Not to prove you are compliant.<\/strong> To find out whether you are.<\/p>\n An internal audit that never finds anything is not evidence of excellence.<\/strong> It is evidence the audit is not looking \u2014 and an experienced external auditor treats it that way.<\/p>\n The purpose is to find problems while they are yours to fix<\/strong>, before a customer or a certification body finds them for you.<\/p>\n Internal \u2014 first party.<\/strong> You audit yourself. This article.<\/p>\n Customer \u2014 second party.<\/strong> A customer audits you, usually before contracting or after a problem.<\/p>\n Certification \u2014 third party.<\/strong> An accredited body audits you for a certificate.<\/p>\n The internal one is the only one you control<\/strong>, and it is the one that determines how the other two go.<\/p>\n Audit everything over a cycle<\/strong>, usually a year \u2014 not everything at once.<\/p>\n Weight it by risk and by history.<\/strong> Processes that have caused problems get audited more often. Processes that have run cleanly for years get audited less.<\/p>\n That is risk-based thinking applied to auditing<\/strong>, and it is what standards expect. Auditing everything equally is both expensive and less effective.<\/p>\n Write the schedule down<\/strong>, and follow it. A programme that slips every quarter is a finding waiting to happen.<\/p>\n FIGURE 1: PLANNING THE PROGRAMME<\/p>\n Cover everything over a cycle<\/p>\n Weight by risk and history<\/p>\n Write the schedule down<\/p>\n Auditors independent of the work<\/p>\n Nobody audits their own work.<\/strong><\/p>\n Why:<\/strong> you cannot see the gaps in a process you designed. And even with good intentions, the incentive is wrong.<\/p>\n In a small company<\/strong> this is awkward and solvable. Cross-audit between departments. Someone from operations audits purchasing; someone from purchasing audits operations.<\/p>\n Auditors need training.<\/strong> Not necessarily formal qualification for internal work, but they need to know how to audit \u2014 how to sample, how to ask, what evidence means.<\/p>\n An untrained auditor checks whether the documents exist.<\/strong> A trained one checks whether the process works.<\/p>\n Prepare.<\/strong> Read the procedure, the previous audit, any nonconformities in that area, any customer complaints. Come in knowing what to look at.<\/strong><\/p>\n Open.<\/strong> A short meeting. Explain scope and how long it will take. Reduce the anxiety \u2014 you get better information from people who are not defensive.<\/p>\n Gather evidence.<\/strong> The core of it, below.<\/p>\n Close.<\/strong> Report what you found, immediately. No surprises later.<\/p>\n Follow up.<\/strong> Findings become corrective actions, and somebody verifies they worked.<\/p>\n Three methods, and you need all three.<\/strong><\/p>\n Ask.<\/strong> Talk to the people doing the work. How do you do this? What happens when it goes wrong? What is annoying about it?<\/strong><\/p>\n That last question is the most productive one in auditing.<\/strong> People will tell you where the process is broken if you ask about friction rather than compliance.<\/p>\n Observe.<\/strong> Watch it being done. The gap between the procedure and reality shows here<\/strong>, and it shows fast.<\/p>\n Examine records.<\/strong> Sample. Pick some completed jobs and trace them through. Was every step done? Is the record complete?<\/p>\n Trace both directions.<\/strong> Take a finished product and work backwards to the order. Take an order and work forwards. Different problems surface each way.<\/strong><\/p>\n FIGURE 2: AUDITING WELL AND AUDITING BADLY<\/p>\n Auditing well<\/p>\n Auditing badly<\/p>\n Open questions get information. Closed questions get agreement.<\/strong><\/p>\n Weak:<\/strong> “Do you follow the procedure?” \u2014 the answer is yes, always, and you have learned nothing.<\/p>\n Better:<\/strong> “Show me how you do this.” Then watch.<\/p>\n Better still:<\/strong> “What happens when the part is late?” or “When did this last go wrong?”<\/p>\n And the one that works best:<\/strong> “What is annoying about this process?”<\/p>\n People are honest about friction<\/strong> in a way they are not about compliance. And friction is where the process is failing.