Consistently Late Internal Audits- Any Suggestions?

[AuditFan]

Its an engineering company with Sales, Procurement, HR, Field Support and Engineering (mainly) audited. Not rocket science. I have a form where I have taken all the Standards Clauses and put them in plain English (really). I have id'd the Clauses that apply to the Process and give examples in another column of a) the evidence to look for and b) other ways to rephrase the question for each process.

I wouldn't do audits like this, tbh. I think you're setting yourself up to fail. Apart from anything, you should be giveing "ownership" of the audits to the auditors. They need to plan the audits. It should be about the process not about clauses (in any language) and make them sit down with management when they come up with their things to check. When you do everything FOR the auditors they won't do the one thing you need them to, because you set a presecendent. Telling them what to look for etc is abrogating their responsibility for the work of auditing. I've seen it before and I was doing the remedial activities. TBH you may be beyond getting your current auditors back. I'd go with what @John C. Abnet suggest for a while, until everyone can see how to do them (as long as he doesn't just replicate the CB audits, that is )

 

[BradM]

$650.00 to complete and submit the internal audit report within 15 days prior to the due date.
$500.00 to complete and submit the internal audit report on-time.
$300.00 to complete and submit the internal audit report on-time within 15 days after to the due date.

Maybe restructuring the incentive will help.

Now... I don't know their situation. They may have so much work and other activities; and given what it takes to complete the internal audit, $1000 is nothing; I don't know. I know that's horribly basic, but if the person is... hey I'll get my cash, so I'll wait until the last second to get it done; the incentive program could be fueling part of the issue.

 

[John Broomfield]

Its an engineering company with Sales, Procurement, HR, Field Support and Engineering (mainly) audited. Not rocket science. I have a form where I have taken all the Standards Clauses and put them in plain English (really). I have id'd the Clauses that apply to the Process and give examples in another column of a) the evidence to look for and b) other ways to rephrase the question for each process.

Buckeye,

You seem to have spent a long time alone in your office. Your cookie cutter approach seems humdrum to me and may easily descend into box checking.

It suggests to me that your auditors are not encouraged to work with an independent (thinking) mindset but instead are told to complete your forms.

Personally, I would see this job as soul destroying.

Instead invite your audit team to redesign the auditing process so:

1. The objectives for the audit programme come from top management
2. Each audit has its own objective
3. The checklists are prepared fresh for each audit by the auditor
4. The auditors feel confident to ask any question they like* provided it contributes to the objective
5. The auditors keep notes on the checklist as they go
6. Evidence is agreed with the auditee as the notes are made
7. The auditor preps her or his Audit Report immediately for presentation in the closing meeting

* Don’t worry the standard will support just about any question.

Being as your auditors are busy with their day jobs do not delay completion of the report so show them how to complete their reports on the day of the audit.

Engage your auditors in redesigning the process so it is interesting and works well for everyone.

John

 

[RoxaneB]

1. I give 30-45 days so they can handle their other duties. If gave two weeks, all of them would be late.

With all due respect, have you tried a shorter window? Again, by giving them a larger reporting window, they are essentially permitted to go back to their normal jobs, get sucked into something else, and then forget what actually happened on the audit. As lovely as detailed notes are, the longer the window, the longer the delay, the more that is forgotten. Shorten the window.

And if reports are still late, at management review, you call out their boss (presuming their boss is part of senior leadership)...not them.

3. Yes I do. When I hand out the assignments, I review who they will audit and information on the process. I also tell them to ask me any question along the way (even volunteer to sit in with them). Ask again when I check in before the due date.

That's not really asking if there's anything else you can do to support them. You're also spoon-feeding them. Why not ask them who they believe should be audited and the approach they'll take. They're adults. Let them take the lead and you simply coach them.

6. Is (Management) silence an answer?

Even more of a reason to not point fingers at the auditors but rather highlight a deficiency within senior leadership's...well...leading.

As Jim said, we really haven't heard a reason WHY they're late. Lots of high-level, excuse-type reasoning, but no actual WHY.

 

[Jim Wynne]

I agree with Sidney. This seems to be a classic case of responsibility without authority, which will always lead to fear and loathing. Impetus must come from the top. If it did, we wouldn't be having this conversation, and if it doesn't, nothing will improve. It appears to have been confirmed that the extra money didn't help. All of that money could have been saved if top management set and enforced the requirements.

 

[John C. Abnet]

I agree John--with getting external source to do internal audits. Maybe that is a possible solution (depending on cost). I am linked in to you. I will reach out to you there for further thoughts.

Ok...looking forward to discussion.

Be well.

 

[Jean_B]

Tbh most succes was had with auditors which had project based jobs, and were between projects. The only process based job which can do audits without interruption/distraction is a the dedicated audit-process job (full-time) auditor.

