Internal audits – who are you pleasing?

If you’ve been doing internal audits just to tick the ‘yes we did that’ accreditation or certification box, you’re doing your business a huge disservice.

Of course, internal audits are necessary for compliance and conformance. But they can also drive real change and add value for your business.

As well as determining if the lab is meeting its quality standards, internal audits can identify opportunities for improvement. They can show you where additional training needs to occur. And they can help to increase staff awareness of the requirements of your quality system.

Here are some tips on how to use your internal audits as a powerful tool for change.

Improving the process

ISO standards require that you carry out an internal audit of your quality management system periodically (the frequency is up to you). That doesn’t mean that a complete audit has to happen annually since that would be enormously disruptive. That’s why we break it down into manageable pieces using an audit schedule.

Often internal audits can focus on defined areas of the lab that have been identified as problem areas. Particular sections may have had customer complaints or quality control issues and it makes sense to examine these.

However, it also makes sense to examine the planning and scoping of your internal audit program using a different focus. Have you identified the areas of key risk for your business? Have these changed since the last audit? Can you include them as part of your audit?

What are your business goals or and objectives? It’s worth checking if your internal audit process is being used to monitor these. Can you use the report generated from the audit to track goals and objectives?

Consider concerns or questions raised by stakeholders. Can you use your internal audit process to provide them with insights?

Do you always use the same checklist? Although it may be fit for purpose, if you’ve been trotting out the same one for years, consider whether this is really adding value. Think about what you’re really trying to discover – is your checklist providing you with this information?

Choosing your auditors

We’re written previously about auditing and questioning techniques. There’s also the issue of training staff to ensure they’re able to carry out an effective audit.

There are plenty of organisations that providing training for internal audits – in fact, we have an excellent course of our own. But if you’d prefer to train internally, you could consider developing internal audit training units.

These units could cover both general and specific topics about the auditing process for your business. They could be made available to all staff, not just to auditors. This will ensure transparency for the process and should make staff members feel more comfortable. If they know what to expect from an audit, they ought to be more accepting of the process.

Choosing staff from other parts of the business has benefits beyond avoiding a conflict of interest. It will give them an insight into the working of other sections and enable valuable professional interactions.

For a smaller business, maintaining a level of independence can be tricky. In this case, you may need to use the services of an external provider.

Identifying risks

As we mentioned, internal audits can be used to manage and monitor risks in your business. But they can also be used to identify emerging risks and challenges.

For example, there are regular reports in the media of cyber security breaches. Perhaps you could consider adding an examination of your data security practices as part of the internal audit.

Supply chain issues continue to plague some businesses. Talking to these stakeholders could uncover issues or gaps that need to be addressed. Consider evaluating the different risks and opportunities that could be presented by your suppliers and contractors.

Objective evidence

Audits are all about gathering data to obtain insights, not a test of the auditor’s or the auditee’s knowledge. This data must be objective. Staff failing to document weekly maintenance tasks is an issue – not liking the form they use to record the tasks is not, but the latter warrants some investigation as a potential improvement opportunity.

This data can include feedback from various sources. For example, social media could be used to identify customer opinions and complaints. This information could lead to an examination of customer service and turnaround time. Perhaps staff turnover and its effect on operational efficiency could also be examined.

And of course, reviewing data on any corrective actions is crucial. Not only will the accreditation or certification body want to see that this has occurred, but it makes good business sense. Were the identified actions taken effective? Or was there a recurrence of the issue?

While a document review is certainly part of the internal audit process, it’s unlikely that reviewing a procedure or document will yield sufficient information. The auditor should consider other reports and records along with interviews and witnessing.

Reporting

You expect a prompt report from your accreditation or certification body on the results of your assessment or certification visit. And an internal audit report is no different.

Information should be provided to the department that has been audited, including any nonconformities and evidence. The report should also include recommendations for rectifying these nonconformities.

The audit report will also need to be shared with management since they’ll need to approve the implementation of any recommendations and improvements. They should also know the kinds of non-conformances that are being found in the audit process because it tells them about the health of the business.

As it’s a requirement for any business that holds accreditation or certification, ensure the report is stored as part of the records for presentation during an external audit.

Evaluation

While the auditees may have work to do after an audit, this process shouldn’t be restricted to them.

Ask the auditees how they felt about the audit. How did the auditor perform? Did they feel as though they were being asked relevant questions in a non-judgemental manner? Did they discover anything about themselves or their role during the audit?

As well as demonstrating your interest in their opinions, reflecting on the process is useful for an auditee as preparation for external audits. It will also give valuable feedback to the internal auditor and allow them to improve their skills for next time.

The final word

The internal audit process is not just a requirement. It’s an important part of your lab’s continued success.

We also know that with a tightening job market, your lab may not have the capacity to undertake this work. And that’s where we can help.

As well as developing an internal audit schedule with you, we can also carry out those audits for you. This efficient, cost-effective solution will allow you to meet the requirements of NATA or your certification body.

For a confidential, obligation free discussion about how we can support your internal audit goals call Maree on 0411 540 709 or Diane on 0402 012 781.

Remember, you don’t have to do this alone!

Download the article Internal audits – who are you doing them for?

Read our complete guide to learn more about ISO 17025.