Many executives only see internal audits as something that has to be done for compliance reasons. However, the reality is that an efficient and effective internal audit program can reduce redundancies, reduce risk, enhance customer satisfaction, and bring about cost savings. An effective internal audit will also improve efficiencies by identifying opportunities for improvement and eliminating unnecessary or unproductive activities.   

Best practices in internal auditing are not always evident. Below will cover what is involved in setting up and performing effective and efficient internal audits. 

Step 1: Define Pre-audit Activities 

Develop Procedures for Internal Audits.    

The procedures must specify the actions taken before, during, and after each audit. The goal of the internal audit procedure is to define the “how to” of the audit process and to standardize how audits are to be planned and executed, and how corrective actions must be addressed.  

Design Audit Program 

An audit program establishes which aspects of the quality management system must be audited, which suppliers will be audited, the length of each audit, and how many audits will be performed for a certain amount of time. Usually this is determined at the beginning of the year. 

Evaluate Auditors 

It is important that you find the right people with high-level technical skills and a relevant range of expertise. You can look in-house for dedicated internal auditors or contract with external experts. External auditors can provide impartiality that the in-house internal audit team cannot. Also, external auditors are able to observe how the same or similar processes are implemented at the various clients they audit which provides a unique perspective on current regulatory expectations and industry best-practices. 

If you are considering using internal resources, calculate the adequate number of internal auditors since they cannot audit their own activities. For instance, Department Managers cannot audit their own departments or even processes from other departments if their involvement in those processes is significant. 

Select Audit Team 

When selecting the audit team, evaluate the team's combined skills and experience to determine whether they are appropriate to perform the task at hand. Ensure the audit team members have between them the knowledge, skills, and availability needed to prepare for an audit, carry out an audit, and develop the audit report. 

Define Audit Plan 

While an audit program focuses on how multiple audits are scheduled, an audit plan looks at how a particular audit will be performed. Your auditor needs to conduct preliminary planning and data collection to define the audit’s objectives and the audit's scope. This includes content such as the quality manual as well contact information. Choose an employee to be the “point of contact” who can provide this information to the auditor. 

When determining priorities, a risk-based approach is recommended. Take into consideration that status and importance of each process and area to be audited. 

Step 2: Performing Audit Activities  

Performing the internal audit process that involves the following steps: 

Audit Announcement 

Once the audit objectives are defined, the written audit notification should be issued to the departments that are to be audited. The memo should be directed to the department's head or other relevant senior officials. The goal of the audit notification is to communicate the schedule, objectives, and scope, as well as to set the expectations for the audit process. 

Opening Meeting  

The opening meeting is the formal start of the audit where the auditor presents expectations of the audit and reviews the audit plan. During this meeting, the auditee can ask questions to clarify the audit approach and can provide the auditor with any missing information.  

Walk-through of Site  

This important step provides the auditee an opportunity to provide an overview of the area and what work is performed there.  Auditors will make note of layout, appropriateness of product flow, and equipment status.  The walkthrough is an important step for the auditor to gain an understanding of what, how, and where things are done.   

Audit Interviews 

Interviews with are the next critical step in the audit process. There is no better way to assess the effectiveness of processes and procedures than by simply asking employees and managers what they do and how they do it.  Accuracy, understanding, and consistency of implementation can all be assessed via interviews.   

Review and Communicate Results 

Should your audit team identify potential control weaknesses, policy and procedural violations, and any other deviation during their walk-through of the site, they should inform you promptly. Notably, throughout the audit, strive to discuss any observations to ensure the identified issues and risks are well understood. However, the full results of the audit should be communicated in the closing meeting and audit report. 

Closing Meeting  

After the fieldwork, you should formally meet with the auditor and other member of management to discuss all the issues identified and your recommendations. Accepted practice is for both parties to discuss and agree on what counts as deviations and proposed recommendations. This ensures that your response is not only reasonable but also achievable. 

Reporting  

An audit report is crucial for reviewing audit issues and recommendations that enhance audit completeness and accuracy. It also helps prepare a formal response and action plan. The audit report captures any identified recommendations, observations, and deviations. Additionally, an audit report helps monitor and review audit plan results, identify the need for Corrective Action and Preventative Action (CAPA), as well as point to opportunities for improvement.  

Step 3: Post-audit Activities 

Audit Feedback Survey 

After the issuance of the final audit report, ask those involved to complete a Post Audit Survey that will help you determine the audit process's effectiveness. This survey will also give you essential insights on: 

• The relevance of the report recommendations. 
• Audit planning and communications      
• Audit timing 
• Auditor professionalism and performance 

Appropriate Action Based on Findings 

Once the audit report it received, it may contain several observations regarding compliance with requirements as well as identification of opportunities for improvement. However, if the audit report is simply filed away, the potential benefits from process improvement are lost, along with the resource costs that went into performing the audit. An effective process for managing the implementation of the corrections and improvements identified in the audit is critical to realize the full benefits of the audit process, in addition to meeting applicable regulatory requirements. 

Follow-Up Audits 

The auditor may also conduct a follow-up audit after the completion of the original audit. During these follow-up audits, the auditor will verify that deviations have been corrected. 

Work With Experts During Internal Audits 

Beyond being required for specific certifications, internal audits improve a company's effectiveness and efficiency. However, setting up audit plans from scratch is difficult if you don't have an audit services advisor with prior experience. An internal audit strategy can lead to costly dead ends if not planned right from the start.  

If you are interested in learning more about audits and other aspects of regulatory affairs, subscribe to our blog.