Re: Internal audits 3 year plan?
If only it were that simple, Randy. Sure it's not rocket science, but from some of the posts here on the Cove, it's not just a case of "If it feels good - do it"........
We read of internal audits done 'once a year' or something equally scary. A huge calendar of audits is almost a receipe for a lot of work, keeping it updated. And what do management really think about an audit 'manager' who constantly keeps adding to or rescheduling audits? You can see it on their lips........."Make up your mind!"
There is no way that audits can be of the right type of benefit if management are not intimately involved in the planning of the programme. To simply produce a calendar of audit events and then expect them to do anything but agree to it is naive. Of course they won't say anything about the schedule, why would they? Most management haven't got a good grasp of why audits are performed, so to expect them challenge the validity of the scope and timing of an audit is, frankly, bizarre!!
Audit Management must constantly strive to ensure that the focus, scope and audit performance bring back a report which confirms that a business process is effective and in control - trustworthy of delivering measureable results, as planned......no more, no less.
I'd wager there's only a small handful of audits, done at organizations which could satisfactorily demonstrate this!
What is really being discussed is a 3-year audit program comprised of a number of audits conducted over that time period for whatever the intended purpose consists of........(I read ISO 19011 once
)
This really, really isn't rockect science (I know, I worked at Aerojet for a while with real rocket scientists and they didn't do this)......Anyway, all your audits, audit program or as you call it audit plan (wrong use of that phrase in this case) has to do is determine whether or not you have effectively established, implemented and maintained your management system and whether or not your system is able to allow your organization to meet the committments of your policy and achieve you objectives.....that's it, nothing more and nothing less. The only real wrong way is the way that is not effective (for you) and the only really right way is the way that is effective (for you). As long as it works it doesn't matter what someone else likes or dislikes, they can start their own and try to do better if they're so hot and smart.
Just do what you think is right.
)This really, really isn't rockect science (I know, I worked at Aerojet for a while with real rocket scientists and they didn't do this)......Anyway, all your audits, audit program or as you call it audit plan (wrong use of that phrase in this case) has to do is determine whether or not you have effectively established, implemented and maintained your management system and whether or not your system is able to allow your organization to meet the committments of your policy and achieve you objectives.....that's it, nothing more and nothing less. The only real wrong way is the way that is not effective (for you) and the only really right way is the way that is effective (for you). As long as it works it doesn't matter what someone else likes or dislikes, they can start their own and try to do better if they're so hot and smart.
Just do what you think is right.
We read of internal audits done 'once a year' or something equally scary. A huge calendar of audits is almost a receipe for a lot of work, keeping it updated. And what do management really think about an audit 'manager' who constantly keeps adding to or rescheduling audits? You can see it on their lips........."Make up your mind!"
There is no way that audits can be of the right type of benefit if management are not intimately involved in the planning of the programme. To simply produce a calendar of audit events and then expect them to do anything but agree to it is naive. Of course they won't say anything about the schedule, why would they? Most management haven't got a good grasp of why audits are performed, so to expect them challenge the validity of the scope and timing of an audit is, frankly, bizarre!!
Audit Management must constantly strive to ensure that the focus, scope and audit performance bring back a report which confirms that a business process is effective and in control - trustworthy of delivering measureable results, as planned......no more, no less.
I'd wager there's only a small handful of audits, done at organizations which could satisfactorily demonstrate this!