The Internal audit schedule, covered partially in last week’s Toolsday is something with which many companies struggle. We’ve covered how the various standards state the requirement, and what is expected. And some other considerations such as should they be done by an outside party, how they can be used to help prepare for formal auditor credentials and what parts of the business should be included.

There are many styles and formats used in the wild to accomplish the task. Regardless of the format, the internal audit schedule will involve, primarily, some event occurring at some point in time.

The events will be related to the requirements against which we are auditing; expressed perhaps as locations or documents or processes or some combination of these.

The time can be expressed as any calendar date, in any granularity that is consistent with the culture of the company. If I’m asked which time-frame resolution is best, and not given any other considerations, I will always say quarterly. Some corporate cultures dictate the schedules be defined down to the day – whatever works.

And, while you’ll not find any specific requirement for the time period in which a “full cycle”, or in which the entire scope of registration is covered – the correct answer is “within a calendar year”.

Options to consider

Process-based

Typically, the best audit schedules are process-based. What is a process? The fairly common definition says it is something that has inputs and outputs.

ISO 9001 defines it as “set of interrelated or interacting activities which transforms inputs into outputs”.

Some processes are documented, some are not – the different standards each have requirements for what is to be formally documented and what is not needed to be.

The standard schedule looks pretty much like Figure 2.

Floor plan

This choice is an interesting one, and I like it. What it entails, simply, is to take a floor plan of the organization and section it off in slices of time. And this covers, in most implementations, about 80 percent of what needs to be covered – the rest earns an honorary position in the schedule (I will explain).

It is important to include all areas of the company; all buildings, including outbuildings and designated outdoor functional areas (storage, for example).

It is essentially a process-based audit, with a different way of illustrating it. So in this way, interrelated processes could easily be grouped together, especially if they are physically proximate.

This method makes it easy to see logistical inefficiencies as well, which is a nice bonus. While it makes sense to group Receiving, Incoming Inspection, and Stock Room, for example, if these blocks are scattered at the four corners of the map then a potential inefficiency becomes obvious.

Floor plan-based audits work best when there is a good balance between complexity and compartmentalization. If the processes are very complex, then they should be compartmentalized (there should be an inverse relationship between complexity and compartmentalization).

There are some areas, however, that need to be artificially, or “virtually” added to the Floor Plan schedule and these are processes which are not contained within a physical boundary. These would typically be support functions, such as preventive maintenance (in the case where there isn’t a dedicated department), or occasionally Information System support which is either performed by an outside provider, or through a corporate office. Improvement activities, such as continuous Improvement, Corrective Action, and Preventive action, as well as the Internal Audit function itself are also not typically located in a physical area. These are simply added to the schedule as a separate, virtual area.

Depending on the standard, other areas will need to be considered virtual as well.

How to ensure the full standard is covered in a Floor Plan-based Schedule

Once you’ve created your floor plan, take the standard; each clause and subclause, and make sure it has a counterpart on the layout. You should have to do this once, before you start using the system – and again each time the Internal Audit function is audited.

Document-based

What is meant by a document-based audit? Well, using the documents that have been created within the Management System as a basis for the audit. This would be distinct from using your ISO standard of choice (I’m going to leave that to third-party audits). Let’s discount this one out-of-hand.

Almost – baring two considerations. The first thing needed to do this is to include the Quality Manual as one of the documents used, with the caveat that the manual is of the sort that mirrors each requirement of the standard. I say this because some quality manuals are quite short (I know of one that is three pages long) – and as it stands now, ISO 9001:2015 won’t even require the use of a Quality Manual (though it will still be a convenient container for several sub-component requirements). Short manuals like mentioned above, are difficult to audit from without referencing the standard unless – here’s the second consideration, the management system has chosen to document every process. Not all standards require this (do any?), so this can be problematic.

If this is attempted then the schedule must include a provision to track the revisions of the documents over time, so nothing is missed (as I’ve shown in Figure 3).

Where this becomes problematic is when forms and other documents are involved. Should forms be included on the list? Or should there be an audit policy directing that whenever a document references another, then that document gets audited (and recorded) as well. It’s a bit of a logistical annoyance if you ask me. A document-based audit schedule is not my weapon of choice.

There is a hybrid of this and a process-based schedule that can work quite well, and that’s shown below (Figure 4).

 

Fig. 4

 Risk-based

Definitely something to consider as risk management, or at least risk consideration becomes a familiar part of every ISO Management System standard.

The details of how this is done, along with a few other tidbits – will be covered in the next installment.

Next Time – Risk Based Audit Schedules

See you next week! And thanks!

Until then – go forth, and calibrate thyself.

Sal