Internal Audit Questions

[andrekmh]

Hello everyone,

First of all, I would like to say how interesting and friendly this forum is. Usually I do not participate in forums given their aggressive nature most of the time but this one I found very different from what I have seen so far, people are very polite and helpful. So congrats keep up this culture!

I have searched past posts and did not find anything related to what I need, so apologies if there is something like this somewhere in the website.

I have been given the task of preparing my company documents for this year ISO audit, I never did this before so it has been a challenge.

I need to create 6-10 questions for our Internal Audit report for each of the following processes.

-Risks and Opportunities
-Quality Objectives
-Monitoring and Measuring Equipment
-Document Control and Records
-Control of External Products and Providers
-Product and Service Provision
-Nonconforming Product and Corrective Action
-Monitoring and Measuring Results
-Internal Audit
-Management Review
-Customer Requirements

Would you guys have some sort of example or list of questions from where I could learn from ?

 

[Johnny Quality]

andrekmh,

Welcome.

Why don't you start with the the information on how each process is performed and perform your internal audits based on that?

 

[RoxaneB]

Hello everyone,

First of all, I would like to say how interesting and friendly this forum is. Usually I do not participate in forums given their aggressive nature most of the time but this one I found very different from what I have seen so far, people are very polite and helpful. So congrats keep up this culture!

I have searched past posts and did not find anything related to what I need, so apologies if there is something like this somewhere in the website.

I have been given the task of preparing my company documents for this year ISO audit, I never did this before so it has been a challenge.

I need to create 6-10 questions for our Internal Audit report for each of the following processes.

-Risks and Opportunities
-Quality Objectives
-Monitoring and Measuring Equipment
-Document Control and Records
-Control of External Products and Providers
-Product and Service Provision
-Nonconforming Product and Corrective Action
-Monitoring and Measuring Results
-Internal Audit
-Management Review
-Customer Requirements

Would you guys have some sort of example or list of questions from where I could learn from ?

Hello and welcome.

First things first, why do you NEED to create 6-10 questions? Where did this number come from? There typically is no min/max number of questions to be asked.

To Johnny's point, do you have documentation upon which to base your questions?

Or, is this a homework question where you have been asked to come up with some example questions to ask? In this case, the requirements (i.e., the 'shall' statements of the standard) give you the basis of your questions. Keep them open-ended (i.e., NOT questions that require a yes/no response) in an effort to prompt a more detailed response from the auditee.

 

[andrekmh]

First things first, why do you NEED to create 6-10 questions? Where did this number come from? There typically is no min/max number of questions to be asked.

It is just the number we agreed upon in our last meeting given that in the past auditors have complained that only 2-3 questions would not be enough to cover the process. I do not have experience like I said but from I have been reading in our Audit Reports from past years, seems to be a very subjective process. It is up to the person auditing to be picky or not. In the case mentioned before we did not get a minor or major NC but a Room for Impromevement.

To Johnny's point, do you have documentation upon which to base your questions?

If you don't mind Johnny I will answer you and Roxanne here, and the answer is that I do not know what you guys mean by this . I do have several QMF forms related to each of those processes as evidence of their conformance.

Or, is this a homework question where you have been asked to come up with some example questions to ask? In this case, the requirements (i.e., the 'shall' statements of the standard) give you the basis of your questions. Keep them open-ended (i.e., NOT questions that require a yes/no response) in an effort to prompt a more detailed response from the auditee.

I would say in this case is more of a homework but I will be the one auditing, I am pretty much the lead on this project since everyone hates it. I do not have access to the standards and to be honest I don't think we have it anywhere in the company. We have been doing this for more than 10 years and at this point I think they just have their own internal manuals to pass the audit year after year but you gave me an idea and I did find a Procedures Manual which explains a bit of how a successful process should look like.

 

[Johnny Quality]

andrekmh,

I agree with Roxanne, 6-10 questions per process sounds arbitrary. I would struggle to perform an effective process audit if I could only answer 10 questions.

The "Procedures Manual" sounds like it could be promising. Your organization should have some sort of documentation that states how the organization functions and this manual could be it.

Do you have any experience internal auditing?

 

[RoxaneB]

It is just the number we agreed upon in our last meeting given that in the past auditors have complained that only 2-3 questions would not be enough to cover the process. I do not have experience like I said but from I have been reading in our Audit Reports from past years, seems to be a very subjective process. It is up to the person auditing to be picky or not. In the case mentioned before we did not get a minor or major NC but a Room for Impromevement.

