Developing and Maintaining an Effective Internal Audit Program

Understanding the difference between an effective internal audit program and just doing inspections

By Debby Newslow, President, D. L. Newslow & Associates, Inc.
Published June 12, 2012, FoodSafetyTech.com

In today’s world of management systems, customer audits, third party audits and tougher regulations, many ask for assistance not only in setting up an effective internal audit program but in understanding the difference between an effective program and just doing inspections. Having an effective internal audits is very important for a sustainable, compliant, and value added management system.

Top management must be committed. Management commitment must be evident throughout the process. Ensuring the provision of required resources for an effective internal audit process is a challenge for most management systems. It is critical that top management communicates through its ranks that the internal audit program is important to the system and that findings are fact-based observations, not a tool for discipline. The audit is an assessment of the process, not the people. Findings must NEVER be used for disciplinary action.

Each department team must take ownership of compliance rather than waiting for an audit to find out that something is wrong. The audit team is an independent set of eyes that sees what those close to the process miss - not because of neglect or a lack of concern, but because they are too close to the situation. The statement that we do not see the trees for the forest truly applies. In discussing effective internal audits, a few key principles stand out. The first, of course, is having a trained team that understands the concept of auditing and its role in the process. This team needs a leader who plans the audits, leads the team, and acts as a technical resource with a strong understanding of the organization, its processes and the focused standards. This leader, known most frequently as the Audit Program Owner, must have the right resources to create and manage an audit schedule appropriate for the organization. The Audit Program Owner must also have the responsibility and authority to report to the Top Management Team (may be a member of the team) on the status and effectiveness of the audit program.

Although there are many parts to an effective internal audit program, this article focuses on a frequently overlooked aspect of an effective audit program: ensuring that each auditor is accompanied by an area representative (guide) during the audit. This is critical to an effective audit. It is essential that a responsible representative (guide) from the area being audited accompany each auditor for the entire duration of the audit, and that audits never be performed without such a guide. It is very important that this person sees what the auditor sees, because he or she can provide information vital to the overall audit scope. It is essential that we not leave anything to interpretation. Remember that the audit process is only as effective as the relationship between the auditor and auditee. This concept may be one that is the most strongly challenged by department management. Let us review some audit situations and their outcomes with and without the area representative (guide). Keep in mind that the auditor is independent of the area being audited. Consequently, if an area representative is not present, those being audited may not truly understand the auditor, and may feel that they don’t need to allocate much time or be concerned with the audit results. Conversely, by design, the auditors are evaluating a process unfamiliar to them and may need some orientation.

 

Situation One:
An auditor asks the packaging operator to demonstrate his verification of the metal detector that has been identified as a CCP in their process. The operator has three metal standards. She places one at a time on a bag of product confirming that a bag is rejected. The operator records the results on her form. The auditor states: “It appeared that the system was rejecting the bag after the standard, not the bag with the standard.” The operator states that she did not notice that, but she did run through the process again confirming that in actuality, the line is rejecting the bag prior to the standard, not the bag with the standard.

a. The auditor is accompanied by an area representative (guide). The area representative saw this and was very concerned. He stopped the line immediately and called maintenance. The operator was instructed to follow his procedure for a CCP deviation. The area representative contacted the department manager making him aware of the serious situation. It was investigated, the product evaluated, and the situation corrected.

b. The auditor is not accompanied by an area representative (guide). The operator stated that she would notify her supervisor, but that she would get in trouble if she stopped the machine. The operator stated that a bag was rejected (not the correct bag) so the metal detector is working. The line kept running and the auditor made a note of the finding and moved on. The auditor did notify his audit program manager who stated he would tell the department manager. At the closing meeting, the auditor read his finding. The department manager stated that he sent maintenance to check it out, but maintenance could not find anything wrong. So, what do you think happens next? How many serious situations could evolve from this?

