With our new reality of social distancing, can internal audits be effective? Do we need to throw out the audit program schedule, or is it possible our audits might even improve? Let's explore some options to help us keep our audit programs functioning.
In reviewing hundreds of audit programs and audit reports, it is sad to say that many of these reports were superficial evaluations of the processes reviewed. Why? The auditors relied on checklists (that asked questions about having and following procedures) and mainly verbal responses (without verifying records or observing practices to confirm the effectiveness of the processes). That limits the reports to verifying conformance with the INTENT and IMPLEMENTATION of the standards without evaluating EFFECTIVENESS. We can do better!
What if our auditors changed focus to review the records and evaluate effectiveness of the processes? How would they identify what to review? Hopefully, by understanding the processes within the audit scope.
What are the:
You may already be thinking that the above list should be part of any audit preparation and I would agree. Although, when teaching even experienced auditors, they nearly unanimously agree that their past preparation has been severely limited. Then, they have that "Aha!" moment in which they understand the value of preparation to therefore enhance the value of any audit findings (conformance or nonconformance).
The ISO 19011:2018 Guidelines for Auditing Management Systems has an informative Annex A with Table A.1 Audit Methods. This table explains four (4) main methods to audit that can be used while on-site or off-site. In these cases, the auditor may have interactions with humans or not. These methods give us a model to follow while our "norms" are forced to change.
Here are a few practical examples:
1. Video Calls: Instead of being in the same conference room looking at a screen as documents or records are being pulled up, you can do a share a screen video conference. This may also enable you to see analysis of data within a wide variety of software programs used by the company. What do the managers review to know if it is a good day, week, month, quarter? Explaining the trends is very valuable to the auditing process.
Example 1. A client was thousands of miles away, so travel time and per diem expenses added to audit costs. Once we worked in person and established trust and rapport, it was very easy to audit via remote access. In this case, I was functioning as an internal auditor, so they knew I was "on their side" to help confirm progress and identify blind spots. We also worked to understand the impacts of any issues raised to help prioritize them. Part of what made this work well is my list of documents and records, people to interview, and questions. This preparation helped reduce time clicking around.
Example 2. Executive leadership (division president) was out of the country. This was a bit more challenging since the interview was phone only. No body language was visible and we had never met. The interview was near the end of the internal audit and several significant findings needed to be discussed. Time was limited. What worked here was asking "what if" questions of the leader that gathered their perception of impacts related to the audit findings to confirm potential impact to the business, verify the facts and potential impact, and then make the ISO linkage.
2. File Research: Instead of being guided by a representative of the department, you are given view-only access to their file storage area. They may have an orientation or on-boarding document that explains their approach to file management. The auditor can be fresh eyes to their approach. Can you find the files needed to answer the above questions? Are they organized? Are they complete? What does the data show?
Example 3. A client totally changed their internal platform for internal communication. Many users had complained that it "took 10 clicks to find anything!" They set me up with VPN access to evaluate their new platform and their approach to file organization. I also had access to their old way to be able to compare and contrast from the user perspective. This was like a scavenger hunt! The audit results were helpful to give feedback prior to the full launch. It helped avoid further frustration by the users.
Example 4. In teaching internal auditing, each team was given a small scope that included evaluation of records management for that process. The participants were genuinely surprised that the "weekly" inspection reports were strewn into a variety of central files and personal folders of the inspectors. Once the files were located (or confirmed to be missed inspections), they were able to be evaluated in sequence to evaluate effectiveness of the inspection process. This evaluation confirmed the inspection questions were interpreted differently. For several key questions, some inspectors thought XX was the correct answer, while others thought YY was correct. In contrast, if this audit were done "normally," one or more inspectors would have shown their inspections and perhaps no issues would have been found. By looking at the overall system, the inspection process was significantly improved.
In summary, it is feasible to do effective audits using remote auditing techniques or methods. In fact, using this approach, the auditors may be forced to look deeper into the records and evaluate the processes for effectiveness. Often auditors use the interviewing process as a crutch and limit their review of records and supporting documentation. You can use this time to upgrade your auditing processes by focusing on the details and ways to increase management's involvement.
Contact us if you would like to discuss your audit program and explore ways to enhance the value of audit results for your organization. We can set up remote coaching sessions for you or your auditors.