A Guide to Successful Internal Auditing

The internal auditor acts as a fresh set of eyes on your established processes, reviewing day-to-day behavior to see if:

• Processes are being followed
• Processes are still effective/relevant
• Risks occur during these processes
• Output is of a consistently high standard

Depending on your industry, different departments within your business may need internal audits more frequently than others.

Planning an audit

The first step is to draw up a list of areas that need an internal audit. This may include:

• Purchasing
  • Purchase invoice process
  • Purchase order process
• Sales
  • Sales invoice process
  • Sales order process
  • Sales quote process
• IT and Security
• Human Resources
• Accounting
  • Payroll process
  • Expenses process
• Manufacturing
  • Preparation of Item A
  • Production of Item A
  • Finish/Quality Control process
• Shipping
  • Stock process
  • Shipping process

Once you have your list of areas and processes in place, you can plan out how frequently they require auditing. With this information, you can create an Internal Auditing Calendar for the year.

Internal auditing calendar

It’s important to treat internal audits as a necessity, and not as an additional process outside the business model. Drawing up a calendar ensures that the audits will be completed on time and frequently.

Your internal auditing calendar doesn’t need to be anything fancy. A simple template to follow could be:

Using an audit calendar will also allow you to alert the next department to be audited in advance, which is recommended so that they can prepare the correct documentation for you to review. It also gives the internal auditor a chance to locate the process documents, review how the process should be followed and write up relevant questions, before they observe it in action.

The internal audit process

Observation and interview

With questions in hand, the internal auditor should then monitor the employee performing a given process, preferably in a natural scenario (i.e. the task needed doing that day). Asking the employee questions about the process they are performing will give the auditor insight as to whether or not the member of staff is:
a) Following the process properly
b) Understands the process and the risks it is designed to mitigate.

Depending on the answers, the auditor can make note of areas that may need refresher sessions, or aspects of the process that may not have aged well (such as inefficient practices compared to technology that has been brought into the workplace).

Report write-up

With the observation and interview process complete, the internal auditor needs to write-up their findings and highlight any areas of concern.

Again, the report document can be as simple or as detailed as you require, so long as the findings are recorded. In the event of a process found to be non-compliant, the auditor will need to recommend further measures in an action plan. They may also need to raise a Non-Compliance Report, depending on your company and its quality compliance measures and recognitions:

Action plan

Working alongside the respective head of department, an action plan can then be put together to address any shortcomings or risks highlighted in the internal audit. This should include:

• The finding
• The corrective action
• Who will take ownership of implementing the corrective action
• The deadline for doing so

There should also be a follow-up date to ensure the corrective action has been applied:

The process of internal auditing is a benefit to any business, and it should be implemented as a critical procedure, and not simply as something to tick off in the books!