Maintaining Your Internal Audit Program
With everything else you have to deal with on a daily basis, your internal audit program probably doesn't even make the top 10 list. There is always something more important; a customer issue, supplier problems. Yet, it must be done. Somebody must determine that your company's processes are performing as planned.
Some companies tend to fall behind when it comes to their internal audit program. It's not always viewed as mission critical. Top Management knows the company will stay afloat if these tasks are not performed, or are completed late. And it's likely that they are correct in this assumption. Your company will not go out of business if the audits are not conducted. But, your company may become more profitable if your internal audit program is conducted effectively.
Tip #1- Understand the process model.
Any process or system is destined to fail without a plan. This planning initially comes into play in clause 4.1 of ISO 9001. Here we are told to identify the internal processes necessary to create our product or service and determine how to make certain that our processes will be effective. Read more on the process model.
Tip #2- Have a schedule for your internal audit program.
ISO 9001 tells us to create an audit program enabling us to conduct audits as planned, not specifically requiring an audit schedule. However, I'd argue that by creating a schedule and sticking to it, your company won't fall into nonconformity regarding your audit program; even if by accident.
Tip #3- Don't forget to detail any auditor competency requirements in a job description or in the procedure.
The standard also states that a procedure is required. This procedure will provide the details of how your audit program functions. Include information about how your company determines the competency of auditors, reporting methodology, etc. Additional information about the procedure can be found on the internal audit procedure page.
Looking for Internal Auditor training?
Read about Carpenter Group's ISO9001 Internal Auditor Seminar
Take our ISO9001:2008 Transition Webinar
Tip #4- Proper checklist creation.
The last step in planning your internal audit is the creation of a checklist. Write down the important questions to ask during the course of the audit. Review the process documentation (flow charts, procedures, work instructions, etc) prior to checklist creation to give yourself ideas of what to look for during the audit. Read more about internal audit checklist creation.
Tip #5- Create a formal audit report.
A standardized method of reporting audit results should be utilized. This provides consistency within your reports and records. Everyone who accesses the reports will know where to find the appropriate information if you maintain a formal structure to the reporting. Remember that the certifying bodies (that's what they're called now, you probably know them as registrars) have controlled forms for reporting their results to you.
Tip #6- Learn to properly record a finding.
The ability to record an audit finding is another key to maintaining a robust internal audit program. Recording a finding doesn't have to be difficult, but many new internal auditors have problems with it. By following the specific format detailed on the internal audit report page, auditors won't have to explain the nonconformity to the process owner. A well written finding speaks for itself.
Tip #7- Determine if the process is effective.
Per the standard, auditors must determine if the process has been implemented and maintained effectively. This concept is often overlooked by those new to auditing. Process effectiveness is defined as the ability of the process to achieve the intended or expected result.
Let's look at a shipping process example. The company has determined that the key process goal is 100% delivery accuracy. In other words, when the company ships product, the product gets to the correct customer 100% of the time. The shipping process must be measured to determine if the goal is being attained. This data should be made available to the auditor as evidence of process effectiveness. The auditor interprets the data to determine if the process regularly meets its goals.
