Hot topic – internal auditing
In the last issue of INform we gave readers the following ‘hot topic’ poser: ‘How can organizations get the maximum value from an internal audit?’ See below for some of the responses from around the world
Most of internal audit time is taken up looking at paper or reading computer reports and only a small amount of time (typically less than 5 per cent) is used for asking people questions. Asking people the questions usually produces the biggest amount of improvement - typically 80 per cent of improvements come from people and 20 per cent from inspection of paper. And does anyone read the paper work anyway?
In order to continue with the compliance aspect we need to look at the paper so instead of using our own people we use foreign students who are qualified engineers. We train them in auditing (and English) and in return they audit and write up reports without being paid. They are fully independent, and training ensures consistency between auditors and audits.
The important and valuable thing about internal audits is that any improvements or corrective actions must be addressed. If these are not then it was not worth finding them out. They need to be completed in a timely manner and the root cause needs to be determined. If just corrective action is applied then you will see the same fault reoccurring. Only correcting the root cause will lead to permanent improvement. Once improvements have been made they need to be audited to check that the change was correct and that they have not slipped back into old ways.
Internal audits must include talking with all levels from process operators, technicians, management right up to directors. You usually find out more by asking operators about the system than any other group. They will openly tell you why they don't follow the procedure and even give information that they pass onto each other about running a unit that their managers do not know. Asking operators questions also improves the health and safety environment and quality as the operators feel more involved and responsible for their system.
Internal audits encourage people to change their behaviour as they have the added work of filling in a request for corrective action and root cause analysis for every item identified and highlights the problem to senior management. It encourages people to identify problems before they are audited and to put them right. Some use internal audits as a way of highlighting to management that an area has a problem.
Rhian Newton
Quality systems manager
Flexsys Rubber Chemicals, UK
By being open, honest and not shooting the messenger. So often I have seen senior managers arguing with an auditor that an issue is not a non-conformance as they tend to be very competitive and fail to see that it is an opportunity for improvement, treating it rather as a failure.
Secondly the auditor needs to have the same level of thoroughness as the external auditor. Many find it difficult to issue an non-conformity report to one of their colleagues - cross site or intra-company auditing can help with this. The support of an external auditor when auditing the internal audit findingscan often be very beneficial and provide the internal auditor with the ammunition to be stricter in future audits.
Murdo Morrison
QHSSE manager, Scotland
Today most of the organizations have made their internal audit process as a compliance requirement. This exercise happens before the external audit to ensure that there are no process deviations. What the organizations miss out is the effectiveness of the process. This can be improved by:
- deploying internal auditors who meet the auditor qualification criteria
- ensuring that they understand their role and responsibility
- making them understand how to do process validation , not just verification
The quality team needs to first understand the individual process objectives and verify if the same have been achieved using the metrics and process outputs. If this starts happening, the whole exercise becomes very meaningful, both for the auditees as well as auditors.
Once the processes are validated based on the process objectives, the overall effectiveness will increase dramatically. Most importantly, the organization will also identify non-value adding processes and get rid of them. The moment the auditors start questioning the objectives and output, the focus will also shift from document verification to process validation. This will send the right signals that auditors are not there to just verify documentation but also judge whether the planned results are being achieved effectively.
M Sridhar Chakravarthi,
KPMG quality registrar, India
Internal audits should serve as a potent and value-adding tool to bring continual improvement to the organization’s effectiveness and efficiency. To be effective, results of audits must be communicated to the concerned areas and must demonstrate commitment to search comprehensively for root causes and formulate realistic and achievable corrective actions. An audit should be periodically conducted to ensure suitability of the system.
Gilbert Llovit
Goodfound Cement Corporation, Philippines
I would make the following four recommendations for improving the internal audit function within an organization:
1. Make the internal audit function/department a cost centre. In other words, they (internal auditors and relevant department) have to demonstrate they are profitable to the organization. Profitability can be demonstrated by quantifying the costs and benefits obtained out of the results of the internal audits performed.
2. Ensure all auditors can perform integrated audits in order to make them more efficient and effective. Auditors need to be trained on all applicable management systems within the organization.
3. Members of the audit team need to actively participate in all management review and business planning activities within the organization. This will ensure they are aware of the business direction and strategies, and be able to incorporate those in their audit process.
4. All audits (whether environmental, quality or safety) need to be performed following a process approach. Inputs, outputs, indicators, resources, support and interactions are all applicable when conducting an audit for a specific process within the organization. Performing audits by elements of the environmental or safety management systems do not add value to the audit process itself. Use the QMS process structure to accommodate the other management systems.
Chris Parra
I have been in the quality business for over 20 years and many things have changed in this time. Internal auditing is one of the topics that has been subject to changes in the standards used. There are various factors that have to be considered to make it effective:
1. The auditors have to be trained not only in auditing techniques and the standard used, but they must know the culture of the organization, the boundaries between areas, the political divisions etc. Without such knowledge, the auditor is extremely limited and the audit will be of doubtful value. It must be remembered that the culture is constantly changing and the auditors must be made aware of the changes as they take place.
2. Auditors need to be able to view and understand the processes being audited. The auditor has to be able to follow the process in detail and ask pertinent questions. I do not believe that auditors have to have specialist knowledge of an area, but they must be able to understand, at the very least, the macro process. There are, of course, instances where specialist knowledge is necessary but this can be obtained through training or by using specialists to guide the auditors.
3. Each process is only one in a chain, frequently very complex. The auditor must be able to picture the whole or ‘macro’ process in order to understand the contribution that the process being audited makes to the whole.
4. Auditors must be able to visualise the ‘customers’ and the ‘suppliers’ in each process and be able to look for information as to the requirements for each stage in the macro process. The customers may be external and/or internal and all have to be considered. Likewise for suppliers, they may be external and/or internal. The process owners need to be able to demonstrate that they know the requirements of their customers and that they have accurately defined their own requirements to their suppliers.
5. Auditors must throw away the standard checklists for audits. Instead of this checklist culture, use only general headings and let the auditor follow his/her nose during the audit.
6. There must be a ‘champion’ for internal audits. In my organization, I preach the word about auditing to all the directors and senior managers, convincing them of the usefulness of this practice.
7. Someone has to verify the on-going analyses of observations and, where appropriate, corrective actions. While I prefer that the auditor of an area verifies these points, I oversee this and, if necessary, carry out the verification follow up. This leads to continuous improvements and a very high visibility of the whole improvement process. The process owners perceive the quality of this service, seeing it adding value to their operations.
I am totally committed to internal auditing, on the premise that the audits are carried out to add value to the processes and not merely to satisfy an external auditor. With such commitment, everybody gets the maximum from internal audits and it becomes a ‘win-win’ situation.
Philip Sharland
ISD process management and quality assurance, Alcatel Telecom
The next hot topic question is: ‘How can the certification industry encourage top management to understand and use management systems effectively?’ Email Amy Holgate on e: aholgate@irca.org and make yourself heard (please include your professional role and your country of residence).
 |
|
 |
|
 |
|
 |
|
 |
 |