Audits are often associated with inspection and fault-finding. In management systems, however, internal audit is a learning tool: it reveals what works well and what needs to improve, before gaps become problems.
An audit is defined as a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled. Internal audit is also called first-party audit, as distinct from second-party audit, which an organization conducts at its suppliers, and third-party audit, carried out by an independent body such as a certification body. ISO 9001 requires internal audits at planned intervals to check that the quality management system conforms to the organization’s own requirements and to those of the standard, and that it is effectively implemented and maintained.
International guidelines: the principles of ISO 19011
ISO 19011 provides guidelines for auditing management systems and sets out principles auditors should follow:
- Integrity: honesty, impartiality and responsibility, the foundation of professionalism.
- Fair presentation: reporting findings and conclusions truthfully and accurately, including unresolved diverging opinions.
- Due professional care: applying diligence and sound professional judgement.
- Confidentiality: protecting the information the auditor has access to.
- Independence: not auditing one’s own work, so that conclusions remain impartial.
- Evidence-based approach: verifiable conclusions based on appropriate samples of information.
- Risk-based approach: directing audit effort towards what matters most to the organization.
The audit programme and its stages
ISO 19011 distinguishes the audit programme, the set of audits planned for a given period, from the audit plan, which describes the activities of one particular audit. As ISO 9001 requires, the programme takes into account the importance of the processes, changes affecting the organization and the results of previous audits, so that sensitive processes, or those that have had problems, are audited more often. Each audit then goes through the following stages:
- Preparation: define the objective, criteria and scope, review documents and previous results, and prepare a checklist that serves as a guide rather than a straitjacket.
- Opening meeting: present the objective and method, and put auditees at ease.
- Conduct: interviews, on-site observation and review of samples of records, tracing real files from start to finish.
- Findings: compare the evidence with the criteria and classify what is found.
- Closing meeting and report: present the findings clearly and objectively, and agree on next steps.
- Follow-up: check that corrective actions are implemented and effective.
Classifying findings and acting on causes
Many organizations classify audit findings into three categories:
- Nonconformity: non-fulfilment of a requirement — of the standard, of the organization’s own procedures or of the customer — established by objective evidence.
- Observation: a situation that is not an actual breach but could lead to a nonconformity if left unaddressed.
- Opportunity for improvement: a suggestion to increase efficiency or effectiveness in a practice that already conforms.
A well-written nonconformity has three elements: the requirement concerned, the evidence collected and a description of the gap between them. It is also important to distinguish a correction, which deals with the situation found, from a corrective action, which removes the root cause to prevent recurrence. Correcting a document issued with an error is a correction; understanding why the error occurred and changing the way of working so that it does not happen again is a corrective action.
Worked example: an audit in a hospital department
A nurse trained in internal auditing, from another department, audits the process for checking emergency equipment in a hospital department. The criterion is an internal procedure requiring a daily check of the emergency trolley and a record of it. Reviewing a sample of the log reveals days with no recorded check, most of them during night shifts. Interviews show that the night team had not been told the task had become its responsibility after the shift rota was changed. A nonconformity supported by evidence is therefore recorded, alongside a good practice: the clear arrangement of the trolley’s contents. The analysis places the root cause in the lack of a mechanism for handing over responsibilities when rotas change, not in any one person’s negligence. The check is then added to the shift handover checklist, and a later follow-up audit verifies that the log is kept consistently.
Making audits useful
- Involve auditees and explain the purpose from the start.
- Focus on processes and results, not on people.
- Highlight good practices as well as gaps.
- Train internal auditors from different departments, and coach them in open questioning and attentive listening.
- Present a summary of audits at management review, so that it leads to improvement decisions.
Common mistakes
- Box-ticking audits that check documents exist without examining whether they are applied.
- Rigid checklists read word for word, which hide what is really happening.
- Holding audits only just before the certification body’s visit, instead of spreading them according to the programme.
- Closing nonconformities without checking that the corrective action was effective.
- Looking for someone to blame rather than for a cause, which pushes auditees to hide problems.
A successful audit leaves auditees having learned something, not feeling accused.
