Carrying out an internal audit: step-by-step plan and checklist

Step 1: plan the audit programme

Standards such as ISO 9001, 14001 and 45001 require internal audits at planned intervals. Make a programme for a year or a whole certification cycle: which processes and clauses are covered when? Audit high-risk or deviating areas more often.

Choose an auditor who is independent of the work being audited. Nobody should assess their own process.

Make sure the programme also leaves room for extra audits, for example after a serious incident, a major change or a series of complaints.

Step 2: set the scope, objective and criteria

Record for each audit what you examine (scope), why (objective) and what you test against (criteria), such as standard clauses, your own procedures or legal requirements. Also look at what is going on: open findings, complaints, incidents and recent changes.

Step 3: build the checklist

A good checklist consists of open questions that produce evidence, not yes/no questions. A useful structure:

Test the checklist with one colleague before you start. Questions that are unclear or yield no evidence are adjusted before you visit the department.

• A question per clause or process, for example: show how you record deviations
• The expected evidence, such as a register, record or instruction
• Room for objective evidence, conclusion and process owner
• Questions that fit your own scope, not just the standard wording

Step 4: carry out the audit and record findings

Talk to the people who do the work, look on site and ask for evidence. Note facts, not opinions. Record a finding straight away, with a severity:

Keep asking until you have seen the evidence. If someone says an instruction exists, ask to see it and for an example of it being used in practice.

• Strength: something that works well and should be kept
• Opportunity or observation: a chance to improve without a deviation from the requirement
• Minor: a deviation that calls for a corrective action
• Major: a system deviation that calls for a CAPA

Step 5: follow up findings with actions and CAPA

A finding without follow-up is worthless. Give every deviation an owner, a deadline and a measure. For a recurring or serious problem you look for the root cause and set up a CAPA (corrective and preventive action). Later, check whether the measure really worked.

For a closed action, check whether the problem is really gone. After a few months, ask for new evidence, because a ticked-off action is not yet an effective measure.

Step 6: report to the organisation

Write a clear report with scope, criteria, findings, a short conclusion and the agreed actions. Discuss it with the auditees before it goes to management. The results are also input for the management review.

Keep the report short and readable. Management prefers two pages with clear conclusions over twenty pages without a summary.

Checklist for the auditor

Go through these points before, during and after the audit:

• Before: scope, objective and criteria are recorded and the auditor is independent
• Before: the audited department knows the date and topic
• Before: open findings and actions from earlier audits have been reviewed
• During: evidence was seen, not just heard, and noted with its source
• During: findings were recorded immediately with severity and process owner
• After: the report was sent and discussed within a few weeks
• After: every deviation has an owner, deadline and measure

Common mistakes in internal audits

These mistakes make an audit yield little:

• The audit is a tick list and nobody asks a real question
• Only reviewing documents and not looking at how the work is really done
• Findings without an owner or deadline
• Auditing the same areas each time and skipping the rest
• The report disappears in a folder and never returns in the management review

An example of a good finding

A good finding is factual and traceable. For example: 'For three of the five projects checked, the signed work instruction was missing. Criterion: own work instruction procedure, chapter 3.' That leads to a concrete action: complete the instructions and build the check into the process.

Avoid judgements such as 'employees are careless'. Describe what you saw, what you tested against and what the effect is.

How to approach it

Start small: this quarter pick a process with risk or recent complaints and audit it thoroughly. Use the results to improve the checklist and programme. After a few rounds you have a fixed routine and spot recurring themes sooner.

Step 7: plan the next audit and use software where it helps

Decide whether a re-audit is needed and use the results to adjust your programme. That way your system improves with each round.

In BrydgeOne you plan audits with standards in scope, build the checklist from your standards and record evidence and findings directly. Findings go to Actions, an audit only closes when no open points remain, and you create a re-audit with one click.