<\/p>\n A finding needs three things.<\/strong><\/p>\n What was found.<\/strong> Specific. The record, the date, the observation.<\/p>\n Which requirement it relates to.<\/strong> A clause, or an internal procedure.<\/p>\n Evidence.<\/strong> What you actually saw.<\/p>\n Not:<\/strong> “documentation could be improved”. That is an opinion and nobody can act on it.<\/p>\n Instead:<\/strong> “Three of ten inspection records sampled from March had no inspector signature, which the procedure requires.”<\/p>\n Somebody can act on that.<\/strong><\/p>\n Grade them.<\/strong> Major nonconformity, minor nonconformity, observation. Grading matters<\/strong> \u2014 treating everything as major means nothing gets prioritised.<\/p>\n Findings become corrective actions<\/strong>, and the same rules apply as anywhere else.<\/p>\n Find the root cause.<\/strong> Not “remind the team to sign”.<\/p>\n Change something structural.<\/strong><\/p>\n Verify it worked.<\/strong> Come back later and check.<\/p>\n Track to closure.<\/strong> An audit finding list that only grows is a system not working.<\/p>\n The audit is not the point.<\/strong> What happens afterwards is.<\/p>\n FIGURE 3: THE AUDIT CYCLE<\/p>\n Prepare<\/p>\n Gather evidence<\/p>\n Report findings<\/p>\n Follow up<\/p>\n The practical problem nobody writes about.<\/strong><\/p>\n If an audit feels like an inspection people can fail, they will show you the clean file.<\/strong><\/p>\n Four things that help:<\/strong><\/p>\n Say what it is for.<\/strong> Finding problems while they are cheap, not catching people.<\/p>\n Never make it disciplinary.<\/strong> The moment a finding leads to blame, information stops.<\/p>\n Report friction as well as nonconformity.<\/strong> If somebody tells you the process is impractical, that is a finding about the process \u2014 and treating it that way makes people talk.<\/p>\n Show that findings lead to change.<\/strong> If nothing ever improves, people stop bothering.<\/p>\n When a certification body assesses you<\/strong>, they look at your internal audit programme specifically.<\/p>\n Did you cover everything over the cycle?<\/strong><\/p>\n Were the auditors independent of what they audited?<\/strong><\/p>\n Did the audits find anything?<\/strong> A programme with no findings is itself a finding.<\/strong><\/p>\n Were findings closed with root cause and verification?<\/strong><\/p>\n That third point catches people out.<\/strong> A perfect internal audit record is not the good news it appears to be.<\/p>\n An internal audit is for finding problems while they are still yours to fix.<\/strong><\/p>\n Ask, observe, and sample records<\/strong> \u2014 all three. Documents existing is not evidence the process works.<\/p>\n Ask what is annoying about the process.<\/strong> It is the most productive question available.<\/p>\n Write findings that are specific and evidenced<\/strong>, then root-cause and verify them.<\/p>\n And if your audits never find anything, they are not working.<\/strong> That is the signal to change how you audit, not a reason to be pleased.<\/p>\n Internal audits that never find anything?<\/p>\n Get in touch. That usually means the audit is checking documents rather than watching work \u2014 and it is a straightforward thing to fix.<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":" What an internal audit is for Not to prove you are compliant. To find out whether you are. An internal audit that never finds anything is not evidence of excellence. It is evidence the audit is not looking \u2014 and an experienced external auditor treats it that way. The purpose is to find problems while […]<\/p>\n","protected":false},"author":3,"featured_media":9468,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[29],"tags":[],"class_list":["post-9467","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-quality_management"],"yoast_head":"\nThe three kinds<\/h2>\n
Planning the programme<\/h2>\n
\n
\n
\n
\n
Who audits<\/h2>\n
How an audit actually runs<\/h2>\n
Gathering evidence<\/h2>\n
\n
\n
Asking good questions<\/h2>\n
Writing findings<\/h2>\n
After the audit<\/h2>\n
\n
\n
\n
\n
Making people willing<\/h2>\n
What auditors look for in your audits<\/h2>\n
The short version<\/h2>\n