Internal audits are an essential part of any management system. Together with management review and other verification activities, they are supposed to be a self-cleaning mechanism. Read 10 tips for more effective internal audits.
Clients and external parties don't need to tell you where you are effective and where you are not; internal auditing is a very powerful tool for making progress yourself.
But why is it that many companies struggle with internal audits and don't get much benefit from this tool? Here are some suggestions for harnessing the full potential of internal audits. As an auditor trainer, I hope these tips will help you as an internal auditor or as a manager of an audit programme.
Tip 1: Common goal
Why do you conduct internal audits? What should they deliver for your company? If you are still in the “it's mandatory” phase, you may not have the best starting point. Discuss what the result should be.
Are we just looking for compliance, or are we investing in finding opportunities to improve or simplify our processes? As an internal auditor, take the time to talk to the auditee about their ideas for improvement and make these tangible and specific in the report. Don't overlook the need to check compliance with internal or external requirements.
Tip 2: Audits as a management tool
Are you the programme manager who is struggling to find a way to decide on the content of the audit programme yourself? Why not discuss this with senior management? Help senior management take on the leadership role by discussing what is important to audit. This should increase the importance of the overall internal programme.
Make sure that senior management is aware of the results and follow-up activities. Involve management in reserving sufficient time for the programme manager, the auditors and the auditees.
Tip 3: Valuable time
Very often, the auditor does not have enough time for all aspects of the process: preparation, questioning and writing the report. As a result, audits are often postponed or not carried out at all. This means that your internal self-cleaning tool is completely neglected and, if you do what you have always done, you will get what you have always got. No improvement whatsoever.
Set aside time for the audit process at the beginning of each period, rather than at the end, and ensure that your valuable audit time is worthwhile by addressing important issues selected by senior management. Write your report shortly after the interview, while you still remember many details. Stick to the schedule and make good use of the time set aside. Enjoy the personal contact and cherish the results.
Tip 4: Prepare your internal audit
A good internal audit process starts with preparation. Think about interesting topics and pay attention to points that come from the audit programme manager or even directly from senior management.
Make your audit risk-based: Every topic is related to risks and opportunities. Take these into account from the preparation stage right through to the audit report. Ask the programme manager or a colleague to help you if you are unsure about the risks and opportunities during the preparation phase. Ask the auditee to define their risks and opportunities.
Read previous audit reports, internal or external complaints and corrective measures relating to the subject. Review the procedures of the process you are going to audit and make a shortlist of topics you want to discuss. Remember: auditing is not an inspection with a simple checklist, but a conversation with your auditee.
Tip 5: Go for it!
With your preparation in mind, use all your skills and an open attitude to get the most out of the audit. Once you are in the conversation, make sure you dive deep into a topic and gather objective evidence of conformity or non-conformity.
Discuss the effectiveness of the process and motivate the auditee to provide relevant evidence and ideas, improve the quality of your report and speed up follow-up actions.
Focus on the audit itself and the valuable time with your colleague. Avoid disruption as much as possible. Questions that are not related to the audit should be postponed as much as possible.
Tip 6: Competence management
Internal auditing requires a wide range of competencies. Most auditors undergo training in auditing to gain a solid foundation for conducting their first audits. That is only a starting point. As with other roles, a company needs to consider competency management for internal auditors in terms of auditor selection, training and competency development, performance evaluation and action when results are unsatisfactory.
Consider auditor development as an ongoing activity that requires attention just like any other role. As the manager of the audit programme, you have a prominent role in the process. Think about keeping the audit team motivated. Intervene when the behaviour of an auditor or auditee is inappropriate. Consider further training. As programme manager, make sure you witness internal audits so that you know what is happening and what is needed for the audit programme.
Tip 7: Share successes
As programme manager, consider how you can share the successes of internal audits. Keep the auditors informed of the results of follow-up actions. What has changed and what was the effect of the change? Organise a way for the audit team to discuss successes and difficulties. How can you motivate each other and learn from what has been achieved? Nothing motivates more than sharing successes.
Tip 8: CAPD (Check-Act-Plan-Do) instead of PDCA
Auditors often use the PDCA model to audit continuous improvement. Starting with understanding the plans, followed by implementation, can take a lot of time.
In most companies, these PDCA steps are well established. Very often, evaluating (the Check step) and taking action to correct or prevent recurrence (the Act step) prove to be much more difficult. But before the auditor gets that far, the time available for the audit may be up.
An alternative approach is to use the “Check” and “Act” steps at an earlier stage. Since the PDCA cycle is a cycle, you can also use it as the CAPD cycle and spend more time on the difficult points of the audit and the required actions.
Let those being audited tell you how they evaluate the effectiveness of their process and let them demonstrate what measures they have taken when the audit revealed a lack of compliance or effectiveness.
Tip 9: Ensure you remain independent
Remaining independent from the process and the consequences of your internal audit means that you must ensure that there is no connection between the subject and your current role or recent former role. You must have no interest in a specific outcome of the audit. Also, make sure that your line manager or subordinate is not an auditee. This could easily lead to confusion between auditing a process and assessing a person.
Check your independence before accepting an audit and contact the audit programme manager about why you are not accepting an audit.
Tip 10: Promote internal auditing
The role of an internal auditor is one of the most interesting roles once the support for these activities has been established. You get to see other parts of your company, talk to people you don't normally talk to, and develop a broad understanding of all business activities. This will increase your respect for other people and other activities.
Once you have mastered some basic auditing techniques, you will find that these skills are also very useful in the rest of your professional and private life.