Initiation and planning

First of all, the customer of the audit should be clear. This doesn’t have to be the person organising the audit. This is the person or group who agree to the audit purpose and scope, and who will be presented the results of the audit. They will have responsibility for ensuring the subjects of the audit remedy any issues found. The customer might be the business owner or Board, or for small audits, it could be a manager.

Internal audits should be initiated for a reason, so you should first establish what you’re trying to achieve. Examples include:

• Verifying that your organisation continues to meet specified requirements
• Evaluating your organisation against system standards
• Verifying that your organisation is in full compliance with safety legislation.

Once you’ve done this you can start planning your audit with a clear focus. Planning includes:

• Selecting the specific activities to be audited
• Selecting the audit type (procedures or high-level processes)
• Selecting the dates, auditors and areas of the business to audit
• Producing an audit timetable and schedule.

You should also determine an audit frequency that suits your organisation going forward, that meets required standards and is based on the safety risk of the areas being audited.