Reports and quality
The internal audit, without the theatre
Its job is finding problems before someone else does. If it finds none, something is wrong.
Internal audit has a problem built in: it is done by someone from the house, who knows everyone and knows what to look at to avoid awkwardness. That is how it ends up a formality that finds nothing and serves nothing.
The sign it has become theatre
Important
An internal audit that finds nothing does not prove all is well: it proves nobody is looking. And it is worse than not doing one, because it also creates the false comfort that it has been checked.
What to look at so it serves
| Area | The useful question |
|---|---|
| Suppliers | How many have something expired right now? |
| Records | Were they filled in when things happened, or afterwards? |
| Training | Who is doing something their training expired for? |
| Non-conformities | How many have been open over six months? |
| Access | Are there accounts for people who left? |
All five are answered with a filter, not an interview. That is the difference between auditing and asking whether everything is fine.
Watch out
Do not turn findings into a list of culprits. An internal audit used to point at people stops receiving information the following year: people tidy up for the photo and the problem stays underneath.
Worth knowing
Findings you make yourselves are worth more than an external auditor's, because they arrive earlier and count in your favour. Finding four things internally is a good result, not a bad number.
›How often should it be done?
Annually at minimum; twice a year while mid-change.
›Can the person running the area do it?
Better not: people audit their own work badly, however well intentioned.
›Does it have to be documented?
Yes, with its findings and their closure. An unrecorded audit did not happen.
A real case
The situation
A company runs its annual internal audit and never finds anything.
What you do
- Replaces the questions with five concrete filters
- Has someone from another area run it
What you get
Finds seven things, five are fixed that week, and the external audit passes without surprises.
The situation
The internal audit is prepared the week before by creating records after the fact.
What you do
- Audits against what is genuinely recorded
- Notes findings with an owner and a date
- Reviews at three months whether they closed
What you get
The internal audit serves to find things rather than to pass an exam.
The situation
Everything is audited each time and there is never enough time.
What you do
- Rotates the areas across periods
What you get
Each area is examined properly when its turn comes.
The situation
Findings are noted and nobody closes them.
What you do
- Checks the open ones monthly
What you get
The list goes down.
The situation
The internal auditor audits their own area.
What you do
- Swaps areas between auditors
What you get
The finding is credible.
The situation
An audit happens and there is no record of what was reviewed.
What you do
- Records the scope and what was examined
What you get
The audit is demonstrable.
This article answers
- how to run an internal audit
- what to review in an internal audit
- internal audit programme
- internal audit findings