Annual Internal Audit Plan to Audit Everything?

[kalehner]

2. What do you think is the intent of the following statement in the evidence section of the finding --- “The internal audit records do not show that internal audits are tracking process performance to metrics and meeting specified goals of the process” ---

I suspect the audit records should contain evidence that the audit researched and verified the process performance goals/targets etc and then confirmed that, at the end of the process, the records showed that the goals/targets were being met

The CB audit report discussing the auditor’s review of the internal audit process made the following comment. “Process is not effective at monitoring process effectiveness”.

Please help me understand what is wrong with our approach to process auditing described below and/or why a CB would find it unacceptable.

On the day of the audit we determine what product is being manufactured in the process we intend to audit. We determine the process specification in agreed to specifications with the customers, confirm these are consistent with those defined in the control plans and the product specification in our online database.

In this example we start at the input end of the manufacturing process and indentify the specific materials being input to the process. We then move upstream into the purchasing process to determine if these inputs (raw materials) have been verified as meeting our specifications. If we determine that everything is the way it should be we conclude the process is under control (effective). If we find things are different than they should be (the raw materials can not be verified as meeting our specification) we conclude that the process is not under control (ineffective) and create a finding of nonconformity.​

Please help me understand why this audit process does not “monitor process (purchasing) effectiveness”. Why is it important to identify an overall performance metric for this process and assess whether that metric is being met if I already have evidence of process effectiveness? What is the value of verifying or not verifying that the purchasing process objective is being met when this is one of the inputs to management review? Why duplicate the review that should occur during management review? Management review (5.6.2 c.) seems to be a more appropriate place for this assessment as management is in a position to intervene to create change (5.6.3 a.).

 

[AndyN]

I'm thinking that the auditor believes you didn't audit the actual Purchasing process, you looked at the output...as an input, kind, sorta..

The traditional approach would have taken the input to the Purchasing process (requisitions in various forms), looked at the supplier monitoring/performance to ensure a source of know performance was selected, turned that into a purchasing spec. Then the audit might have looked at the delivery of the product and any verifications inspections performed to see if the stuff came in correctly, in the right quantity on time, undamaged etc. I suspect that's what the auditor was expecting...and I'd be thinking the same, not what you did (or sounds like to me)...

The simple answer to your last point is, because you didn't verify they followed the purchasing process. You simply looked at the product that arrived and took it that it must have been the result of the Purchasing process being followed and that the req. was fulfilled. However, that's not - or doesn't appear to me to be - what you did.