Jump to content

  • Quick Navigation

Advertisement

Featured Implementation Packages

* * * * *

Ineffective Internal Audit: Underlying Causes

internal auditing audit

My name is Jean-Guy Cormier, P. Eng. Lead Auditor. I am a professional engineer providing consulting and auditing services for almost 30 years. As a professional auditor, I have done over a thousand audits against food safety, quality management, environmental and health and safety management systems. In the past 10 years, I have done over 250 FSSC audits in the food and packaging industry. I have been working as Lead Auditor for DNV GL - Business Assurance, one of the leading global certification bodies, for 10 years.

 

After so many years, one observation that continues to linger is ineffective internal audit process. Almost every audit that I have participated in, there have been findings against requirements of internal audits. Arguably, some of the underlying causes, why internal audit process is ineffective are:

  • inadequate training and ongoing professional development;
  • poor preparation;
  • poor utilization of adequate tools;
  • not having the abilities to communicate in writing and/or verbally;
  • Poor skill sets to collect samples of observations and supporting evidences.
Thus, I would like to share my views of what I have encountered. Hopefully, internal auditors can improve their auditing skill sets not only to demonstrate the effectiveness of the facility management system, but, also, identify potential gaps with strong supporting evidence and, more importantly, opportunities for improvement to strengthen the effectiveness of a management system.

Purpose

 

What is the purpose of auditing a management system in a certified company? Internal auditing determines the robustness and effectiveness of the plant management system. Ultimately, it provides feedback to management on the performance of the facility management system and where to focus their resources in areas requiring attention.
Why internal audits are important to management? There are several reasons why internal audits can be very beneficial to plant operations:

 

one – identify areas of improvements. the internal audit evaluates the effectiveness and efficiencies of the management system. Corrective actions are generated to address raised findings during the internal audit process.

 

two – employee growth and breaking communication barriers- It is a good strategy to use employees from other departments as internal auditors. This allows the auditor-employee to learn various aspects and functions of the business. It can also break down some communication barriers between employees and management. For some, it can be an opportunity for growth in the company.

 

three – internal feedback. If it is done correctly, findings can provide significant insight in the company's operation including existing performance and identifying opportunities for improvements.

 

four – audit report. A well written report is a summary of observations, in which area(s) facility management should focus their energy and resources.

 

Key factors of why internal audit process is ineffective

 

Internal auditors should be tougher, dig deeper than third-party auditors, because they are familiar with plant operations and understand company culture. However, I recognize that internal auditors may do one or two internal audits per year. Yet, an auditor at a certification body, such as DNV GL Business Assurance, may do one or two audits per week.

 

Auditors at DNV GL also benefit from calibration training once or twice a year, as well as there is constant feedback from senior management, certified companies, and accreditation bodies, such as FSSC, BRC, RvA, ANSI. From this feedback DNV GL’s auditors improve their auditing skills over time - something an internal auditor may not benefit from.

 

Thus, often, there are observations and/or findings that a third-party auditor records against requirements of internal audits. Some of the underlying causes include inadequate training and lack of ongoing professional development, poor preparation, poor utilization of auditing tools, and inability to communicate in writing and verbally. This also includes inadequate collection of observations that would support any positive or negative conclusions and communicate those findings to the process owners for a better understanding of some of the gaps that may exist in the department or process, which he or she is responsible for.

 

Another primary cause is lack of management commitment and/or management understanding on the benefits of internal audit process to company operations, which leads to the lack of:

 

- Resources for adequate training and
- time to do the audit and follow-ups. Absence of those lead to:

 

1. Not covering all aspects of the business operations, specifically the plant leadership – too often an internal audit team does not audit plant manager, for whatever reasons. It is important that one auditor is assigned to audit the leadership team of the site. Site manager must demonstrate their leadership and commitment to an effective and continuous management system. Management should be aware of the performance of the management system and which resources are required to strengthen and improve the existing management system.

 

2. Internal auditors are ill prepared and/or not qualified: it is great that plant personnel volunteers to become internal auditors, but too often they are ill prepared, because they were not properly trained; expectations and outcomes of the internal audit were not explained to them and they are not monitored by qualified management during the internal audit to later provide feedback.

 

Internal auditors in most cases may do one or two audits per year, and it is very important that management provides refresher training every year and continuously monitors the progression during the audit. Sometimes, it is helpful if people work as a two-person audit team, where one person interviews the auditee and the second person takes notes, with the team alternating these roles. This creates synergy with the two-person audit team and quality of the audit improves significantly.

 

Also, the person responsible for the management system should organize witness audits to observe the audit team and provide feedback to increase knowledge and competencies. It is also important for the person, responsible for the management system, to explain expectations and upcoming changes. To overcome possible barriers in the company’s culture, the audit team could be a composition of managers and hourly personnel.

 

3. Using a generic checklist that has no value to the company’s operations: checklists are used all the time both for internal and external audits. But for a novice auditor using a checklist will only scratch the surface, and there are little opportunities to investigate deeper.

