Gone are the days where every sub-clause of ISO standards have to be checked off during an internal audit. Your resources can be more cleverly focused to ensure high-risk activities are highlighted in your internal audit schedule.
When did you last review how you do internal audits?
Assess the risks associated with specific processes. Consider what have been issues for your business in the past, and what could affect your business in the future.
Here are 5 tips to get your started!
Tip 1: Invest time in planning.
As with most things, the planning stage is the most important! Setting up an audit schedule will be a bit of a process the first time. A good audit schedule should be developed based on evaluation of risks. Processes which have been evaluated as ‘high risk’ should be audited more frequently. Conversely, ‘low risk’ processes less frequently.
Decide how various areas will be audited and who will be involved. Some policies or procedures might best be covered by ‘horizontal audits’ (for example, looking specifically at one procedure and how it is being applied across several business areas), or by ‘vertical audits’ (process-based audits – read on to point #2!).
Tip 2: Conduct audits based on processes rather than procedures.
Traditionally internal audits have been conducted clause by clause, or by running through every internal procedure in order of ID in your system. Process-based audits are more efficient at covering various areas of your management system. For example, consider all the areas you can audit in a laboratory by following staff who receive samples, test and report to the customer.
Tip 3: Train your staff in audit techniques.
There are skills involved in internal auditing. If you want to see real benefits, auditors have to know how to ask questions, what questions to ask, what evidence to look for, how to record findings and follow up actions. The auditor should also understand the importance of the process for compliance and for continual improvement in the organisation.
Tip 4: Follow up on findings.
Sounds obvious, but don’t forget the improvement suggestions or non-conformances once they have been written on an audit report. I have seen it many times; often when the system for following up internal audit actions is separate from what you would normally use for investigation of issues.
I recommend for this reason having one system for investigating and following up all improvement suggestions, non-conformances, customer complaints… no matter what the source. This makes it much easier to keep track of progress towards addressing each action.
Tip 5: Monitor and continually improve.
Think of your internal audit schedule and processes as an ever-changing organism. As your business evolves, so must the emphasis you put on internal audits of particular business areas.
Once the foundations have been set for a risk-based internal audit schedule (planning – tip #1!), re-visiting it should not be too time-consuming because you are just considering what has changed. If you see internal audits as more of a pain than a positive process, perhaps you need some help.
In addition to tailored training (which I have not been shy about ‘plugging’ in tip #3), Q&A also offer you help with:
Conducting risk-assessments;
Rationalising your internal audit schedule based on risk;
Conducting your internal audits;
Investigating and addressing non-conformances and improvement suggestions.
Comments