Advice about Internal Audit Frequency

[pammesue]

During an internal audit of the internal audit process, we have a history of a certain auditor's scheduled audits being WAY behind schedule.

In the corrective action, the auditor wrote this..."Consider changing audits from yearly to once every two years unless there is a change that directly affects that area--ISO doesnt specify interval time, only planned intervals and we made up the previous yearly interval, so if there are no findings in the audits then why dowe need to do them every year?"

Yeah I cant make this stuff up.

Does anyone really have a biannual internal audit schedule? The lack of commitment from the auditor and auditee is unbelievable...and one of them is my quality manager lol.

[Jennifer Kirley]

Here comes the bad news.

I audit five systems in my plant, and three of them run on a three year cycle, based on the three year registration cycle.

This means not everything gets audited each year, but some things do - critical processes like manufacturing, regulated processes and those which impacts our site goals appreciably. Others are audited every second year, while a few are audited once every three years. When being audited by 3rd party auditors I always run the gamut of explaining this.

I also show how the schedule can be sped up - and I demonstrate that it is sped up when problems are noted that should receive follow up in the coming year because they are important.

I've been called many things, but "uncommitted" has seldom been one of them!

[AndyN]

In Reply to Parent Post by pammesue

During an internal audit of the internal audit process, we have a history of a certain auditor's scheduled audits being WAY behind schedule.

In the corrective action, the auditor wrote this..."Consider changing audits from yearly to once every two years unless there is a change that directly affects that area--ISO doesnt specify interval time, only planned intervals and we made up the previous yearly interval, so if there are no findings in the audits then why dowe need to do them every year?"

Yeah I cant make this stuff up.

Does anyone really have a biannual internal audit schedule? The lack of commitment from the auditor and auditee is unbelievable...and one of them is my quality manager lol.

Pammesue - I'm going to guess that this is because the audits are not looking at anything to do with 'status and importance'! The fact that the auditor could even suggest such a thing indicates (to me) that it's because they aren't tasked with discovering anything other than compliance to a standard etc. Take a look at this and see if your internal audit program addresses the comments made.

[Sidney Vianna]

In Reply to Parent Post by pammesue

During an internal audit of the internal audit process, we have a history of a certain auditor's scheduled audits being WAY behind schedule.

That happens because top management (one of the primary stakeholders of the internal audit process) don't see the business benefit of internal audits. If they did, they would like more (and more frequent) audits. But don't feel bad. 97.83% (stats don't lie) of organizations certified to ISO 9001 report no perception of business benefits originating from internal audits. They only do it because 8.2.2 requires it. And through the motions they go.

In Reply to Parent Post by pammesue

In the corrective action, the auditor wrote this..."Consider changing audits from yearly to once every two years unless there is a change that directly affects that area--ISO doesnt specify interval time, only planned intervals and we made up the previous yearly interval, so if there are no findings in the audits then why dowe need to do them every year?"

If a 24-month interval becomes acceptable, why not a 36, 48, 120 month interval? Where is that magic threshold?

In Reply to Parent Post by pammesue

Does anyone really have a biannual internal audit schedule? The lack of commitment from the auditor and auditee is unbelievable...and one of them is my quality manager lol.

As a 3^rd party auditor, I wished organizations would pay attention to the REQUIREMENT which stipulates that internal audits SHALL (not should) be scheduled based on status and importance. If organizations paid attention to that REQUIREMENT of the standard (like Jennifer does), they should have no problem explaining and justifying to an external auditor why certain processes, areas, functions, etc... are audited at a higher frequency and others are audited less often.

But and once again, as long as internal audits are perceived a non-value added exercise, most organizations will do the bare minimum possible to "pass the external audit". Sad, but true.