ISO Audit Group / After

Internal audit that is worth doing

Not a rehearsal for the certification audit.

Internal audit is frequently run as preparation: check the same things the external auditor will check, in the same way, and fix what is found. That produces a smoother external audit and very little else.

Its actual advantage is that it can go where an external auditor cannot: more time, more context, no commercial relationship, and the ability to look at what the organisation is genuinely worried about rather than at the scope.

Independence within a small organisation is the practical difficulty, and the workable compromise is auditing across functions so nobody audits their own area, plus being explicit about where independence is limited.

Internal auditors need training and almost never receive it. Somebody assigned to audit without preparation will check documents, because that is what is obviously checkable.

The findings should go somewhere with authority. An internal audit reporting to the manager of the area audited will produce findings that manager is comfortable with, and everybody involved will know it.

There is a further internal audit consideration worth naming, which is that the programme should be risk-weighted rather than uniform. Auditing every process annually spends the same effort on the one that could close the business as on the one that could not, which is a plan rather than a judgement.