Situation Two:
An auditor is doing a GMP audit of the warehouse. The scope of this audit is to review the shipping process. The auditor interviews four different associates, asking each of them what the process is for loading the trucks and for knowing what needs to be shipped. The auditees explain the warehouse software system that ensures that product that is not approved or that is on hold is not pulled for shipments. In the process of auditing, the auditor notes an empty transport backed up to the warehouse. He asks what this transport is for, and the auditee states that it is waiting to be loaded. The auditor notes that the transport has two holes (daylight coming through) on the bottom of the transport and that there is a strange odor coming from inside. The auditor questions the inspection process, and the auditee states that it will be inspected by the forklift driver assigned to load it, and that the inspection results will be documented on the bill of lading. The auditor asks to see a record of the load that the auditee is working on, and he provides a copy of the bill of lading with the inspection stamped present and signed as acceptable for the current load.

a. The auditor is accompanied by an area representative (guide): As a result of this observation, the area representative also noted the holes in the transport and the foul odor. The representative immediately contacted the area lead, who stated that they had turned down the transport the day before. It was returned with assurances that it had been cleaned, and the transport company stated that the holes on the bottom were of no concern. The representative asked that the transport be returned to the supplier stating that it did not meet their requirements.

b. The auditor is not accompanied by an area representative (guide): The auditor stated that, as defined in the warehouse SOP, this transport was not in compliance and asked if it would be used. The auditee repeated that it was up to the person loading to make that decision, but that he would leave a note in the office to the lead person to check it out. The auditor moved on. Later that day he returned to review the paper work and found a copy of the bill of lading for the load that went into the questionable transport. It was stamped with an acceptable evaluation of condition, loaded, and released. When noted in the report, the department manager’s only comment was that since the transport was gone, he had no way to follow up on this issue and felt that a corrective action identifying this would be useless. Wow – not even a true assessment of the situation or root cause or fix suggested for the future.

Situation Three:
The audit team is auditing the receiving area. The scope of this audit is to review the incoming inspection process to confirm if all required evaluations are being completed. The auditee demonstrates positive knowledge of the required activities, including being able to access the document control software for the most current version of the specifications and requirements for acceptance. The auditor asks the associate if he uses any calibrated equipment, and is told that they have a calibrated thermometer. The auditor asks the status of this calibration and the auditee states that she does not know, but thinks that the quality department checks it once a week. The auditor also asks how she was trained and if there are records on her training. The auditee states that she learned from the previous person and that she does not know about any records.

a. The auditor is accompanied by an area representative (guide): The guide stated that the quality department did perform the calibration process and recommended that they ask that department for the records on this thermometer. The guide also noted that they would need to review the calibration SOP to confirm that defined requirements for the identification of the calibration status were met. The guide confirmed that training records are kept in the supervisor’s office, leading the auditor there to confirm this before visiting the quality lab to complete the calibration trail. The auditor was able to review all related information to identify findings and observations. Results were documented and reported at the closing meeting. The audit was completed on time.

b. The auditor is not accompanied by an area representative (guide): The auditor was unaware of required trails to follow so she completed the audit, writing nonconformances for calibration (one for thermometer not calibrated and one for not having the status clearly identified) and training (one for lack of training related to calibration and one for no training records confirming operator had been trained). The auditor presented findings to the department manager, who was quick to argue each finding, stating that these were worthless and did not add any value because he was sure that they had all the required information. The auditor just didn’t know where to look or whom to ask.

These are only three simple examples. Similar examples could be found for just about every audit activity, comparing the effectiveness with and with out a department representative or guide. Participation of a guide dramatically increases audit effectiveness. As stated previously, it is essential that the department representative see what the auditor sees. Additional benefits include being able to explain the process to the auditor, to answer questions on issues outside of the auditee’s area of responsibility, and to provide guidance on trails that may answer the questions and where possible, provide evidence of compliance.

Another resource issue is the availability of department management for an opening or preaudit planning meeting. Prior to beginning the interview process, the audit team should arrange to meet with the responsible management of the area to be audited. This provides an opportunity to review the scope of the audit and any other pertinent information. Examples of pertinent information would be associate availability, identification of the person(s) who will accompany the auditor (department representative or guide), and agreement of a time for the closing meeting to discuss the audit findings.

An effective audit also requires a “reasonable” scope. It is recommended that a process map be developed for each identified audit process. Based on this information, identify all related elements for the process. This can be done in the process map or in a related matrix. Once this is done, divide the total process into 4-6 “sub-scopes” which will be audited throughout the 12 month period.

There are many critical parts of an effective internal audit program. In this article we touched on several key aspects including auditor training, role of the audit program owner, the audit planning meeting, and identifying a manageable audit scope, with the main focus in this document on the importance of the audit representative or guide. No matter which aspect of the program we focus on, top management commitment is a must. Remember, the audit is not meant to find everything wrong but to provide independent eyes to reinforce compliance. Auditors are fact finders, not fault finders, and the audit is of the process, not the people.