The first question to answer when commencing an internal audit program is ‘what to audit?’
Experts vary in their advice given to companies when setting up an internal auditing program or revising an existing one. If you audit only procedures, you are likely to miss parts contained within policy manuals. If you only audit the policy manuals and procedures, then you are likely to miss the linkages between the different procedures. If you only audit processes then the audit may become too lengthy. The truth is not obvious and there are many variables that will impact on your decision. To make you feel comfortable about your decision, just remember it doesn’t matter where you start. Those companies that do some auditing and find some things and fix some things are better than those who do no auditing at all. Your auditing will mature over time.
What to Audit?
Begin by looking at the documented information that supports your business. This may include a wide variety of sources including:
- Policies
- Procedures
- Standards
- Legislation
- Instructions
- Project plans
- Contracts
- Specifications
- Regulations
- Organisation Charts
- Job descriptions
The list is endless. These sources represent your internal audit criteria and will assist you in creating an audit checklist. When you conduct an internal audit, it is an opportunity to verify and validate the content of your managements systems in order to ensure any necessary changes and/or improvements are identified. To assist, creating a checklist is a good way to stay on track.
Creating an Audit Checklist
Many of our clients and students understand what to audit, but don’t know what questions to ask during an audit. It doesn’t have to be a lengthy process, but by spending some time to prepare an audit checklist will make for a smoother and timely audit. An audit checklist can be prepared by turning active verbs into things to check for, or reversing the statement made in a document and turning it into a question. For example:
‘Control shall be exercised by….’ becomes ‘Who exercises control?
‘Records must be kept….‘ becomes ‘Show me the records..?‘
‘All orders must be signed by…’ becomes ‘Who signs the orders..?‘
It is important that an auditor remains objective when conducting an internal audit. The best way to do this is by recording evidence as you go on your checklist, and making sure your questions are based on criteria. Whilst you may ask the above questions of the auditee, it is important to validate the answers. The easiest way to do this is by selecting a random sample or observe a task being conducted. It is important to remind your colleagues that you will believe what they say but have to observe evidence in order to validate your findings.
If you would like to see what a simple checklist could look like, you can download here from our resources page for free.
To learn more about how to conduct internal audits within your workplace, the two day management systems course will help you develop the skills to create audit checklists and the ability to perform an internal audit. To find out more or join our next course, click here.