Building a Risk-Based Internal Audit Programme That Adds Value
How to build an internal audit programme that adds real value instead of being a routine exercise before the certification audit
Internal audit is one of management’s strongest tools for seeing the real state of the management system. In many organisations, however, it has become a formality: a generic checklist, a quick audit just before the certification body visits, and a report nobody reads.
The standards require the audit programme to take into consideration the importance of the processes concerned, changes affecting the organisation and the results of previous audits. That is the essence of risk-based auditing: directing auditor time to where the real risks and opportunities are, instead of spreading it evenly across every clause.
This article explains how to build the programme, select auditors and write findings that lead to real improvement, using the guidance of ISO 19011 on auditing management systems.
1. Audit programme versus audit plan
| Element | Audit programme | Audit plan |
|---|---|---|
| Time span | A year or a full certification cycle | One audit |
| Content | Processes, sites, frequency, criteria and resources | Scope, timetable, auditors and key questions |
| Owner | Programme manager (often the quality manager) | Lead auditor |
| Review | After significant changes and audit results | Before every audit |
2. Building a risk-based programme
2.1 Identify processes and sites
Start with the process map: management, core and support processes, sites and shifts, and outsourced processes.
2.2 Assess the importance and risk of each process
Simple criteria work well, for example:
- Effect on product conformity or safety, the environment or occupational health and safety.
- Number of complaints and nonconformities linked to the process.
- Recent changes (new equipment, new staff, new products).
- Results of previous internal and external audits.
- Legal requirements and specific customer requirements.
2.3 Turn the assessment into frequency
| Priority | Examples | Suggested frequency |
|---|---|---|
| High | Production, critical control points, receiving, laboratory | Twice a year or more |
| Medium | Purchasing, warehouses, maintenance | Once a year with follow-up |
| Low | Human resources, documentation | Once a year |
The programme must still cover every process and every clause of the standards within the cycle, even if some are audited less often.
2.4 Integrate where possible
In an integrated management system one process can be audited once against quality, environmental, safety and food safety requirements together, with specific checklists for the technical requirements of each standard.
3. Selecting auditors and ensuring impartiality
- Auditors do not audit their own work or their own department.
- Appropriate training is required, such as an internal auditor course on the relevant standard, plus supervised audits before working independently.
- Auditor competence is evaluated periodically by reviewing reports and observing audits.
- Small organisations can use external auditors to maintain impartiality.
4. Conducting an audit that reveals reality
Follow the process, not the clause
Instead of asking “where is the document control procedure?”, trace a customer order from receipt to delivery. Along the way you will meet the requirements, responsibilities, records and risks.
Use different sources of evidence
- Interviews with people at their workplace, not only in the meeting room.
- Direct observation of work.
- Random record samples from different periods.
- KPIs and their trends.
Write clear findings
Every nonconformity has three parts: the requirement, the objective evidence and the conclusion. For example:
Requirement: the effectiveness of corrective actions is reviewed (clause 10.2). Evidence: 6 of 8 actions in the third quarter were closed without any evidence of effectiveness verification. Conclusion: effectiveness verification is not applied consistently.
5. After the audit
- The report is issued within a defined period, for example five working days.
- Nonconformities enter the corrective action system and are subject to root cause analysis.
- The auditor verifies effectiveness before closure.
- Programme results and trends are presented at management review.
- The programme itself is updated from the results: a process with repeated findings moves up in priority.
6. KPIs for the audit programme
| KPI | Why it matters |
|---|---|
| Programme completed on schedule | Measures commitment to the plan |
| Findings per audit by process | Shows where the weaknesses are |
| Findings closed effectively | Measures the effect of auditing |
| Findings raised by external audits but missed internally | Measures internal auditor competence |
The last KPI is especially telling: if the certification body keeps finding what internal auditors miss, the programme needs attention.
Conclusion
A good internal audit programme is management’s early-warning system. When it is risk-based, carried out by competent and independent auditors, and followed through to verified effectiveness, it becomes a real source of improvement instead of an annual burden.
Does your audit programme reflect the organisation’s current risks, or is it a copy of last year’s?