 

A checklist is a tool, but it is an assigned auditor’s responsibility to investigate as deep as he or she wants to assure the confidence of the audit. If the site is planning to use a checklist, it is better the checklist is adapted to the company’s operations. The best checklist I’ve seen includes guidance notes what to look for and expectations of specific activities, audits, or requirements.

 

4. Observations are incomplete, most often a documentation review: too often, internal auditor(s) will review documents, but would not review records, observe site operations and/or interview management and hourly personnel. Good manufacturing audits, process audits, or system audits determine the effectiveness of every process that is part of a company’s operation, and ultimately the effectiveness of a plant management system.

 

Thus, process audits must include interviews of the process owners, samples of interviewed personnel, who work or are responsible for the process. It also includes documentation and records reviews and, if necessary, site visit for both inside and outside a facility premises.

 

An internal auditor can review procedures beforehand to fully understand process activities, but ultimately, he or she audits the effectiveness of the assigned process. Furthermore, the auditor must document positive and negative observations to support the assessment of the effectiveness of the audited process.

 

5. There is no evidence that records were covered or reviewed, and there is no evidence that observations were made on site visit of company operation: too often, records associated with the management system are not reviewed and recorded on the auditor’s checklist or auditor’s notes. There are no guidelines how many records should be reviewed, but if there are several records every day for example about inspection activities, an auditor should review the initial sample to determine effectiveness of the inspection process, and if there are any gaps or deficiencies, the auditor can review more records.

 

Ultimately, the auditor must have confidence the audited process is effective. In addition, both positive and negative observations should be recorded. Unlike a GMP audit or an inspection, a description of the observations should be documented to demonstrate traceability and support findings.

 

6. There is no evidence of proposed continuous improvements when gaps are identified: an internal auditor has more flexibility and is not restricted by accreditation requirements to propose opportunities for improvement. Internal auditors have many years’ experience with plant operation, know the culture and should be much tougher than an external auditor to ensure the audit process is effective. And if there is a gap, the assigned auditor can propose opportunities for improvement.

 

7. Difficult to maintain integrity or objectivity, when an assigned auditor is auditing own company’s department and or processes: often the person, responsible for the management of the facility management system, takes part in the internal audit. The best practice would be, if the person, responsible for the facility management system, would delegate the internal audit to others, and he or she can focus on improving the effectiveness of the system.

 

8. Auditing by process or risk factor: there are still many companies that are auditing by standard requirements or even by clause - this is old-school. A more effective practice would be auditing by process and/or by risk factor and associated requirements of the standard that the process owner would be responsible for. Such approach would provide added value, because the process owner would know some of the gaps that have been identified in his/her process. Also, auditing by risk factor would ensure that more resources are dedicated to the high-risk areas and low risk areas get less resources.

 

9. Do not fully understand the science, methodology and/or techniques of specific processes: the assigned internal auditors must understand the science, technology and/or methodology in the audited areas: e.g. hazard analysis, risk analysis, corrective actions, microbiological hazards, metal detection. If they do not have the knowledge, we strongly suggest preparing some training materials to help them understand some of these key concepts; otherwise the audit would be very superficial.

 

Furthermore, extensive literature - various technical and scientific papers - is available on the Internet about internal audit best practices, good manufacturing practices, methods, technologies and methodologies. Auditors should constantly search the internet for topics of interest that can help during an audit.

 

10. Poor selection of auditors: auditing is not for everybody - it is important that the person responsible for the selection of the internal audit team should be very selective as to who should be part of that team. The selected auditor should have some abilities to investigate and collect evidence, communicate the evidence to the process owners and document his/her observations on the audit checklist and/or auditors’ notes.

 

More importantly, internal auditors should be motivated to not only determine the effectiveness, but also ways to improve the audited process. It will not be easy, but the assigned auditor should audit the same process several times to have a better understanding of operation and become familiar with the activities.

 

In this case, the assigned auditor should be able to recognize any deficiencies and propose opportunity for improvements. Furthermore, some schools of thought consider auditing once a year as a bad practice: instead, audits should be spread out throughout the year and be performed by a very small pool of auditors.

 

11. Pool of auditors is too large in comparison to the complexity of the operation: too often an audit team is too large, sometimes 30 to 40 auditors in a 200 or 300-person operation. That is a large team to manage and the quality of auditing suffers, because the assigned auditor may only do one audit per year.

 

Instead, best practice would be to select a small group of auditors, who will be more efficient. There is no magic number how many auditors there should be, but it should be relatively small, so that the audit team could maintain integrity and do a number of audits per year, which would add value in an effort to continuously improve effectiveness of a management system. To train all these auditors significant resources are required, which may not add any value to the audit team, if it is only utilized once or twice per year.

