---
id: KB-IC-007
url: https://app.codecontract.io/help/reports-and-quality/internal-audit-without-the-theatre
idioma: en
categoria: informes-y-calidad
subcategoria: calidad
audiencia: usuario
nivel: intermedio
actualizado: 2026-08-13
tambienEn: [es]
relacionados: [KB-IC-002, KB-IC-005]
citadoPor: [KB-IC-009, KB-IC-010, KB-IC-014, KB-CR-019]
---

# The internal audit, without the theatre

_Its job is finding problems before someone else does. If it finds none, something is wrong._

**Responde a:** how to run an internal audit · what to review in an internal audit · internal audit programme · internal audit findings

Internal audit has a problem built in: it is done by someone from the house, who knows everyone and knows what to look at to avoid awkwardness. That is how it ends up a formality that finds nothing and serves nothing.

## The sign it has become theatre

**En corto**

- It finds no findings, or always the same three harmless ones.
- Two weeks' notice is given and everyone tidies up first.
- The report is written before the looking is finished.

> [!IMPORTANT]
> An internal audit that finds nothing does not prove all is well: it proves nobody is looking. And it is worse than not doing one, because it also creates the false comfort that it has been checked.

## What to look at so it serves

| Area | The useful question |
| --- | --- |
| Suppliers | How many have something expired right now? |
| Records | Were they filled in when things happened, or afterwards? |
| Training | Who is doing something their training expired for? |
| Non-conformities | How many have been open over six months? |
| Access | Are there accounts for people who left? |

All five are answered with a filter, not an interview. That is the difference between auditing and asking whether everything is fine.

> [!WARNING]
> Do not turn findings into a list of culprits. An internal audit used to point at people stops receiving information the following year: people tidy up for the photo and the problem stays underneath.

> [!NOTE]
> Findings you make yourselves are worth more than an external auditor's, because they arrive earlier and count in your favour. Finding four things internally is a good result, not a bad number.

**How often should it be done?**

Annually at minimum; twice a year while mid-change.

**Can the person running the area do it?**

Better not: people audit their own work badly, however well intentioned.

**Does it have to be documented?**

Yes, with its findings and their closure. An unrecorded audit did not happen.

## Ejemplos

**A company runs its annual internal audit and never finds anything.**

- Replaces the questions with five concrete filters
- Has someone from another area run it

→ Finds seven things, five are fixed that week, and the external audit passes without surprises.

**The internal audit is prepared the week before by creating records after the fact.**

- Audits against what is genuinely recorded
- Notes findings with an owner and a date
- Reviews at three months whether they closed

→ The internal audit serves to find things rather than to pass an exam.

**Everything is audited each time and there is never enough time.**

- Rotates the areas across periods

→ Each area is examined properly when its turn comes.

**Findings are noted and nobody closes them.**

- Checks the open ones monthly

→ The list goes down.

**The internal auditor audits their own area.**

- Swaps areas between auditors

→ The finding is credible.

**An audit happens and there is no record of what was reviewed.**

- Records the scope and what was examined

→ The audit is demonstrable.