not to. Now this seating 'requirement' was not needed for ergonomic or safety reasons. It was just a silly slip - the originator of the procedure had observed the original operator sitting on swivel chair and simply wrote it into the proceure years before the audit and subsequent revisions of the procedure didnt' remove teh statement. Now of course it shouldn't have been in there if not required, but in the grand scheme of things this was so far on the right hand side of the pareto for causes to our quality problems that it was ridiculous. we could have spent time issuing a finding and revising the procedure and then re-auditing to ensure that the change was implemented and logging it in the database and - oh since this was an internal audit finding we also needed to determine and eliminate the cause of why operators weren't following the procedure - but towards what end? We had real quality problems to deal with and a finite set of resources with which to address them. Not only did managment find this finding - and the many others like it - non value add, but they questioned the usefulness of the entire audit function. The auditor never saw or even really looked for the process issues that were driving our quality problems in this function.

From my perspective, auditing for compliance is needed but it should not be the primary purpose of internal audits. So compliance audits, in my opinion and my experience are of limited value add to any organization because all they do is maintain the status quo, they don't initiate significant improvements and are therefore not considered highly value add to managment.