Thus, counterpoint to much of the above (we have/are continuing to struggle with the same now and then, so I feel spicy enough to advise an option I haven't been able to get done (yet)):
Make it the process owner's responsibility to be able to show a frequently audited process, by defining it as part of compliance. Have them pull it, instead of you pushing it (in lean terms). This also distributes any pain areas, as it is narrowed down to that process owner/process.

I also agree with the value of internal auditors over that of external ones, because a lot of the true risks and opportunities reside in specifics that an external auditor simply cannot pick up quickly enough. Specific value where externals win are compliance audits (regulation to system), because it's usually wasteful to keep an internal auditor trained on those. Luckily those only mostly apply in regulated sectors.

 

[Randy]

I didn't even really pay attention to the time frame involved..........30-45 days? I'm sorry but it's time for my renowned bluntness.... 30-45 days for an internal audit report is one of the largest baskets of horse bagels I've heard of in a while.

I might write upwards of 40 or more audit reports a year, not internal reports either, but multi-standard, multiple auditor, multi-day, high risk reports, whether they be annual surveillance, Stage 1, Stage 2, recertification, extension to scope, certificate transfer, annual synthesis, corrective action close out, you name it in the ISO world and I do it (as do other participants here as well). No matter what type of job, no matter how complex, no matter the risk, the performance metric I meet is 2 days, that's it 2 business days. There is absolutely no rhyme or reason for 30-45 days for some internal audit report, and I don't care if you're auditing a process for making chewing gum or creating synthetic Human DNA (and I've done both). You are shooting yourself in the butt from the git-go with this 30-45 day stuff. Volunteer, voluntold, drafted, hood-winked or otherwise, you are allowing your auditors to scam you from the start, and have created an equation for failure.

Go to your leadership, change the process, tighten the parameters and get people that want to do the job.

Question...How large is your organization? 5-10-100-1000 people or what?

 

[Buckeye001]

With all due respect, have you tried a shorter window? Again, by giving them a larger reporting window, they are essentially permitted to go back to their normal jobs, get sucked into something else, and then forget what actually happened on the audit. As lovely as detailed notes are, the longer the window, the longer the delay, the more that is forgotten. Shorten the window.

And if reports are still late, at management review, you call out their boss (presuming their boss is part of senior leadership)...not them.



That's not really asking if there's anything else you can do to support them. You're also spoon-feeding them. Why not ask them who they believe should be audited and the approach they'll take. They're adults. Let them take the lead and you simply coach them.



Even more of a reason to not point fingers at the auditors but rather highlight a deficiency within senior leadership's...well...leading.

As Jim said, we really haven't heard a reason WHY they're late. Lots of high-level, excuse-type reasoning, but no actual WHY.

1. shorter time. That is where we started- 2 weeks. They said they needed more time and they suggested 30.
2. calling out bosses. I have not tried that.
3. spoon feeding. all the things i've mentioned: questions per close, meeting, etc. have come from meeting with them over the last four years i have had this responsibility. tried making it easier for them.
4. reasons. nothing that is legit. my other role "real job" requires 50-60 a week. to show them i am not asking them to do anything more than i do, i assign myself an audit too and i do not partake in the bonus. i do not have "manager" (or any exec. title) on my business card.

 

[Buckeye001]

I didn't even really pay attention to the time frame involved..........30-45 days? I'm sorry but it's time for my renowned bluntness.... 30-45 days for an internal audit report is one of the largest baskets of horse bagels I've heard of in a while.

I might write upwards of 40 or more audit reports a year, not internal reports either, but multi-standard, multiple auditor, multi-day, high risk reports, whether they be annual surveillance, Stage 1, Stage 2, recertification, extension to scope, certificate transfer, annual synthesis, corrective action close out, you name it in the ISO world and I do it (as do other participants here as well). No matter what type of job, no matter how complex, no matter the risk, the performance metric I meet is 2 days, that's it 2 business days. There is absolutely no rhyme or reason for 30-45 days for some internal audit report, and I don't care if you're auditing a process for making chewing gum or creating synthetic Human DNA (and I've done both). You are shooting yourself in the butt from the git-go with this 30-45 day stuff. Volunteer, voluntold, drafted, hood-winked or otherwise, you are allowing your auditors to scam you from the start, and have created an equation for failure.

Go to your leadership, change the process, tighten the parameters and get people that want to do the job.

Question...How large is your organization? 5-10-100-1000 people or what?

1. i've responded to the 30-45 days. it was their request when they said 2 weeks wasn't enough
2. there are no volunteers.
3. after this March audit, i will go to leadership
4. about 160 (COVID and the mass resignation has taken us down from around 210)