IRCA INform

The importance of
integrated internal auditing

Does your business flow from one process to the next? How important is it to implement integrated internal auditing? Rhian Newton defines the issue and gives advice on the best approach to take

To start with, it’s important to define integrated internal auditing. It should relate directly to an integrated business system and the risks involved with it, rather than the host of management standards that abound. It ensures all processes and procedures are arranged in a way that suits the business, such that everyone can find the tools and information that they need to perform their work. This includes integrating standards and legislation into the processes and procedures so that the system is considered as a whole instead of as individual elements.  

Once the system is integrated it makes sense to audit the whole thing together, including the flow through the system as well as the processes, people and procedures that make it up. This will lead to improvements that cut waste and don’t push problems onto other departments. As a preventative tool it will also highlight areas of weakness across traditional boundaries so that the root causes can be found and rectified before they become problems.

For it to be effective and efficient, examination of a full procedure or process needs to be covered in a single audit. As when performing any task, start by considering the whole operation, perhaps taking five minutes to consider the safety implications for a job not done in a while. People would not stop to consider, for example, the environmental aspect of the job today, the safety aspect next week and social responsibility the week after. This would not make sense, yet that is the way many people audit.

For example, when doing a quality audit, an auditor was challenged for highlighting an environmental problem which needed correction. The person being audited thought this was unfair, as only a quality audit had been expected. If something is wrong an action is needed to put it right and integrated audits will pick up on value-added improvements more than any other type of audit.

When the standards and legislation to which the company subscribes have been integrated into procedures, then it is only necessary to train auditors to use procedures and checklists when carrying out audits. Clearly, legislation should be based on common sense. ‘If it looks wrong it probably is wrong’ and even if it is not a noncompliance it may well be an indicator for improvement.

As long as auditors write everything down in detail, when it is read through by an experienced lead auditor, they will be able to understand and identify which standard, legislation or improvement is required.

This makes it easy to train auditors as they only have to follow the process flow or the procedure to be able to audit. Train them to look for strange or unusual conditions, to look for all forms of waste and to ask open questions. Make sure they have management support and that anything they observe has an action and a root-cause analysis performed.

For example, Flexsys Rubber Chemicals Ltd at Ruabon takes mechanical engineering students from French and German universities to perform integrated internal audits. As well as learning English at the same time as auditing, they also find themselves exposed to taking a responsible role in the working environment for the first time. It is a symbiotic relationship that works well:

• the students are keen, interested and up to date with the latest technology
• they want to learn and are eager to improve the system
• they have fresh eyes as everything is new
• as they are fully independent those being audited know there is no hidden agenda, which is a problem that can happen with some internal audits

The integrated internal audit workflow mainly depends on the maturity of the system although bits can be picked out at different stages:

• young systems tend to perform compliance-type audits. There are many books on how to do this, many with checklists available. Often these audits pick up on spelling errors or that the written procedure has not been updated to follow the practical procedure
• as the system matures audits tend to follow the process and focus on flow through the interfaces. This can pick up on waste in the system and identify areas of improvement, as well as corrections
• risk-based auditing follows and focuses on areas of weakness, major impact or the complexity of the system. These audits can prevent accidents or incidents from happening and can be very powerful
• when all of these mature fully then site surveys become the norm. They identify areas of weakness, communication problems, people problems and training issues that are traditionally not picked up in other types of audit

The best integrated internal audit system would use of all of these because it keeps the business system current and ensures people retain control over it. The old adage ‘you can only control what you can measure and only improve what you can control’ is as true today as it ever was. The first three types of audit can be integrated into one quite easily. Today we have to be wiser and more efficient in our work and integrated internal auditing is one way of staying ahead of the competition.

About the author

Rhian Newton is quality systems manager for Flexsys Rubber Chemicals Ltd, a fellow of the CQI and a member of the Royal Society of Chemists. With 34 years' experience in quality, she has developed methods for testing, analysing, measuring and maintaining standards in laboratories, as well as taking a leading role in the development of early computerized robotic testing systems and equipment www.flexsys.com

 

Have a burning food safety issue you want to raise? Tell us now in the Online Forums.