Planning an internal audit can give you a real headache and cause a bunch of worries. Let´s begin by mentioning that when I made my very first internal audit plan, I ran into a few bumps, especially because I didn´t have any idea how to start.
It´s true that a lot of questions can pop up when planning an internal audit. That´s the reason why I´ve worked on breaking down the most common ones and put together a step-by-step- guide to help you out if you need to plan an internal audit for your lab.
Here´s what we´re going to talk about:
- What’s an internal audit?
- What’s the difference between an internal and external audit?
- What’s an internal audit plan?
- Why is an internal audit plan important?
- What’s the difference between an audit plan and an audit program?
- How to create an internal audit plan step by step?
Let’s get started!
What´s an internal audit?
An internal audit is a process that evaluates any aspect of your organization. If we have testing and calibration labs as an example, the audit might consider things related to the management system, stakeholders, methods, equipment, staff- you name it.
One of its main purposes is to get useful information that can help the people in the company make better decisions. And those decisions are all with the idea of reaching the organization´s business goals.
You need to keep in mind that the internal audits should be carried out by people who aren´t directly involved in the process or activities being evaluated. These people can be employees that belong to the same organization or external people who are hired just to do the audit.
What´s the difference between an internal and an external audit?
The key point to make this distinction depends on the target audience. In an internal audit, the target is the most important top management of the organization.
We can say that in a lab, the top management, could be, the lab director. In this case, the information gathered during the audit would be aimed at the director of that organization.
On the other hand, an external audit is the one that focuses on looking at useful information for outsiders such as clients, other organizations either public or private, accreditation bodies, investors, and so on.
In addition, internal audits are usually done by the organization´s own staff (sometimes they might bring in outside people), while external audits are done by third parties who are independent form the organization.
What´s an internal audit plan?
According to ISO 19011 and ISO 9000, an audit plan is:
“a description of the activities and agreed-upon details of an audit.”
That means an audit plan is a document that establish in detail how the gathering process objective information will go- information that will then be compared to reference standard or requirements, like the ones found in ISO/IEC 17025.
An audit plan can have a set of internal audits that can be carried out over a period of time—say, over a year.
During all these internal audits, the plan can act like a guide that gives you direction on what needs to get done, based on the requirements set in the standard or reference.
By having those references into account, you will know whether they are being met and get a good idea of how long the audit might be.
Why is an internal audit plan important?
An internal audit plan is important since it can bring a whole bunch of benefits to your organization. So, one of the most important ones is this:
Along the risk assessment phase, which is part of the internal audit plan, it can be possible to find risks that haven´t been addressed yet. That gives the audit team the chance to raise the flag and let others know about these risks early on.
Based on that, the planning phase helps break down the inefficiencies when it´s time to actually do the audit, that means you will also save some money in the process.
Investing time on designing a properly plan for your internal audit will help you have a real purpose and direction to the audit work itself.
What’s the difference between an audit plan and an audit program?
In order to understand the distinction between these two, we need to define what an audit program really is. According to ISO 19011, an audit program is:
“Arrangements for a set of one or more audits (…) planned for a specific time frame and directed toward a specific purpose.”
Based on that, the internal audit program is related to a series of audits that have been agreed upon and are scheduled to happen over a certain period —say, over the course of a year.
That’s why you need to know that in some organizations the audit program requires just one internal audit done at a specific time. In some others, it may require multiple internal audits that are spread out across different times of the year.
Now that we have clear what the audit plan and the audit program are, we can have a comparison chart to highlight their differences.
How to create an internal audit plan step by step?
The steps to design a correct internal audit plan in a lab or other type of organization are described here. Each step shown has the main questions that you need to have in mind.
Step 1: Define what audits are about to be done.
If the audit plan defines what activities should be done in each audit, it is necessary to know which audits or audit are important to carry out. To do that, you need to answer the following questions:
What you should do in this stage is to think of your organization as a whole and then break it down into smaller sections. Once you do that, zoom in on the smaller sections- no matter how you split things up. Doing this will help you narrow down the scope and set clear goals for your audit work.
Step 2: Do the risk assessment phase
The big question you need to answer is:
What are the risks in the organization that should be taken into account?
Giving an answer to this question is important when planning your internal audit. Why? Because the identification of risks gives you a clearer picture of your organization´s goals and how everything is aligned with the planning stage.
A correct risk identification can also reveal possible internal audits that you haven´t considered in previous stages.
Usually, the internal audit planning is done once in a year, and a calendar is set up to prioritize audits based on the risks you´ve found.
Step 3: Define the resources and timeline
When planning, think about whether internal audits will be done by your own team, outsourced to third parties, or maybe a mix of both.
Some audits might need people with special skills or knowledge that sometimes your team doesn’t have. In that case, bringing in external help is a good choice.
Figuring out who’s doing what and setting a timeline makes resource planning way easier.
Step 4: Get the internal audit ready
Once you´re done with all the steps above, it´s time to actually prepare the audit. There are a lot of things you can do, but here are a few questions you should ask yourself:
Step 5: Create the internal audit plan
Keep these questions in mind during this step:
Creating the audit plan can feel a bit overwhelming because there’s usually a lot of info coming in. But that’s not a bad thing—more info actually helps a lot when putting the plan together and carrying it out.
Step 6: Review the internal audit plan
Most organizations have an audit committee. This group oversees the internal audit function.
During the plan review, this committee should give their input to make sure all risks and other important stuff are covered.
Once the plan’s been reviewed, you can set up meetings to share it and start rolling it out. It’s super important to notify the selected staff in advance and make sure they understand the audit’s goals.
Conclusion
Doing internal audits regularly helps you see where your lab stands—and with that information, you can make better decisions to keep improving your quality system.
So, take full advantage of your lab’s audits, and don’t be afraid of someone else checking your work.
If this post helped you—or you think it could help a friend—go ahead and share it on your socials!
Catch you next time!
