Energizing your Internal AuditsBy: Robert Badner
Planning for the Internal Audit
The key to an effective, thorough and value added internal audit is in the preparation. If internal auditors are spending one to two hours preparing for an internal audit, it is not enough time. To properly prepare for an audit, it should take twice to three times that. If the actual audit time will take an hour, there should be at between two and three hours spent in preparation. A good rule of thumb to spend about two and half times as much time in preparation as the audit will take. Often times, auditors plan for a two hour internal audit and spend 1 hour preparing which leads to them running out of questions about 30 minutes into the audit. I can't stress this enough if you want to be a successful internal auditor or manage a successful internal audit program then make certain you spend adequate time in preparation for the audit.
This sounds easy, but it is actually very difficult. The major obstacles to allocating enough time for preparation are time restrictions placed on the internal auditors. Chances are they have other responsibilities aside from internal auditing that compete for their precious time. One method to help remove that obstacle is to have as many trained internal auditors as possible to spread the work load.
Effective planning for an internal audit requires following a few simple steps that are listed below.
1. Learn the process
Before you can audit a process you must become familiar with it. You need to learn how it is supposed to work, what it supposed to do, what are the inputs, outputs, activities, resources and controls. The first step would be to create a turtle diagram of the process (This may have already been done by the organization as part of their documentation, or in previous audits). A turtle diagram looks at the suppliers, inputs, activities, controls, resources, outputs, and customers. A turtle diagram is laid out such that the process activity is a box in the middle, the inputs come in from the left and outputs exit from the right of the box. The supplier is listed in the upper left hand corner and the customer is listed in the upper right hand corner. The controls are above the process activity and the resources are below the process activity. The feedback loop is an arrow from the output to the input. Let's do an example of a turtle diagram for a process. For this example, the process will be one that applies to about every business in some way and that's purchasing.
2. Identify the Interfaces to the Standard
The interfaces are the points where the process intersects the standard. In simple terms it is where the requirements of the ISO 9001:2000 standard are applicable to the process being audited. The easiest way to accomplish this is to use a matrix with the elements of the standard on one axis and the process name on the other. To better discern the interfaces of the process to the standard you could break the elements down into the sub elements. For example, 7.2 Customer Related Processes is comprised of 7.2.1 Determination of requirements related to the product, 7.2.2 Review of requirements related to the product and 7.2.3 Customer communication. The left side of the matrix would become larger, but you would have a more definitive intersection of the process and standard. This activity provides you with the understanding of what areas of the standard apply to the process. You will be developing questions to ensure compliance to the standard and this tells you what areas of the standard to focus on.
3. Document Review
The document review section requires reading and understanding the associated documentation for the process you are auditing. Start with the level 1 document, the quality manual. The quality manual should provide an overview of the process and should describe how the process fits into the overall quality system. The quality manual will explain what processes feed the process you are auditing and what processes are supported by it. It will describe the interaction and interrelationship of processes within the quality system.
The main output from the review of the quality manual will be an understanding of all the processes that make up the quality system and how they interact. The quality manual should provide a good description of how the processes work.
Next, review the level 2 documentation or procedures. Procedures should describe the process in more detail than the quality manual. There could be many procedures outlining the quality system, or there could be the minimum required by the ISO 9001:2000 standard, six. The six required procedures are:
Since the ISO 9001:2000 standard requires less documentation than previous versions of ISO 9000, there may not be as many procedures to evaluate. In this case the document review portion will be reduced. During the document review of the manual and procedures your are trying to understand the process and the system and ensure the requirements of the standard are met.
4. Identify Potential Process Failure Modes
Another tool we want to utilize is the pFMEA, which stands for "process failure modes and effects analysis. You may have some background in FMEA's and you may not. Either way is alright because we are not going in depth in the FMEA process. An pFMEA is a method to identify potential problems with a process before the process is implemented. It is a preventive measure that aims to resolve problems before they occur. For our purposes we will be concerned with the process function, the failure mode and the cause of the failure mode. Below is an example of an pFMEA for the purchasing process:
Process Function Failure Mode Potential Cause
get good product bad product requirements not understood supplier is not capable not inspected enough
product on time product is late lack of capacity ordered late supplier out of product
low total cost too costly excessive rework excessive freight excessive testing
pFMEA's are an exhaustive approach that generates a large quantity of potential audit directions. By evaluating the prospective problems associated with a process, you can develop audit questions and an audit approach to ensure the potential problems are addressed. This can lead to some findings that can have positive impact on the quality management system.This process can help develop a foundation to create a checklist for the internal audit. With your developed checklist you can drive improvement in the quality system with the audit results.
© Copyright 2007, Robert Badner
The author assumes full responsibility for the contents of this article and retains all of its property rights. ManagerWise publishes it here with the permission of the author. ManagerWise assumes no responsibility for the article's contents.
Would you like us to consider your own articles for publication? Please review our submission and editorial guidelines by clicking here.