How to run an internal audit that finds something

Most internal audits find nothing, and that is the problem. A programme that returns a clean sheet every cycle is not evidence of a healthy system; it is evidence that nobody looked hard enough. The internal audit is the cheapest place in the organisation to find a problem, and a finding raised here costs a fraction of the same finding raised by a certification body or a customer.

What clause 9.2 actually requires

ISO 9001 asks for four things, and they are less prescriptive than most programmes assume:

• An audit programme planned against the importance of the processes involved, changes affecting the organisation, and the results of previous audits. Risk-based, in other words, and not simply everything once a year.
• Defined criteria and scope for each audit.
• Auditors selected so that the process is objective and impartial. The standard's phrasing is that auditors shall not audit their own work.
• Results reported to relevant management, with correction and corrective action taken without undue delay.

There is no required frequency, no required checklist template and no requirement that an auditor hold a certificate. What there is, is an expectation that the programme is designed rather than inherited.

Planning it so it finds something

Two decisions determine whether an audit is useful, and both are made before anyone walks the floor.

The first is what to look at. A programme that audits every clause of the standard in rotation will spend most of its time on things that were fine last year. A programme that weights toward the processes where work actually goes wrong will not. Look at your nonconformities, your customer complaints and your near misses from the last cycle, and let them set the schedule.

The second is who audits. Independence is the requirement, but competence is what makes it worth doing. Someone from another department who understands the process well enough to ask a second question will find more than an experienced auditor who has to be walked through the basics.

Auditing the practice, not the procedure

The most common way an internal audit fails is that it checks the documentation against itself. Someone reads the procedure, asks whether it is being followed, is told yes, ticks the line and moves on. Nothing was tested.

The alternative is to follow a real case. Pick an order, a batch, a change request or a training record and trace it end to end, asking for the evidence at each step. Where the trail is complete, the process works. Where it breaks, you have found something, and it will usually be one of three things: the procedure describes work nobody does, the work happens but leaves no record, or the record exists and nobody reviewed it.

This is also the fastest way to discover that the controlled document and the document in use are different versions, which is the single most common finding in document control.

Writing a finding somebody can act on

A finding needs three parts, and the middle one is where most reports fail:

1. The requirement. Which clause, which procedure, which contractual term.
2. The evidence. What you saw, with enough detail that someone else could find it again: the document number, the date, the batch, the person's role.
3. The gap. What the evidence shows against what the requirement asks for.

What a finding should not contain is a solution. Deciding how to fix it belongs to the process owner, who knows constraints the auditor does not. An audit report that prescribes the fix tends to get the fix it prescribed, whether or not that addresses the cause.

Be clear about severity, too. A nonconformity is a requirement not met. An observation is something that will become one if left alone. Calling everything an observation to keep the report comfortable removes the only signal management has.

Closing the loop

A finding is not closed when someone writes a corrective action. It is closed when the action has been done and something shows it worked. That means a due date, a named owner, and a check afterwards, which is often another sample of the same process a cycle later.

Corrective action asks for the cause, not the incident. If a record was missing, the correction is to complete the record; the corrective action is whatever explains why it was missing, and that is usually a step that was never practical, a handover that nobody owns, or training that happened once. Our QMS functionality is structured around the ISO 9001 clauses so the finding, the action and the evidence stay attached to the same process rather than living in three systems.

A programme worth having

Judge the programme by what it costs you to be wrong. If a certification audit or a customer audit is finding things your internal audits did not, the programme is decorative, and the cheapest fix is usually to audit fewer processes properly rather than all of them quickly. See the three kinds of compliance audit for how the internal one sits alongside the others.