How to handle Internal Audits in a very small company?
We are a very small dry blending company. 4 management 4 production employees. How in depth do I have to be for the audit schedule - ? Responsibilities? I am using the NSF Internal Audit Check list Module 2 & 11. Do I need to list all the records reviewed? It is nearly impossible to have staff independent of the function do the audit.
Normally the review is conducted by the SQF Practitiioner and senior management.
For one of our smaller clients (total of 4 people) they use their SQF document index form and starting from 2.1 keep working forward in reviewing everything and all inputs - on the index form we have an area to write comments, amendments (because you need to keep a record of amendments) and the date of the review and or change to documents.
I understand small business, we are afterall a small business where those in the office here wear many hats, it is quite acceptable for the same people to do multiple things including the annual review plus general internal audits and most of our clients are small to mid-size and family operations, thus when it comes to doing audits all hands are on the task - you have 8 people avaialble, you have enough to ensure people are not overstepping on themselves, it will be just fine.
And since we wear many hats, I have to go and walk the dogs now, check the mailbox down the lane, take the garbage out, and come back here and begin a new SQF development project.
Be careful on separating your Validation and Effectiveness component (2.5.1) and your internal audit component (2.5.5).
To meet the 2.5.1 requirement you and your team can go through and review each element of the code - this includes looking at all procedures, forms, etc ensuring everything is up-to-date, properly completed, meeting the code, and effective when in place. This component can be done fairly easily even within a small company point by point over the year.
2.5.5 for internal audits is different and more strict. You need to demonstrate that the person (or people) conducting the audit are properly trained in internal auditing techniques and they should be independent from the function they are auditing (2.5.5.4). The SQF states ''where practical'' person should be independent, but some SQF auditors are really tough on this. If you have a small company you can always outsource your audits to a 3rd party company, just be sure to include in your internal audit procedure that it can be conducted by an external party.
My suggestion to you would be to continue using your checklist to complete your review component but outsource your internal audit. It is seriously worth the investment (typically costs around 1200$ for 2 day audit in Canada), it will save you time and the internal auditing training. It will also provides a good practice run for the actual audit.