Why Conduct an Internal Audit?
By Jong Fernandez, Lead Auditor & Principal Consultant
Why we audit?
The objective of internal audit is to determine adequacy, compliance and effectiveness of the management system. These are the primary reasons why we conduct internal audits. Whether it is for quality, environmental, health and safety, information security or food safety management systems, the internal audit is at the heart of performance measurement and evaluation.
Internal audit is an organisation’s tool for determining performance. This activity can be done at planned intervals. Depending on the needed frequency, internal audits can be done as frequent as quarterly or at least once a year. Note however that it is not the frequency but the quality and effectiveness of audits that add value to the organisation.
Adequacy Check
An initial audit on the adequacy of documents can be a good place to start the internal audit. This so called adequacy check zeroes in on the amount of documentation needed by the management system. An established management system can be checked through the available documented information. Adequacy check is also known as desk audit where documents and records are read for suitability and completeness.
Inadequacy in documentation can spell issues, major and minor alike, in the implementation of any management system. It is important to check first and foremost how the documents are prepared.
Note that the documentation may vary based on size, type and nature of every business. The management system follows a common hierarchy of documents starting from manual to procedures, work instructions or guidelines and forms.
There is no standard amount of documentation that can guarantee results from the management system. Documentation is entirely the discretion of the organization. International standards such as the ISO 9001:2015 however provides guidance on how to properly document the management system. As a general rule, whatever is needed by the management system, that will be instrumental in achieving desired results, shall be documented.
An audit therefore, based on the adequacy criteria, is not only beneficial but also crucial in determining whether there is appropriate documents to support effective implementation of the management system. The old adage “Document what you do and do what you document” still rings true despite the several updates on ISO standards.
Do what you document
Now that the system and processes are put on paper, the next challenge for the organisation is on how to comply with the established standardised system. Documenting what is needed by a management system can already be daunting for some organisations. However, documentation is just one piece of the entire standards-based management system story. The other vital half of documentation is implementation.
It is where the rubber meets the road. A moment of truth for the managers and process owners. More often than not, the truth is that not all planned documents can be effectively executed by the process owners who authored the documents. There are several contributory factors in the implementation phase. From accuracy of documented flow charts to competence issues, most documents will undergo necessary revisions for improvement reasons. But then again, this will not be considered an aberration in ISO implementation. This is the very essence of continual improvement.
Improvement has no finish line. Contrary to the notion that ISO is stiff, can be very structured and hampers a rather more fluid management approach, implementing ISO standards will constantly challenge companies to think outside of the box. ISO will evolve the process until it has zero room for deviation.
Compliance audit, which is the next logical step after adequacy check, will reveal invaluable insights on how one ought to manage its processes. After all, it is the processes that produce consistent results. Fix the process and one could have fixed the results.
Two elements therefore should be covered in this audit. First should be the manner of compliance or the ability of the people in the organization to execute the plan. Second is the knowledge or awareness of the people of the implementation plan. Assuming that documentation is proven adequate during the initial audit, the auditing can now focus on how these documents are being complied.
A typical audit finding during compliance check is that the human resources are knowledgeable of the clear implementation plan. It was made clear as to how the management system works. Not only from the high-level plan-do-check-act cycle but also elaborating the details of the interrelationships of the different functions of each processes. Communicating the management system implementation plan is key.
Show me results
Perhaps the easiest to audit, results, are objective evidence of an effective management system. The proof that the management system works can be found in the results. These can be customer satisfaction or the quality products and services delivered. All these are evidence that there exist an effective implementation of an appropriate plan. Of course the only way to find out is to conduct an effectiveness audit on the results that the management system is capable to deliver.
Without internal audit, it can be difficult or even impossible for the organisation to determine if documentation is adequate, its people and practices are compliant, and the overall system is effective.
Hi Doria,
Our pleasure. Stay safe always.