 

12. Verbal communication: for an internal auditor, this may be the most difficult task, because he or she is auditing a colleague, a friend and/or a superior. For some auditing superiors or managers can be intimidating, or an auditor may be hesitant to provide adequate feedback, especially if the findings are not favorable. In a large company it is relatively easy to select a group of auditors, who are independent from plant operations.

 

But what do you do, if you are small to medium-size facility, with no corporate support? It starts with the management’s commitment and explanation of expectations for the outcomes of the internal audit process, which would, essentially, aim to strengthen and improve the affected process, to the process owners.

 

Yet, it is very important for an internal auditor to be transparent and provide feedback to the process owner after the completion of the audit process. If the process owner pushes back on some of the findings, then the person responsible for the management system, and, in some cases, plant leadership should intervene to avoid potential personal conflict between the process owner and the auditor.
However, it is important for the internal auditor to be professional, diplomatic, courteous, in some cases pragmatic, ready to compromise when necessary, but not be influenced by the process owners’ reactions and be firm, if there is sufficient evidence that supports his/her findings. For most, this may be very challenging.

 

Conclusion

 

In summary, management must recognize benefits of the internal audit process to strengthen the facility management system and provide adequate resources, including time and continuous training, ensure selection of qualified auditors, who in turn can ensure effectiveness of the facility management system and, more importantly, identify opportunities for improvements. Management must clearly explain to the audit team its expectations for outcomes of internal audits.
For internal auditors, interpersonal communication with colleagues and superiors can be challenging, but after an auditor performs a number of audits, this challenge should become less burdening.

 

It is also important to constantly review auditing best practices, to be aware of the most up- to-date concepts such as lean manufacturing and/or six Sigma concepts, to be prepared by knowing company’s operations and culture and make adequate observations, including from listening to plant personnel’s comments during interviews, document reviews and site visits. There should be adequate evidence to support an auditor's findings.

 

Author Biography

 

Posted Image

 

Jean-Guy Cormier, P. Eng.,
Professional Lead Auditor
Moncton, NB. Canada

 

Industrial engineer Jean-Guy Cormier takes particular pleasure in helping manufacturers and processors of various sizes improve their technology capacity. For years his primary focus was to develop and transfer technologies in the aquaculture industry, seafood processing and small manufacturing industries. That work allowed him to build a broad base of knowledge through his extensive travels around the world.

 

He is also a specialist in ISO- 9001, ISO-14001, Occupational Health and Safety, Food Safety and Food contact packaging, including HACCP, ISO-22000, FSSC 22000 and British Retail Consortium; training and development; and process and productivity improvements. As a professional Lead auditor, he regularly does external management system audits in North and Latin Americas with large international and reputable certification bodies.

 

“International management system standards are normally generic and not very prescriptive in nature,” he says. “Many small and medium-size, and even large companies, and their respective managers have difficulties understanding some of the requirements of a particular standard. That is because they may not have the skill set and/or sufficient resources, so they struggle with the development and implementation of a management system. This is where I can help them.”
With his extensive working experience with management systems and his affiliation with some of the largest registrars in the world, Jean-Guy provides concrete and practical examples and tools for effective and successful implementation of management systems.

 

“I take a lot of pride in providing value-added services when I work with a company,” he added. These include monitoring the progress of the project, providing the management team with the most current information and tools, identifying the strengths and weakness of the management system, proposing practical and systematic solutions and methodology, and providing clear and concise interpretation of each management system standard.

 

In the past 30 years Jean-Guy has organized more than 1000 management system audits. He taught these management systems with the Canadian Standards Association Learning Center for 10 years, explaining and clarifying the requirements of management systems to companies in the Americas.

 

Mr. Cormier work with French, English and Spanish-base companies. Jean-Guy laid the educational foundation for his impressive skill set with a Bachelor of Applied Science, Industrial Engineer, a five-year degree from Université de Moncton in Canada and Total Quality and Environment System at the Technical University of Nova Scotia in Halifax, Canada. As a life-long learner, he is constantly upgrading his skills to stay up-to-date and proficient in significant programs in the respective standards mentioned above. He is a Registered Professional Engineer with the Association of Professional Engineers and Geoscientists of New Brunswick, a Registered Food Safety Lead Auditor with RABQSA, Milwaukee, WI USA, and a Registered Quality, Environmental and Health and Safety and Food Safety Lead Auditor.



Share this

7 Comments

Fantastic article! I agree in all points,

Tnks,

Leila

Very interesting for new comer

An excellent article which mirrors my experience. Many of these issues relate back to senior management comittment and culture of the business. A positive culture tends to encourage issues to be raised and a poor organisational culture tends to bury problems. One of the questions I always ask when tutoring on Internal Audit courses is "If there is a problem with the effectiveness of your food safety / quality management system, who do you want to find out about it first?' and then give the options of their customers, certification body, regulatory authorities or their own company? The trainee auditors don't take a lot of convincing - I should really be asking their senior managers.

An Excellent article

Excellent article, these points are so true for the internal audit process.

Very insightful and informative

great article, very practical information, thank you!