How to conduct internal audits:
The steps for conducting an internal audit may vary, but here is somewhere to start when conducting an audit;
1. Plan an Audit Schedule
This first step is important. You need to plan the audits in advance so that everyone knows what is being audited and can plan themselves ahead. This schedule should be available for anyone to view so that they can know whenever an audit will be taking place regarding a specific process. An audit schedule will allow for employees related to the process or project being audited to have time to have things operating at the best standard possible. It is recommended that you share the audit schedule and stick to it as best possible, as surprise audits can sometimes create a feeling of being unfairness within the organisation.
2. Prepare an audit plan
As can be said about most things in life, preparation is key. Audits are no exception to this rule, and it is highly important that the auditor have a clear idea on what they are going to be auditing for. This stage will also aid the department that is being audited, as the auditor will be able to provide information around the intent behind the audit, the scope of it and request any documentation that may be required before they arrive to conduct the audit. During this stage, it may also be useful for the auditor to revise any previous audits from the same department, to discover whether there is any need to follow up on certain aspects from last time.
3. Conduct Audit and Report Findings
After a timetable has been agreed upon, and plan set around what the audit sets out to do, it is time to conduct the audit. This step can take a few different methods such as documentation review, interview, and observation, talking to employees, review and analysis of records. The goal of this step is to find and record any findings that show the process is functioning in the way it is set out to, and actually produces the desired results.
If the auditor is going to use the questioning technique, they should use appropriate questions. This means the questions should be:
‘Open’ to gain information (begin with - “who”, “what”, “how, “why”)
‘Closed’ to get confirmation (answered by “yes” or “no”)
‘Clarifying’, when you think you may have misunderstood (examples are – “show me…”, “can I see…?”, “let’s have a look at…”)
Another useful hint for the auditor is to not regurgitate questions from a checklist. Audits of core organisational processes require that people open up to the auditor. They also require that everyone thinks deeply about their work and what they see going on around them. Checklists (which originally began life as simple memory joggers) are like kryptonite to this kind of feedback. There is no place for them here. Instead, just ask questions, listen and record evidence, then later review the findings against the procedure.
4. Report findings
Once the audit has been conducted, it will be necessary for a meeting to take place between the auditor and auditee to report on the main findings during this process. This is important so that there is no delay in communicating the findings from one party to the other. The main thing to report on here will be if there are any areas that need improvement, but the auditee may also want to know if there are any areas they are excelling in. The report presented should be formally written, and identify the main findings. This will mean the auditee can go back to the hard copy any time they like to see what types of changes they could make.
It could also be beneficial for your audit to include pictures. The old saying ‘a picture is worth 1000 words’ is very applicable to internal audits. Rather than trying to explain something that you have discovered or observed, it will be more time efficient to take a quick photo of this, and follow it up by a small definition explaining what the photo is of.
The main findings outlined in this report should include;
Audit purpose, scope, references and audit team
Audit schedule, people interviewed, documentation reviewed, equipment and resources inspected.
Audit findings positive and negative.
Deficiencies found.
The report should also be discussed with the auditee in order to ensure they accept the findings of the report. This doesn’t mean that the auditee is happy to “accept” what’s in your report. It means that they understand and accept the validity of the objective evidence that you’ve assembled during the audit. It’s not always easy for management to hear feedback about system failures, frustrations and shortcomings. But it is the most important thing you can do as a QHSE professional.
5. Follow up
This step is critical as it will help display whether improvements have actually been made. When reporting on what needs to be adjusted or changed, it is also important to have in mind a period of time that would be suitable for a follow-up. There is no point in reporting your findings to the auditee if you are not going to check whether they have listened and taken action. When thinking about what may need to be followed up on, the auditor must evaluate whether what they discovered was in line with what was expected, and if not what action must be taken.
Related Questions:
