What direction do you provide your internal auditors on OFIs?

[John Broomfield]

In an internal audit, who is the "client"? Why would anyone have to be paid?

The client for internal audits is top management. They may elect for their internal audits to include auditor recommendations or not.

In my experience most do not.

And the claimed demand for audit reports to include auditor recommendations has yet to reach sufficient strength for it to be included as a requirement specified by ISO 9001.

 

[Sidney Vianna]

The following is from ISO 9004:2018:

10.5 Internal audit
Internal audits are an effective tool for determining the levels of conformity of the organization’s management system to its selected criteria. They provide valuable information for understanding, analysing and improving the organization’s performance. Internal audits should assess the implementation, effectiveness and efficiency of the organization’s management systems. This can include auditing against more than one management system standard, as well as addressing specific requirements relating to interested parties, products, services, processes or specific issues.
To be effective, internal audits should be conducted in a consistent manner, by competent people, in accordance with the organization’s audit planning. Audits should be conducted by people who are not involved in the activity being examined, in order to give an independent view on what is being performed.
Internal auditing is an effective tool for identifying problems, nonconformities, risks and opportunities, as well as for monitoring progress on resolving previously identified problems and nonconformities. Internal auditing can also be focused on the identification of good practices and on improvement opportunities.
The outputs of internal audits provide a useful source of information for:
a) addressing problems, nonconformities and risks;
b) identifying opportunities;
c) promoting good practices within the organization;
d) increasing understanding of the interactions between processes.
Internal audit reporting usually contains information on conformity to the given criteria, nonconformities and improvement opportunities. Audit reporting is an essential input for management review. Top management should establish a process for reviewing all internal audit results, in order to identify trends that can require organization-wide corrective actions and opportunities for improvement.

 

[John Broomfield]

Thanks for the guidelines which, of course, are not requirements.

Every nonconformity reported is an opportunity for improvement.

indeed, the only bad nonconformity is the one that remains unknown.

But internal auditors should be careful not to make the systems they audit depend on them for improvement.

 

[Johnnymo62]

I must be real confused again.

I thought the Lead Auditor is the decision maker on what happens with individual internal audit reports. When I was a Lead Auditor, I would review each auditor's findings to decide if the findings were correct and what to do.

Like, initiate corrective actions to the departments that had a valid nonconformance.
Have the auditor correct their findings if the findings were invalid. I had Auditors not find the evidence of conformance...
I would talk to the department heads when OFIs were noticed. Then I would document their decision on the Audit summary and tracker.

It worked for us, then.

 

[Sidney Vianna]

Thanks for the guidelines which, of course, are not requirements.

Of course, not. But who is limiting the scope of the answers here to 9001? Internal audits are, historically, the biggest wasted opportunity for organizations to improve their systems. Just like customers audit suppliers, the concept of internal customers auditing internal suppliers should be effected. Nobody better than the downstream process/department knows what the upstream supplier can mess up.

Without a question, competent internal auditors should go beyond compliance verification and delve as well in to risks, opportunities for improvement. Failure to do so would be a waste of their time and knowledge. That's what ISO 9004 (beyond 9001) tries to convey. The problem is: the majority of internal auditors are NOT made competent for the unpopular task.

 

[John Broomfield]

I must be real confused again.

I thought the Lead Auditor is the decision maker on what happens with individual internal audit reports. When I was a Lead Auditor, I would review each auditor's findings to decide if the findings were correct and what to do.

Like, initiate corrective actions to the departments that had a valid nonconformance.
Have the auditor correct their findings if the findings were invalid. I had Auditors not find the evidence of conformance...
I would talk to the department heads when OFIs were noticed. Then I would document their decision on the Audit summary and tracker.

It worked for us, then.

The lead auditor is obliged to fulfill the audit objective which comes from the audit client. Before the audit the lead auditor advises the audit client what is needed in order to fulfill the audit objective.

Of course this is much less formal for internal audits where there are no contracts or travel expenses.

Even so for internal audits top management (as the audit client) has every right to expect their audit objectives to be fulfilled.

And rarely do we see an audit objective insisting that the auditor makes recommendations as and if necessary.

 

[Jim Wynne]

The lead auditor is obliged to fulfill the audit objective which comes from the audit client. Before the audit the lead auditor advises the audit client what is needed in order to fulfill the audit objective.

Of course this is much less formal for internal audits where there are no contracts or travel expenses.

Even so for internal audits top management (as the audit client) has every right to expect their audit objectives to be fulfilled.

And rarely do we see an audit objective insisting that the auditor makes recommendations as and if necessary.

Rarer still are audit objectives that follow a course like you're describing.

 

[John Broomfield]

When your internal auditors write their audit reports, what direction do you provide on OFIs? I'm thinking that tracking something that might never get done is not useful, and in a high pressure environment where all of my auditors are "volunteers" - OFIs never get done unless I drive each of them myself. During external audits I get a lot of verbal OFIs that I find useful, but I'm running into too many OFIs that are really non-conformances.

Should any system evolve to reflect the recommendations of its auditors?

Of course not.

As auditors what are we doing to prevent that?

My audits answered the audit objective. This meant that I avoided issuing OFIs as part of the audit unless specifically instructed to do so in the documented audit objective. Then the record would show what type of audit it was.

 

[Mike S.]

The fact that ISO 9001 has not made auditor suggestions mandatory says not enough for this desire to become a requirement.

Generally though, auditee managers like to ask for recommendations because it stops the auditor from auditing.

So if ISO doesn't make something mandatory it means most companies don't want it and we shouldn't do it?

Respectfully, this kind of narrow-minded, compliance-focused thinking is too prevalent.

 

[John Broomfield]

I agree. We look for evidence of effectiveness mainly.

But why would some managers stop this by asking their auditors for advice.