Stop Auditing Documents: How to Make Internal Audits Find Real Process Problems

Internal audits can easily become a compliance exercise.

The auditor checks that a procedure exists, confirms that a form has been completed and verifies that a record has been filed. Everything appears to be in place — yet the same production problems, customer complaints or process failures continue to occur.

A useful internal audit should do more than confirm that documentation exists. It should help you understand whether a process is working as intended.

Start With the Process, Not the Clause

When preparing an audit, it is tempting to work through the ISO standard clause by clause.
A more useful starting point is the process itself.
​
Before the audit, establish:

• What is the process intended to achieve?
• Who owns it?
• What are its important inputs and outputs?
• What could prevent it from achieving the intended result?
• How is performance measured?
• Which other processes does it depend on?

This changes the audit conversation. Instead of asking, “Do you have a procedure for this?” you can ask, “How do you know this process is working?”

That question usually produces much more useful evidence.

Follow a Real Transaction Through the Process

One of the simplest ways to test a process is to select an actual example and follow it from beginning to end.

For a purchasing process, for example, you might select a recent purchase and examine:

1. How the supplier was selected and approved.
2. Whether the purchasing requirements were clear.
3. What happened when the goods were received.
4. Whether any defects were identified.
5. How the supplier's performance was recorded.
6. Whether poor performance resulted in further action.

For a customer-complaint process, follow an actual complaint from receipt through investigation, corrective action and closure. This approach makes it easier to identify where the documented process and the actual process differ.

Ask for Evidence of Effectiveness

Compliance and effectiveness are not always the same thing.

A calibration may have been completed on time, but are measurement problems still occurring?

Employees may have attended training, but can they perform the required task competently?

A corrective action may have been closed, but has the problem occurred again?

Look beyond evidence that an activity happened. Ask what happened as a result.

Useful questions include:

• What performance measure tells you whether this process is working?
• What problems have occurred during the past six months?
• What trends are you seeing?
• What actions were taken?
• Did those actions improve the result?
• What risks have changed since the last audit?

These questions turn the audit into a source of management information rather than simply an inspection.

Spend More Time Where the Risk Is

Not every process deserves the same level of audit attention.

Processes with a strong history of performance may require less frequent or less intensive auditing than areas experiencing:

• Repeated non-conformances
• Customer complaints
• Supplier failures
• High reject or rework costs
• Employee turnover
• Process or equipment changes
• New regulatory requirements
• Previous audit findings

Use what you already know about the organisation to shape the audit programme.

If the same area has produced three customer complaints and two corrective actions during the year, that is probably a better place to spend audit time than a stable process that has produced no significant issues.

Turn Findings Into Action

An audit only creates value if something happens with what it uncovers.

Where an issue is identified, record clearly:

• What was observed
• What requirement or expected process was not met
• What evidence supports the finding
• Who is responsible for addressing it
• When action is due

Then follow the issue through to closure.

For significant findings, do not stop when the corrective action has been completed. Verify that the action was effective.

Use Audits to Understand the Business

A strong internal audit programme should give management a better view of how the organisation is operating.

Over time, your audit results should help answer questions such as:

• Where are our processes weakest?
• Which problems keep recurring?
• Where are controls not being followed consistently?
• Which risks are increasing?
• Where are improvement actions producing results?

That is when internal auditing becomes more than preparation for an external audit. It becomes part of continual improvement.