Internal Audit Questionaires - Checklist that is outside the box

[AndyN]

maybe this attachment/example can give you an idea.

thanks

This may not work as an internal audit checklist - Any series of questions should follow the 'process' you are auditing, to be of use. The example starts of with sampling document control - which isn't getting to the start of the Purchasing Process, at all! Indeed, in most places if you ask the questions the way they are written here, likely you'll get some strange looks.

There is another thread around here somewhere which asked how to audit a process which isn't documented. My reply should give a good basis for an auditors questions.

Oh, and one more thing - writing any questions down, isn't a substitute for having an auditor who knows something about the process they are going to audit. If anyone has at least half a clue about purchasing, a quick look at their process, or an interview with the manager is all you need to get you investigating the implementation. You don't need any prepared or canned list of 'fixed' questions to ask.

 

[Doug Tropf]

The use of checklists seems to be discouraged in the present "process based" approach to auditing. I find that a well crafted checklist serves as a beneficial tool in conducting process based audits.

 

[AndyN]

The use of checklists seems to be discouraged in the present "process based" approach to auditing. I find that a well crafted checklist serves as a beneficial tool in conducting process based audits.

I'd agree, Doug, if they don't support a process approach. IMHO, the examples given here don't do that in a manner that would clearly give the auditor a 'path' to follow. It's not the audit approach that's causing the problem, it's the format of the checklist..........

 

[Mueller Time]

We started with our own Internal Audit Checklist 6 years ago before we became ISO 9001 certified. We have since scrapped that list because following a checklist became a crutch for our auditors and did not give a true picture of our system. We found that our auditors did not follow the processes they were auditing, only the checklist.

We do still use an audit Questionaire, but they are developed for each individual audit (by the Internal Auditors) and are approved by the Lead Auditor prior to use. The Questionaires are just a few simple questions (or notes to look for evidence) related to the processes to be audited, are based on the process, the Standard and past audit results, and are used as a jump off point to help start an audit trail. From there the auditor follows the flow of the process, gathering evidence and making sure it meets our system's requirements.

We found that allowing our Auditors to develop their own questions helped them look closer at the processes that they were auditing, and they ended up taking more interest in our systems. I've had the same problems finding interested auditors and this seems to have helped us.

 

[AndyN]

We started with our own Internal Audit Checklist 6 years ago before we became ISO 9001 certified. We have since scrapped that list because following a checklist became a crutch for our auditors and did not give a true picture of our system. We found that our auditors did not follow the processes they were auditing, only the checklist.

We do still use an audit Questionaire, but they are developed for each individual audit (by the Internal Auditors) and are approved by the Lead Auditor prior to use. The Questionaires are just a few simple questions (or notes to look for evidence) related to the processes to be audited, are based on the process, the Standard and past audit results, and are used as a jump off point to help start an audit trail. From there the auditor follows the flow of the process, gathering evidence and making sure it meets our system's requirements.

We found that allowing our Auditors to develop their own questions helped them look closer at the processes that they were auditing, and they ended up taking more interest in our systems. I've had the same problems finding interested auditors and this seems to have helped us.

Wow - what a super piece of information! I'm happy to have read that! It supports what I've seen over the years too!

 

[easttn]

You guys are brutal. The guy was just looking for some help, none of your comments are helpful if your just getting started. From now on I'll keep all my comment to myself as the pundits on this forum are well in control. Jeezzze.

I'll continue to lurk as there is a vast amount of knowledge here. Thank you.

 

[SteelMaiden]

Sorry easttn, I did not mean to be brutal to anyone. The question was asked, and I tried to give feedback based on what the standard requires. If you feel that there is any other information I should have provided, please let me know. don't just bow out, because then we all lose in the exchange.

 

[Marc]

You guys are brutal. The guy was just looking for some help, none of your comments are helpful if your just getting started. From now on I'll keep all my comment to myself as the pundits on this forum are well in control.

People here do tend to be blunt, if that's what you mean by brutal. I've looked over the thread and I'm not sure what the issue is, but if you'll PM me your thoughts, I'll be happy to listen. I prefer not to derail the thread with further discussion about issues within this thread.

 

[Mueller Time]

You guys are brutal. The guy was just looking for some help, none of your comments are helpful if your just getting started. From now on I'll keep all my comment to myself as the pundits on this forum are well in control. Jeezzze.

I'll continue to lurk as there is a vast amount of knowledge here. Thank you.

:truce:Sorry, I wasn't trying to be brutal. I thought the idea was to share info and experiences.
If a checklist is what someone else is looking to do I would recommend it be based on their system, not word for word from the standard. (Basically I believe it should be tailored to focus on finding objective evidence that their system is being followed -- assuming their system follows the Standard). I would also allow for input from each individual auditor at each audit. This allows the auditor to add their own personal contribution to the audit if they so choose.

 

[Benjamin28]

I'm doing my 5th auditing course in as many weeks and I've had about 100 people that I have told the same thing.......If you use a checklist just use it as a tool to start the audit and help take you from the beginning to the end, letting it allow you to get off track and follow those audit trails that present themselves (I use the term Reeses Pieces), and to get back on track; and use the checklist as a memory aid to help reduce your workload as an auditor so you don't have to remember everything you need to look for and look at.

Don't get all wrapped around an axeltrying to get the perfect checklist...it ain't out there.

I agree 100% with Randy on this. The goal should not be to create the ultimate checklist, it should be to create the ultimate auditor. Using a checklist is fine and dandy, but the auditor should not use it as literal questions. The questions should be open ended and should address not only the literal requirement but the periphery of the process as well and the auditor should feel free to follow that course to whatever it reveals, be it reeses pieces, m&ms, or mouse droppings.