Give your business a health check Pt. 1

The need for a health check

Complex systems don’t work perfectly forever. They need regular checks and maintenance to keep them on track.

• Most people wouldn’t buy a new car or motorcycle and then expect it to run well for 10 years without inspection or service.
• Our own bodies can be considered as systems – and most people these days would have periodic eye tests, dental check-ups etc.

Management systems are no different. They also need checks and maintenance to ensure that they still meet requirements and are  effective. Feedback may be received when a complaint is made, or an incident or nonconformance occurs. However, that is re-active. We shouldn't just wait until something goes wrong, but need a pro-active verification that planned arrangements are happening in practice, and our system is working to achieve objectives.

It's widely accepted is that the best, structured form of such pro-active verification is a programme of internal audits. Not surprisingly, internal audits are a mandatory requirement of standards like:

• ISO 9001 - Quality
• ISO 45001 – Health & Safety
• ISO 14001 - Environment
• ISO 27001 – Information Security

That mandatory requirement highlights the importance attributed to internal audits. It also means that your management system cannot be certified without them. In fact, failure to adequately schedule and perform internal audits is one of the most common reasons for nonconformances during certification. Even when organizations are doing enough to pass certification, they often don’t achieve the full benefits they should from an efficient and cost-effective internal audit programme. So, what goes wrong? And what can be done to improve the situation.

Getting genuine commitment - not lip service

Many a certification auditor will recognise this situation: When visiting an organization for a certification or surveillance audit, they find that a whole series of internal audits were carried out – yesterday! That is a sure sign that the organization’s senior management has no appreciation of the importance or benefits of internal audits. They were just done at the last minute – because they are necessary for certification. Because of the rush, they have probably not been well planned, well performed, or delivered tangible benefits. They have just served to tick the box.

If we are looking to get a genuine commitment from senior management to properly resource and support the audit programme, they have to be convinced of the value.

Internal audit catch 22 - and a solution

Obtaining commitment can be a ‘Catch 22’ situation – how can they know the value without trying, and why would they try if they don’t think there is any value?

One solution might be to take just one known problem area of the business and perform a sufficiently thorough audit that can clearly identify issues that are causing actual or potential harm. That may be harm such as increasing risk or costing money. If you can quickly resolve just some of those issues, then a good case can be made for a genuine audit programme on cost-benefit grounds.