Maintaining Objectivity: Changing Your Hat

As an internal auditor, there are some things you should always keep in mind. First, it is important to remain within the scope of the audit. If the audit plan is to audit the receiving department, resist the temptation to wander into other processes, even if observations in receiving seem to point elsewhere. If that happens, it is better to plan a separate audit of those other departments at a future date.

It is also important to exercise objectivity. This can be difficult because of personal relationships and company dynamics. Here is a technique I use personally: before I begin an internal audit, I step outside the building, into the parking lot or the front entrance, take a deep breath, and mentally remove my “worker” hat. I replace it with my “internal auditor” hat. When I walk back in, I am walking in as an independent internal auditor, free from company gossip and personal feelings about people or processes.

The auditor must also collect and analyze evidence that is relevant and sufficient to support their observations and conclusions. We will discuss the methods for achieving this later in the article.

Finally, I feel I should not have to mention this, but the internal auditor should always act in an ethical manner.

Auditee Responsibilities

While we often focus on the auditor’s role, the auditee and their management also have responsibilities during an internal audit. These include:

• Informing all relevant employees about the objectives and scope of the audit
• Appointing responsible staff members to accompany the audit team
• Providing all resources needed by the audit team
• Providing proper access to facilities and processes
• Cooperating with the auditors
• Helping to determine initial corrective actions based on audit observations

No one really teaches auditees about their responsibilities, yet they are genuinely accountable for the above. For example, how many times have I planned an audit for a process, only to be told upon arriving that this particular process is only performed on Tuesdays, and we are there on a Thursday. It would have been nice to know this when we scheduled the audit with the auditee.

Internal Auditors Are Not the Quality Police

Many people think of internal auditors as the “quality police” working for management. Nothing could be further from the truth. Let me share a story from when I was implementing an ISO 9001 system at one of my clients.

There was a gentleman nearing retirement who was responsible for one of the organization’s processes. Despite multiple training sessions and being provided with the relevant procedures and work instructions, he was still very confused. He told me candidly that he genuinely wanted to participate in the ISO 9001 project but did not know what he needed to do within his department to comply with all of the requirements.

I told him: “Invite your internal auditor and ask them to perform an audit of your department.” He looked at me in shock and said, “Why would I do that? I haven’t really done anything yet!” I looked at him and said, “Exactly, that’s the point. Your internal auditors are on your team. If they come in and audit your department, they will outline everything that needs to be done to comply with the procedures and work instructions. At the end of the audit, it will essentially be a to-do list for you, clear and actionable, so you can address the issues one by one. You will also have the opportunity to ask questions about any findings you do not fully understand, and during that discussion, other opportunities for improvement may arise.”

Understanding that internal auditors are part of the team and are there to help is the best approach anyone can take.

The Audit Plan

The lead auditor is responsible for creating the audit plan. The audit plan should include:

• The audit scope and objectives
• Identification of who is responsible for the area being audited
• Reference documentation
• Audit team members
• The planned date and location of the internal audit
• The expected time and duration of each process audit
• The schedule of opening and closing meetings
• The audit report distribution list
• Any logistical considerations, such as required safety equipment
• All organizational units to be audited

The audit plan can change. In fact, it can change from the time it was issued right up to a few days before the audit. Why would it change? Consider a major failure or problem addressed in a corrective action or customer complaint that relates to the processes you are about to audit. In that case, you may want to add those issues to your audit plan and ensure they were addressed effectively.

Read part 1 here.