No where in the standard does it state anything remotely close to "The internal auditor shall ask..." a certain number of questions. If your auditor - was this an external auditor? - complained, let him/her complain. Unless there is a documented requirement within your own organization's process that a certain number of questions will be asked, this is, in my opinion, a non-value add recommendation.

That said, your auditor is right that it is likely 2-3 questions in insufficient to truly see if the requirements of the standard as well as your own organizational requirements have been adequately and sufficiently met.

If you don't mind Johnny I will answer you and Roxanne here, and the answer is that I do not know what you guys mean by this . I do have several QMF forms related to each of those processes as evidence of their conformance.

What we were asking was if you have documented processes (e.g., work instructions, procedures, training materials, meeting agenda, etc.) that help you understand what the organization says it does. Your questions can be influenced by this. For example, if your internal audit procedure says that internal audits are scheduled based on the importance of the activity and previous results, you could ask something like:

1. How are internal audits scheduled?
2. How is the "importance of the activity" determined?
3. How do previous results influence the schedule?

I would say in this case is more of a homework but I will be the one auditing, I am pretty much the lead on this project since everyone hates it. I do not have access to the standards and to be honest I don't think we have it anywhere in the company. We have been doing this for more than 10 years and at this point I think they just have their own internal manuals to pass the audit year after year but you gave me an idea and I did find a Procedures Manual which explains a bit of how a successful process should look like.

If you don't have a copy of the standard, I highly recommend you obtain one. Why? Because the standard contains the requirements of the QMS - your external auditor is auditing to this and you do not have any ability to challenge or argue findings if you cant not say, with confidence, that there is no "shall' upon which the auditor can base his/her finding.

The standard is also what you compare your organizational processes to and it contains the requirements upon which your QMS is based.

 

[Tagin]

I do not have access to the standards and to be honest I don't think we have it anywhere in the company.

To echo what Roxanne said, 9.2 says

The organization shall conduct internal audits at planned intervals to provide information on
whether the quality management system:
a) conforms to:
1) the organization’s own requirements for its quality management system;
2) the requirements of this International Standard;

If you don't have the standard, then you can't audit your QMS to the standard.

It's not that expensive, and will make operating your QMS - including internal audits - much easier.

 

[andrekmh]

andrekmh,

I agree with Roxanne, 6-10 questions per process sounds arbitrary. I would struggle to perform an effective process audit if I could only answer 10 questions.

The "Procedures Manual" sounds like it could be promising. Your organization should have some sort of documentation that states how the organization functions and this manual could be it.

Do you have any experience internal auditing?

Thanks for your help Johnny.

 

[andrekmh]

No where in the standard does it state anything remotely close to "The internal auditor shall ask..." a certain number of questions. If your auditor - was this an external auditor? - complained, let him/her complain. Unless there is a documented requirement within your own organization's process that a certain number of questions will be asked, this is, in my opinion, a non-value add recommendation.

That said, your auditor is right that it is likely 2-3 questions in insufficient to truly see if the requirements of the standard as well as your own organizational requirements have been adequately and sufficiently met.



What we were asking was if you have documented processes (e.g., work instructions, procedures, training materials, meeting agenda, etc.) that help you understand what the organization says it does. Your questions can be influenced by this. For example, if your internal audit procedure says that internal audits are scheduled based on the importance of the activity and previous results, you could ask something like:

1. How are internal audits scheduled?
2. How is the "importance of the activity" determined?
3. How do previous results influence the schedule?

If you don't have a copy of the standard, I highly recommend you obtain one. Why? Because the standard contains the requirements of the QMS - your external auditor is auditing to this and you do not have any ability to challenge or argue findings if you cant not say, with confidence, that there is no "shall' upon which the auditor can base his/her finding.

The standard is also what you compare your organizational processes to and it contains the requirements upon which your QMS is based.

Thanks that helped greatly.

 

[Mike S.]

The internal auditor needs to ask as many questions as it takes for him/her to determine if the process is conforming to the requirements. Longer, more complex processes will generally require more time and questions than shorter, simpler processes. My Management Review audit can easily be completed within 30 minutes and a few questions, the Production audit takes hours and dozens of questions.