The customer of the audit is the person (or group) who agrees to the audit purpose and scope, and who’ll be given the audit results. They have responsibility for making sure remedies are put in place for any issues found. The customer might be the business owner or board or, for small audits, a manager.
First establish what you’re trying to achieve. Examples include:
Once you’ve done this you can start planning your audit, which includes:
You should also set an audit frequency that suits your organisation, meets required standards and is based on the safety risk of the areas being audited.
When you review the finding and recommendations of the audit, confirm whether they’re:
Ask, what the risk is to the business if nothing is done?
Each finding or recommendation needs to have its cause identified, which can be done by asking:
Note: latent conditions within a system can cause system defects. They need to be investigated so the auditor can set realistic and effective corrective or preventive actions.
Once the cause of a finding or recommendation is established, you should assign an action to address it. These actions should:
Preparing well is important for a successful audit. You’ll first need to select the auditor – ideally someone who has completed an auditing course. This person must be independent of the areas being audited, that is, doesn’t work in the area.
You or the auditor will then need to confirm and document the scope, which will be based on initial planning. This involves:
Note: the scope should include a review of the safety processes and procedures included in the organisation’s safety case and safety system.
The number of activities covered by a documented system is often too large to cover in a single audit, limit your audits to a relatively small sample of an operation. It’s helpful to include processes that address the following areas:
You can also do spot checks on items that have been inspected or tested by the auditee.
Only by reviewing the documentation can an auditor decide how to progress the audit and develop the questions they need to ask.
Documents you should review to understand what needs to be done include:
Other supporting documents you should review include:
Performing a desktop review of the documentation prior to the site visit will save a lot of time and effort during the audit. Familiarising yourself with the documents will enable you to ensure they comply.
Checklists are one way to ensure that the audit will be performed according to your specified audit objectives.
Note: a checklist is an aid to an internal audit. Internal audits are not a tick box checklist exercise.
Checklist benefits:
Care should be taken to only include questions that address the purpose and scope of the audit. Each question should be based on a documented requirement of the system.
A good audit will start with an opening meeting, which:
When you move on to the examination of the system, ensure you:
Inspection is a big part of an internal audit. This is when you look at results to ensure compliance is happening and that a system is reliable. The result of inspection should be confirmation of compliance and objective evidence to support any identified non-compliance.
There are two main methods to get objective evidence:
The way you do interviews during an audit can directly influence its success. Some helpful interview techniques include:
Lastly, keeping control of the audit. Good ways to keep control are:
It is important your audit findings make references to objective evidence. This means for each one you should state:
The finding should also include:
When writing the audit report, the findings must be clearly documented and should provide a clear description of the events that were witnessed during the audit. It should also:
You should write your audit report with your audience in mind, accounting for their technical understanding, authority and responsibility. For example, a report for a manager could be a lot more technical than one for a board, but would need to recognise the limits of their authority to remedy issues that may have a root cause elsewhere in the business.
Corrective action, required because of performing an audit, must be followed up and closed out.
The follow up phase of an audit is where the auditor monitors the closing of the actions. This includes ensuring accountability for completing the actions lies with appropriate management. It’s important the auditor accepts or rejects all actions taken to address the findings. For example, whether the action taken was appropriate to address the finding and stop any repeat findings in the future.
