10 Tips for Internal Auditors
Internal auditors can make their audits significantly more efficient and effective with the following 10 recommendations. These tips are based on the experiences of internal auditors as well as external auditors who have to look at the internal audit reports. There is always significant potential for improvement. This is summarized briefly and succinctly here:
Planning and Preparation
Internal audits are required for the certification of a management system. The purpose of internal audits is to enable the organization to monitor itself and to initiate corrective measures and improvements independently. Many companies are familiar with the term “internal audit”. The purpose is similar, but it should not necessarily be carried out by the people who usually audit the accounting areas of a company. There is a risk of operational blindness. A division of tasks with regard to information security or quality management is usually quite sensible. The following tips will help internal auditors and audit program managers to carry out their audits with less pressure and conflict.
1. Set a common goal
Describe the benefits of an internal audit for your organization so that others also see it as an advantage rather than a nuisance (“surveillance”). Negative terms (e.g. “it’s mandatory”) trigger resistance and escape behavior. At the beginning of every meeting, you should briefly explain to the person you are talking to what the internal audit is for (e.g. optimizing processes, complying with regulations):
- State the benefits
- Avoid negative wording
- Explain to your partner the goal of the internal audit
- Optimizing processes, complying with regulations
- Work with checklists and take external and internal requirements into account
- Show genuine interest in the ideas and suggestions for improvement of your partners
- Include all important information in your report
2. Involvement of the management
The management must be involved in the internal audits as far as necessary. During the certification audit, the auditors of the certification body will check whether the management really supports the management system and the associated consequences. Therefore, encourage the top management to take on the leadership role in appropriate situations. Discuss the content of the audit program with the management. The top management is obliged to provide you with sufficient time and resources for the audit process. Inform the management of the results and follow-up measures. The audit program must have a high priority, otherwise an unpleasant minor deviation threatens to prevent later certification. The management must support your decisions regarding content and procedures.
3. Plan enough time
Internal audits are a priority! Plan enough time for the audit process. Set in your calendar when the audits should start and when they should be completed. Show that you are not wasting capacity and that you are carrying out the audit process efficiently. Suggest important topics to management and ask them for other topic suggestions so that management thinks along. Audit time is valuable working time. It must be used in a way that is worthwhile for the company. You can start putting together your reporting documents early on so that you don’t spend too long reporting afterwards. Always take audit notes after or partly during every meeting. This will make your reports more consistent and important things will not be forgotten. Be more punctual than the train. Stick to your schedule moderately. Reserved time is a buffer for important topics that may crop up unexpectedly. Respect the trust placed in you by treating information received in confidence as confidential. Every item on your list should be dealt with. If something is not possible, it must be postponed for a future audit.
4. Be prepared
Good preparation can ensure that the internal audit process is completed quickly from start to finish with virtually no gaps. Important audit topics should be highlighted so that they are not overlooked. Suggestions from your audit program manager or management should be incorporated into the audit plan. But don’t be intimidated. If internal audits have been carried out in the past, you should also study these old reports. You will get a better sense of whether the organization has improved since the last audit. Are there any internal or external complaints? What remedial measures have been taken and have they eliminated the cause of the complaints? Look at the auditing procedures and the associated processes. A shortlist of topics helps you to proceed in a more structured manner. What are the specific risks and opportunities? The preparation phase enables you to involve other colleagues as well. This creates broader acceptance within the organization. Their knowledge helps them to look at risks and opportunities more sustainably. It is also a good way of involving the specialist departments by asking them to define their risks and opportunities.
Conduct in a structured and unbiased manner
Those who approach an audit in a structured manner can achieve more positive effects on the organization in the long term.
5. Listen and learn
A good auditor asks open questions and then listens carefully. Letting the other person finish speaking is not only respectful but also an opportunity to gain unexpected insights. Don’t forget to take a few notes during the conversation where necessary. Also collect evidence of the insights gained. It is important to have objective evidence of compliance or non-compliance for the report. Ask your conversation partners for help so that you take relevant evidence and ideas from the conversation.
The quality of your report depends on your preparation, the approach to the audit and the subsequent processing of the findings. This way, follow-up measures can later bring about more effective, sustainable improvements. Don’t let calls or other distractions deviate from your schedule. Interruptions are like sand in the gears. Focus questions on the audit. The checklist will help you to cover everything as far as possible. Don’t let the checklist become a stumbling block in your conversation.
6. Develop the skills of your auditors
Internal auditors use a range of skills in conjunction with their specialist knowledge. It is important to continue to develop your skills so that you can achieve better audit results over time. Particularly with large audit teams, it is advisable to consider the following points:
- Appointment/recruitment
- Training and skills development
- Performance evaluation
- Remediation of poor performance
Audit program managers encourage the development of auditors. The motivation of the audit team can sometimes suffer greatly from disapproval from the workforce. The audit program must also be continually improved.
7. Share successes
The successes of the internal audits should not be left to the audit manager alone. The co-auditors should know the follow-up measures. The result of the organizational efforts will show how effective the internal audit measures are. Talk about successes and difficulties within the audit team. Share your knowledge and successes with the “younger” team members.
8. Conversion from PDCA to CAPD
The PDCA model is often used as a guide in internal audits. However, this leads to an overemphasis on planning and preparation, leaving little time for the actual audit. Too little time is given to implementing improvements. This reduces the effectiveness of the measures. It is advisable to switch from PDCA to CAPD. The focus is therefore on the more difficult phases of review and adjustment. Ask your discussion participants to rate the effectiveness of your process. Ask for evidence of measures taken to correct identified deficiencies in conformity or effectiveness.
9. Stay unbiased
Interessenskonflikte sind immer ein Problem für die Nachhaltigkeit eines Audits. Der Prozess und die Auswirkungen des internen Audits sollte getrennt gehalten werden von früheren Tätigkeiten der Auditoren. Es wäre nicht hilfreich, wenn Auditoren ein bestimmtes Ergebnis versuchen herbeizuführen. Dadurch würde das Auditergebnis verfälscht werden. Üblicherweise sollte man seine eigene Arbeit bzw. Abteilung nicht selbst prüfen. Zudem sollten die internen Auditoren nicht aus Angst vor Repressalien ihre Untersuchungen abändern. Sollte ein Auditor befürchten er könnte in ein Interessenskonflikt geraten, so sollte er das Audit nicht annehmen.
10. Maintain a positive climate during the audit
Many interviews not only provide you with deeper insights into your own organization, but also allow you to experience a wide range of human reactions to an audit. Some people react with fear or irritation. It is therefore important to create a positive atmosphere for the interview. Your auditing techniques will expand with each audit.