Getting more from your internal audits

5 June 2023: Getting more from your internal audits

Are your internal audits just a chore?

All management system standards require a programme of internal audits to be performed on a regular basis. However, for many organizations they are simply an overhead - a necessary evil tolerated to achieve certification. They are often scheduled and performed in a regulation manner by people with little or no training in how to audit effectively, and trying to fit them in amongst an already busy calendar.

The result is often that the internal audit programme is not designed to best meet the needs of the organization and is performed in - shall we say - a perfunctory manner that doesn't achieve a great deal of benefit.

It doesn't have to be that way

Of course, the intention of ISO is not just to give us something else to do, an opportunity to nose around the business and ticking boxes. The very fact that ALL the major ISO management system standards have a mandatory requirement for internal audits tell us something. It tells us that they consider them to be extremely valuable. Internal audits are probably the key checking component of the PDCA cycle, the best way for an organization to verify that it is achieving what it set out to do.

So, if we accept that an internal audit programme can be a valuable asset to an organization but isn't really at the moment, how can that be put right?

Some solutions to getting more out of your internal audit programme

The first step is probably to look at the audit schedule itself. Does it focus on the things that matter? Does the programme include the same 10, 15, or 20 subjects every year? One of the keys to getting more value from an internal audit programme is to be more agile in selecting the subject matter. The programme should be based on risk. Simply put, audit that things that pose a high risk more, and audit the things with low risk less.

The second suggestion is to ensure that your auditors have the capability to perform the task well. While people  may well be experienced and qualified at their jobs, that doesn't necessarily make them good auditors. The planning, performance and recording of audits is outside of most people's academic or vocational training. Specialised training should be considered. Another option here is to outsource some or all of the audit activity. The term internal audit is perhaps a misnomer here. It doesn't mean that the audits have to be done in-house and an increasing number of organizations are finding it beneficial to introduce some degree of outsourcing to professional consultants. Just reviewing activities from a new perspective can bring many rewards. Outsourcing can also be a great way to solve resourcing issues and it doesn't have to be a long-term commitment. You can revert to in-house resourcing at a later date or perhaps use a mixed approach to keep those perspectives fresh.

A third suggestion is to introduce a little bit of technology. ''Vorsprung durch technik'' as they used to say in the Audi car ads. So many audit records are still retained in Word or Excel documents that have to be individually opened or read to find out what happened in the audit. The result is often that the information in them never sees the light of day. Good management system software can automatically populate Action forms, generate charts, statistics, reports, email reminders and so much more.

The first step is always the most important one. If we want to be getting more from our internal audits, we first have to decide that we want to unleash those benefits.