Five Keys to Successful Internal Auditing

Internal auditing is one of the most routine improvement tools available to organizations. In fact, it’s so ordinary that auditors sometimes forget the underlying principles of auditing. Auditors must be periodically reminded of these underlying truths or the entire audit process can begin to backfire. Keep these in mind as you audit and you’ll nearly always be successful.

Principle 1: The customer of the internal audit is the one being audited

That’s right; the people you’re auditing are your customers. Internal auditing is a service you perform to help make your organization more successful and identify problems before they spiral out of control. The quality of your product depends on how well the audit is planned, the type of training provided to auditors, the level of engagement of top management and the way auditors behave during the audit, among other factors. You must conduct the audit with the same level of professionalism and diplomacy as if you were being paid by an outside party.

Little things that indicate the auditors have forgotten who the customer is include:

*** Treating the audit as a “Gotcha!” exercise. Auditors should never express satisfaction or glee when nonconformities are found. Focus on the facts and keep things as impersonal as possible. Failures revealed by the audit are opportunities for the future.

*** Failing to adjust the audit plan to meet the needs of the auditee. Unexpected events can occur during an audit: accidents happen, lines shut down, rush orders must be processed. The audit plan should be flexible enough to handle changes on the fly.

*** Holding surprises until the very end. The auditee should be apprised of audit results throughout the entire process. Don’t make the mistake of holding a “bombshell” until the closing meeting for maximum impact. Auditor should communicate their concern, along with all supporting evidence, when they think they might have found a problem.

*** Focusing on insignificant details at the expense of critical issues. Auditing is a detailed activity, but don’t forget to examine the effectiveness of the overall system. When faced with an issue, auditors should ask themselves, “What effect does this really have on the organization and its customers?” The answer will usually indicate if the issue is one worth delving into in great detail.


Principle 2: Planning is the key to success

Audits don’t create improvements by accident. It takes a great deal of planning and coordination. I’ve often said that a well planned audit almost runs itself. On the other hand, a poorly planned audit runs itself into the ground, and planning often gets shortchanged in the rush to get audits done.

Audit planning involves a significant amount of dialogue between the auditors and auditees. It’s a dynamic process that begins well in advance of the audit itself. Planning typically provides details around the following issues:
*** Date: When will the audit take place?
*** Location: What’s the audit’s location?
*** Scope: What are the official boundaries of the audit?
*** Objective: What is the point of performing the audit?
*** Auditors: Who will perform the audit?
*** Areas to be audited: What functions, departments or processes will be evaluated during the audit? Sometimes this is clear from the scope, but often not.
*** Topics to be audited: What subjects will be audited in the given departments? Should the auditee expect questions about document control or management commitment? This not only gives the auditee a heads-up, but it also helps guide the auditors.
*** Timing of the audit: When exactly will each department be audited? When will the opening and closing meetings take place?

The audit plan may also address other issues, but the ones mentioned above are the most common. The purpose of the audit plan is two-fold: To help the auditors understand exactly what they’ll be doing during the audit and to allow the auditees to know what to expect. It isn’t uncommon for the auditee to propose changes to the audit plan, usually minor alterations in the timing (“Instead of auditing sales at 9 a.m., can you come at 10 a.m.? We already have something scheduled for 9 a.m.”). Changes of this sort are entirely reasonable and should be accommodated to the extent possible. Remember, the customer of the audit is the auditee.

The audit plan is documented as concisely and clearly as possible. The exact format is usually dictated by the magnitude of the audit. A plan for an audit of an hour or two could take the form of an e-mail. A plan for a full day or multiday audit will often take the form of a matrix, indicating hour-by-hour blocks of activities. Whatever the format, the plan should be communicated far enough in advance of the audit for all parties to digest it and understand its effect on operations.

Principle 3: Opinions never constitute nonconformities

Everybody has opinions. As people become wiser and more experienced, they tend to develop even more opinions. Many auditors consider themselves to be wise and experienced, meaning they have loads of opinions. Sometimes these opinions become the basis for nonconformities, which is a huge mistake. Facts are the only legitimate basis for nonconformities. Opinions have no role in the process.
A child could write a good nonconformity. The problem is that children don’t write them, wise and experienced auditors do. Consider the following:

- The company committed itself to doing XYZ. The commitment is a fact, evidenced by its presence in a procedure, plan, policy, specification, contract, work instruction, standard or statement.

