Internal audits are a key management control activity that ensures the internal business processes are consistent. It also enables the organisation to identify gaps in business processes as well as opportunities for improvement.

An internal audit is a form of audit process that occurs within the organisation to assess the conformity of internal processes and systems. The main objective of an internal audit is to verify and ensure that organisation’s policies and procedure are followed and also inform the top management about the gap in the policy compliance.

In cases where the organisation lacks competent resources to conduct the internal audit, then the organisation can engage an external third party provider internal audit services. Before outsourcing the internal audit to an external agency, the business has to ensure that the external company is competent to conduct the audit and has well established internal audit practices that would benefit the organisation. The organisation should be aware that internal audit process is conducted not to identify human faults in the process but to seek at areas of improvement that may enhance the overall performance of the firm.

Regular internal audit of the system and processes will enable the organisation to maintain product quality and compliance with applicable standard requirements.

Note: All ISO management system standards (such as ISO 9001, ISO 14001, ISO 45001) requires the business to carry regular internal audit as part of the performance evaluation.

Performing an internal audit is usually time-consuming and requires resources that have to be dedicated to the process. The frequency of the internal audit can be determined by many factors such as the risk of the system or process, the complexity of the system or method and availability of resources for internal audit. The organisation can choose to perform internal audit either monthly, yearly and even weekly.

Tip: Refer to ISO 19011:2011 – Guidelines for auditing management system. The standard will provide you with the framework and guideline to plan, schedule and conduct an internal audit.

The following audits tools would be required to perform an internal audit:

• Internal Auditor(s)
• Audit plan
• Audit checklist (recommended)
• Audit schedule

Performing Internal in 6 steps

1. Know what and when to audit
2. Create an audit schedule
3. Pre-planning the scheduled audit
4. Conducting the Audit
5. Record the findings
6. Report the findings

Step #1: Know what and when to audit

Before conducting the internal audit, you should identify what processes are going to be audited. Understanding the scope and objectives of the audit process will help you create an audit schedule. As mentioned earlier, internal audit should be conducted based on the risks of the processes. The higher the risk in a specific area of the business the more frequent you would want to audit that business area. It is also essential to understand the nature of the business process you are planning audit so that you can decide the right time to audit the system.

Step #2: Create an audit schedule

Creating an audit schedule provides the departments with an advanced notice of the upcoming audit. The program will help them have the necessary documentation and records available for review and audit. The internal schedule will also the business of planning for resources required to conduct the internal audit. A surprise audit is not recommended as it may create a disengaged situation and stakeholders will feel threatened by the auditor. It is recommended you share the audit schedule and obtain approval and confirmation.

Step #3: Pre-Planning the scheduled Audit

Being prepared before a scheduled audit is essential as it will simplify and make the whole audit process effective. During the pre-planning phase, auditors need to send an audit plan to department providing information about the audit scope, objective, criteria and possible documentation evidence needed for the audit.

It is necessary that the auditor is prepared before the audit with a clear understanding of the policies and procedure that will be reviewed. For example; Before auditing a purchasing process, the auditor needs to understand the policies and procedures related to purchasing and also know what kind of evidence that he/she may review. This will significantly improve the efficiency of the audit process will also reduce the downtime

Step #4: Conducting the audit

Internal audit can be conducted by different methods such as documentation review, interviewing and observation. Based on the scope and objective of the auditor, the audit shall choose any methodology or combination of all to carry the internal audit.  The internal auditor shall sight and examine sufficient hard-copy or electronic records to verify; evidence of compliance with the management system procedures; and effective implementation of process and internal control. You need to ensure the audit is conducted in a fair and unbiased manner.

Step #5: Record the findings

Recording the findings is vital in the audit process, and auditor needs to list all evidence sighted by record number or record data. The aim of documenting audit findings is to identify gaps in compliance and look at opportunities to fix the deficit and improve the process. Records may also include observation and notes from the interview process. It is recommended that the auditor provide a quick snapshot of the findings quickly at the end of the internal audit to ensure the auditee is aware and also has a chance to clear any questions.

Step #6: Report findings

All findings should be reported in an easy to read audit report. Audit reports serve evidence that an internal audit was conducted. These reports should be reviewed and approved by the department manager / top management. The report can also include an improvement / corrective action plan that should need to develop and implemented in the areas where gaps were identified. ISO recommends you use PDCA (Plan, Do, Check, Act) Management tool to facilitate and carry improvement process within the business.

To be successful, it is crucial that business meet the needs of their customer and can deliver products and service accurately without any error. All internal controls established by the organisation needs to be maintained and effectively followed to support quality products and services. An internal audit is a management tool that organisations use to ensure that process meets requirements.