Does Your Organization Really Benefit from Internal Audits? Time for a Change?

[AndyN]

As an internal auditor, I don't prepare a checklist and what preparation I do, I do only a few minutes before I start the audit.

What is the purpose of 'sharing' checklists? What happens if you don't stick to the checklist?

I think your audit program needs help if you're doing this! Do people feel as if they have to 'pass' the audit, like a CB audit? You don't want people to prepare 'evidence' before hand, it's not productive. If they can't produce records, then maybe one of two things is happening:-

You're asking the wrong people for the wrong thing, or

You're going to discover there isn't a very good system for records or the people don't know it!

Maybe, your doing too much auditing like a CB auditor. You should be 'proving' people know their process, including auditing recent activities, so their shouldn't be a problem with them finding the right records should there?

You might want to rethink the way you go about doing internal audits!

 

[JaneB]

What do you think of the idea to give checklist/questions to auditee/s before the compliance audit ?

Depends on what's on your checklists, and how specific your questions are. Like Howste, I am happy to give information about the kinds of questions I'll be asking and the kinds of info I'll want to see.

But I disagree that "audit is not a sort of exam." In a sense, it is - a test of samples at a particular point in time, to determine whether the system is being followed. And if I give too much information to them (and thus allow them to prepare everything), it won't be a valid test. The auditees may be very unstressed though.

I don't want them to decide what documents and records they will show me. If they show me evidence that they've carefully checked over before the audit, I may not find issues that need to be addressed. I always want to be in control of the sample so that I can collect evidence representative of what is actually going on in the system.

Me too - totally agree.

As an internal auditor, I don't prepare a checklist and what preparation I do, I do only a few minutes before I start the audit.

I'm surprised by your saying this. It seems to indicate you do no (or virtually no) planning for any internal audit! If so, then it's probably because you're a very experienced auditor.

You almost certainly do have a checklist, I venture to guess, but it's probably 'in your head'.

Or maybe we're both hearing different things in 'checklist'. I do use one (written or not). If written, it helps make sure I remember key things, and check for the same things across different samples. But I never feel constrained by it, I never hesitate to drop it if it isn't working and/or change it whenever I need to. It's a planning aid, that's all. I'd rather not give auditees 'the checklist' because it may mislead them. But I'll happily provide a list of topics and some sample questions.

Maybe, you're doing too much auditing like a CB auditor. You should be 'proving' people know their process, including auditing recent activities, so their shouldn't be a problem with them finding the right records should there?

Just so.

 

[JaneB]

Goodtimes,

The 3 year plan you lay out sounds broadly reasonable to me, presuming that there is very little actual change in your organisation (ie, it's very stable), there's little if any development, perhaps only minor improvements and that other indicators in your management system are not indicating problems.

The only bit I query is:

The scope of my audits are basically the same each time. Inputs/outputs, elements of the standard that apply and objectives and measures and taking appropriate actions should always be looked at.

I have a bit of trouble understanding how the scope could be the same every time, as I'd be inclined to vary it more. I also don't usually audit against 'elements of the standard', as that should be built into the design of the system - for internal audit, I want to audit against the company's own criteria, ie, its system (less so the Standard).

 

[AndyN]

You're right Jane - a very experienced auditor

I use a planning document based on my 'football' diagram. It's nothing like a conventional list of items to 'check off' as the audit progresses. It's a way to focus and condense the 'answers' that I should expect to see, during the audit - the 'planned arrangements' which are supposed to be in place.

Since most checklists I've seen are simply a listing of criteria (like ISO 9001) and a place to put a check mark (or 'tick') and somewhere to add comments, then my planning document is not even remotely similar. Indeed, giving the auditee a football before the audit would probably confuse them!!

I agree with your other posts. The idea of any audits which go over the same ground without change is an audit program looking for help......

 

[Chatman]

Thanks for all the responses..

