How effective is your internal audit process? Really? 

The goal of any internal audit program should be to reduce the number of external findings from your registrar. You may be conducting an internal random audit; but are you meeting the needs of the organization to demonstrate continual improvement and/or giving the management team the data that is needed to make ongoing improvements? I have been asked several times by clients about their internal programs aimed around how many findings should the internal team have when conducting integrated audits? In two specific cases, it was noted that the internal teams seem to be focusing on quality issues instead of environmental or safety issues that the clients were registered to. One of these clients expects their internal audits to have at least twice the number of findings as the external auditor. Another client has now separated their internal auditors by schemes as the one focused on quality were not findings issues in environmental or safety.  

One specific question that has come up focuses on two or more auditing schemes where the internal auditors seem to only have findings in quality. Some registrars will provide you with demographics on the type and clauses of findings that they have written over the past years at your site(s). You might consider doing this also for your internal audits if you have not already done so. If there are certain clauses that are repeating, then your internal corrective action may not be effective. On the other hand, if you see gaps in clauses that the registrar is finding, then your internal personnel may need more directions. Your management team may also be questioning why no internal findings have occurred in areas that they suspect are causing issues for the organization. In any of these cases and more, you should be analyzing your internal audit results to understand what the internal auditors are highlighting in their audit reports and thus how effective your internal audit system is.  

One common explanation for this lack of findings in a particular scheme or clause is the typical use of check sheets by companies that only focus on certain aspects of the business versus the coverage of the related ISO auditable standards or process approach auditing. It is very difficult to cover all the clauses in even one scheme in a simple check sheet, never mind the integrated audits of two or more scheme. One way to address this is by using “CPR for Internal Auditors” by looking at past issues of Quality. Using some sort of a graphical presentation of the audit area, as a flow chart, in addition to the check sheets can aid the internal auditor to cover more aspects of the ISO standards. This revolves around the idea of the Process Approach that internal auditors need to be well trained in to ensure more effective internal audits.  

Internal auditors may have a specialty in the field where they work and may not be comfortable asking questions in the other auditable schemes. So in these cases, you need to get them into as many new areas as possible, consider using YouTube to look at how other things are made, to teach them the ideas of the process approach. W. Edwards Deming was fond of saying, “that the more you see the more things look similar.”  

Other good questions to ask:  

• Have all the internal auditors taken the OSHA 10-hour General Industry course? Even if you are not registered to the ISO 45001 – this is still a very good idea. 
• Are the internal auditors aware of what an OSHA or EPA official might be looking for in your business? 
• Have your internal auditors ever had the chance to shadow the registrar’s audits to see how they perform audits? 
• After the initial training process, what improvement events are offered to the internal auditors to learn more skills? 
• If you utilize the Layered Audit Process (LPA) with your management team, have the internal auditors been given the same training?  

Possible sources of audit questions or audit trails for internal auditors. 

• Train all internal auditors in the tools of the Gemba Walk. These can be very useful in looking at the process approach of the area.  
• If there are no current process maps for an area, instruct the internal auditors to work with process owners to create them. If they are in place, take them into the audit to verify accuracy. This includes the Turtle Diagrams for automotive sectors.  
• Quality, Environmental or Safety site risk matrixes. If you have a risk number, look at one aspect of that number and look at the high values of that one column instead of the total risk value. Example: in most FMEA Risk Priority Number, Severity is one of the three typical factors. In a scale of 1—10, look at the areas that have a six or seven in the Severity column. 
• The audit reports from your registrar, have they found and asked your internal auditors to conduct a full Root Cause Analysis (RCA) on those issues. 
• Review the safety near miss log – internal auditors could conduct an RCA on these issues. 
• During the audit, internal auditors should ask each person what they would like different from what they currently have or what change in process methods would be helpful. These can lead to opportunities for improvement (OFI) as well as identifying risks for the company that management should review.  
• If there are JHA/JSA, control plans and/or some form of risk registry? Take them all out to the shop floor and see if they align with each other. 
• Use customer complaints or internal nonconformance reports to track the RCA in an area. 
• Ask the question of older employees as to where the next safety accident is going to happen and go see if it is still possible. 

Continual improvement is a clause found in all of the ISO Management System Standards (MSS) and should be applied to the internal audit process as well as the products or services that you provide to external customers. Yes, your internal auditors are busy doing their daily jobs and we need to encourage them to search for ideas to help the company improve in all aspects of the business. This is why we send the auditors into different departments from where they might work to give some fresh eyes in that area.  

For new auditors, giving them basic training in auditor techniques should be in alignment with ISO 19011:2018 and then build from there for your particular organization. Encouraging them to look at various sources like Quality, YouTube and many others can help give them the confidence that they need to conduct successful audits. Based on their written audit reports, you can start to work with them on improvement to their auditing skill to benefit the organization. 

In recap, many organizations seem to go through their internal audit program as a compliance issue for the MSS requirements in 9.2. Many organizations are missing a very good opportunity to train future leaders in their organizations by engaging them in the internal audit process to hone their management skills. Your internal audit process should be a key tool of the management team to help the organization in their continual improvement efforts.