- The company failed to do XYZ. The failure is a fact, based on evidence such as records, observations, documents or interviews.

No opinions are present in the nonconformity, just cold, hard facts. It’s hard to argue with facts. It also makes the audit go much smoother. Sure, facts may remove a degree of creativity that auditors exercised, but creativity is better expressed in other ways.

Nonconformities aren’t the only kind of audit findings. Because the audit is a balanced process, positives are also highlighted. These may be recorded individually, summarized in an audit report, or presented orally during the closing meeting. Every organization will have at least one or two positives that can be recognized. The auditors just have to remember to look for these in the course of their auditing.

Some organizations also include another category of finding called observations, remarks, comments, opportunities, recommendations, or any number of other names. These fall into a gray area that doesn’t quite constitute nonconformity, but is still an issue worthy of investigation. Sometimes these will include specific recommendations for taking action based on past experience, established best practices or regulatory requirements. These types of findings give auditors a chance to express opinions. Audits are a great place for benchmarking and sharing best practices, as long as all parties to the audit understand and agree to how this will happen.

Principle #4: Don’t burn out your auditors

It’s human nature to utilize your best resources. If you have a patch of ground that produces great tomatoes, it’s tempting to keep planting tomatoes there, year after year. The only problem is that the soil eventually becomes exhausted. This is the case with an internal audit program, too. Experienced and well-trained auditors produce effective results, so they frequently get called on to perform audits. As a result, the organization fails to develop new auditors, and they end up with no auditors when the experienced auditors run out of gas and scream, “No more!”

One of the best strategies is to make each auditor’s ‘tour of duty’ a year and a half. Annually, train a new group of auditors, and then use the remaining six months for the experienced auditors to mentor the new group. Schedule auditors in teams of two, one new auditor and one experienced. That way, the new auditors get the benefit of observing the seasoned auditors in action, and the seasoned auditors can learn from the new perspectives and unburdened approaches employed by the new auditors.

After a few years of rotating in new groups of auditors, you’ll have utilized a significant chunk of your employees. The benefits of doing this are clear:
 Broad exposure of personnel to other functions in the organizations
 Deeper understanding of the management system and its processes
 Stronger communication and analysis skills, as a result of auditing experience
 Varied perspectives and viewpoints that come from using a wide range of personnel as auditors
 Less likelihood that the audit process will fall victim to groupthink, which happens when the same people always involved
 You will an informal ‘alumni association’ of ex-auditors who can be called on to perform audits periodically if you get into a pinch

Take the time and effort to develop new teams of auditors on a regular basis. You’ll find that the overall effectiveness of your audit process will increase significantly over time.

Principle #5: Audits should focus on critical success factors

Critical success factors are the things that keep you in business and help build customer loyalty. They will be different from industry to industry and from company to company, but there are certain critical success factors that apply to nearly all organizations. The internal audit should probe these areas in detail and dedicate significant effort to analyzing their effectiveness:

 Management review: This is the top management reviewing performance, analyzing data, making decisions, and initiating actions for improvement. It is one of the most important functions in your organization, so auditors will need to apply some effort to examining it.

 Corrective and preventive actions: Few issues have as much bearing on an organization’s success as problem solving and problem prevention. These processes should be scrutinized nearly every time an internal audit is performed.

 Customer satisfaction: The primary reason that organizations exist is to satisfy their customers. How well an organization listens to its customers and takes action on what it learns is definitely a critical success factor.

 Internal audits: If internal auditing wasn’t important, you wouldn’t be reading these words right now. Auditing is one of your primary processes for evaluating process effectiveness and driving improvements, so you will definitely want to audit it on a regular basis. Some people find the notion of auditing the audit process unusual, but it must be examined just like any other key function.

 Product realization: Whether your organization produces a good or service, it certainly has product realization. It could involve manufacturing activities (e.g., cutting, stamping, welding, and assembly) or service activities (e.g., scheduling, repair, trouble shooting, instruction). No matter what kind of activities are in place, this is your core transformation process that has the most direct impact on your customers.

Decide which processes in your organization are the most important to its success, and make sure these processes are audited in-depth and often. The results of the audit will speak for themselves.