I think I have to give more information. Currently, we're auditing projects on the basis of project management procedure which was prepared in accordance with ISO 9001:2000. Auditees are project managers and during the opening meeting we decided upon which project we would conduct audit on. So our questions are derived from the articles of that procedure. That's to say we want to know whether they know the procedure and whether they are managing projects accordingly; keeping the necessary records and respecting to time schedule and so on. Of course we do not limit ourselves by those questions..

 

[JaneB]

... our questions are derived from the articles of that procedure. That's to say we want to know whether they know the procedure and whether they are managing projects accordingly; keeping the necessary records and respecting to time schedule and so on. Of course we do not limit ourselves by those questions..

Those are the kind of general questions that I think is more than OK to give to your auditees. If audit is new to them, they may get themselves very worried about what they might be 'tested' on. Once they actually find out that they're just being 'tested' on whether they're doing what they're supposed to be doing (and hopefully are doing), it gets less stressful!

Perhaps I can illustrate the difference like this:

A. Specific-type questions on a checklist that I wouldn't use:

* Is the XYZ form for this project in the ABC folder?
* Is the form dated?
* Is the form signed by the Project Manager
* Does it have the correct project code on it? etc

That doesn't mean I wouldn't consider those things at some point, but this is too low-level and too 'Yes/No' for effective auditing IMO.

B. General-type questions on a checklist that I would use (& might well give to them beforehand). Note that my examples are definitely general, but that I'd have specific documents/records I'd be looking for in an internal audit, as specified by the system in use at that company)

* What is this project about? How is that specified & where?
* What is the process in use on this project? Is it following our requirements?
* Are adequate records available to show this, when & where required?
eg,: - Is there a project brief? (or whatever document)
- Are the contents adequate and suitable to state what is to be done?
- Only current versions in use (any changes? if yes, applicable procedure followed?)
* Does practice match the procedure? etc etc

 

[Citizen Kane]

Hi !

The real benefit comes when you have a auding team that knows for what to look and what it means production - to have a deep knowledge of it. Sine now we tryied different teams, but the most effective was a mix between production (the other production departments) and quality (but with production knowledge, not R&D !).

And this is a situation that adds value to our production when the auditors know what they are auding, not only looking at documents without any touch of the real situation. The interrest is not to pass the audit because it should be, but because it we are at that level.

You must not cheat yoursel that everything is GREEN, but in fact, beyond documents, you are worst.

 

[GAVINSM]

Undertaking our first batch of Internal Audits next week, so I shall see if they are worthwhile following those.

But will probably be to early to tell at this stage, but I do know that management on a whole are not fully bought into the process.

 

[David Hartman]

Apart from Audting Standard requirement, you can add Best and Bad practices seen across the Processes.

Will definitly add value to the Audit

sathis

In my past I worked as an internal auditor for about 14 years and the largest benefit we provided the company was in highlighting processes that excelled in their effectiveness and efficiency. Many times the audit report would not only note the adherence issues, but would also recommend that the area being audited take time to review how a separate department/work center/division was handling a particular process. Because of the internal auditors 10,000 foot view of the organization we were often called upon to provide input on the development of specific processes based on our observations of how this process was implemented in other areas (easier and less costly than re-inventing the wheel). I recognize that this isn't quite the same as real "benchmarking" (as you may not be selecting the best of the best - outside of your company), but it is a method for improving process effectiveness and efficiencies (especially if the adopting organization makes it their own) and adding value to your internal audit function.

 

[kgott]

Re: Time for changes - Does your organization really benefit from internal audits?

Gotta disagree with that Scott. I've learned on the cove here that whether not management take any notice of my audit findings as more to do with my skills as an auditor than anything else.

I've learned that if audit in a way that yeilds information that is useful to management about the operation of the busienss they're more likly to take an interest in my audits.

For what its worth I find this disheartening because I've learned that I'm a long way behind many on this cove in auditing and other skills but then thats why I spend a lot of time lurking around the cove