Getting Real Value From Internal Audits

An internal audit that finds nothing is not good news. It usually means the audit looked at the procedure rather than the work. The purpose of internal auditing is to find problems before the certification body or a customer finds them, and to fix them while doing so is still cheap. That takes trained auditors and a method that follows real evidence through the business.

Audit the process, not the clause

Many internal audit programmes are organised by clause: one audit for document control, one for training, one for calibration. This makes it easy to tick off the standard, and it tends to miss the problems that matter, because real failures happen where one process hands over to another.

A process-based audit starts with how the business actually works. Pick a process such as contract review, purchasing, production or inspection and ask:

• What goes into this process, and where from?
• What comes out, and who receives it?
• Who does the work, and how do they know they are competent?
• What equipment, information and documents do they use?
• How is the process measured, and what do the measures show?
• What are the risks, and how are they controlled?

The relevant clauses of ISO 9001 or AS9100 then become the questions you ask within that process, not the structure of the audit. Certification body auditors work this way, so your internal audits should too.

Sample records, and sample enough

An auditor who looks at one record and finds it correct has learnt very little. Sampling is how you form a view of whether the process works consistently.

Choose samples deliberately. Do not let the auditee hand you the folder they have prepared. Pick from the system yourself: a range of dates, different shifts, different operators, different customers. Include the awkward cases, such as rush jobs, concessions, repeat orders after a long gap, and work done by a subcontractor.

Look for what should exist and does not. A missing first article report, an expired calibration on a gauge used last week, a training record for someone who started after the matrix was last updated. These gaps are often more telling than errors in records that do exist.

Follow an order through the system

One of the most useful audits any manufacturer can run is to take a single customer order and follow it from enquiry to delivery.

Start with the purchase order. Was it reviewed against the quote? Were special requirements, key characteristics and flow-down clauses identified? Then follow it into planning, purchasing of material and outside processing, production, inspection, any nonconformance, final release, the certificate of conformity and dispatch. Was it on time? If not, why not?

At each step, check the evidence matches what the procedure says should happen, and that the information passed between departments was correct. Customer requirements that were identified at order entry but never reached the shop floor are a classic finding, and one that customers and certification bodies take seriously.

This kind of trail audit tests several processes at once and shows how they connect. It also produces findings that the management team understand, because they are about real orders.

Write findings that lead to action

A finding that cannot be acted on is wasted effort. Each one should have three parts:

• The requirement. What the standard, the customer or your own procedure requires.
• The evidence. Exactly what you saw, with references: order number, record, date, location.
• The statement of nonconformity. A clear sentence linking the two.

Avoid vague findings such as "training records need improvement". Write instead what was wrong, where and on which records. The auditee should be able to read it and know what to investigate.

Then hold the line on corrective action. Correcting the individual record is not enough. The owner needs to find the root cause, act on it and check that the action worked. Our root cause analysis guide sets out a practical method. Close the finding only when there is evidence of effectiveness, and look at it again at the next audit of that process.

Train auditors properly

Internal auditing is a skill. Good engineers and supervisors make good auditors once they have been trained in the method: planning, process-based questioning, sampling, interviewing without leading, recording objective evidence and writing findings. Practising on the company's own records during training is the quickest way to build that skill, and the trainee usually finds real issues before the course is over.

Auditors should not audit their own work. In a smaller business that can mean training people from different departments to audit each other, or bringing in outside support for the processes the quality team owns. For the wider certification picture, see how to prepare for an AS9100 audit.

We train internal auditors using your own system, and can run or support internal audits alongside your team. See our training services or get in touch.