Internal Auditing
Original article by Integrated Compliance Solutions.
Conducting an Internal Audit? Avoid These 6 Common Mistakes.
While internal audits may not appear too difficult at first glance, if an auditor is inexperienced or unqualified, it can be easy to overlook key non-conformances and miss out on the significant return on investment of well-designed internal audits.
If you’re not following the appropriate steps for completing a thorough, unbiased internal audit, this can unnecessarily waste time, money and resources on a non-value-adding process. You may also risk making costly oversights, which will need to be revisited and amended, setting you back in reaching your business’ compliance goals.
This considered, rather than conducting internal audits themselves, organisations often outsource assistance from an experienced consultant. Helping you every step of the way, a consultant provides you with a new perspective and impartial advice, while also making sure you avoid the mistakes organisations commonly make along the way.
Overview of Internal Audits
Internal audits assess an organisation’s overall business practices, including its quality and risk management systems, against the requirements of one or more standards. The internal audit process allows companies to evaluate how efficient and compliant their existing processes are, highlighting any shortcomings and making realistic, practical action plans that support continual improvement.
When it comes to achieving and maintaining certification, conducting regular internal audits is a key requirement. While this may seem like a hassle, this expectation has been established for a good reason, in that it encourages organisations to constantly monitor, review and refine their systems. After analysing relevant information, organisations can see their progress towards compliance goals, helping them pinpoint areas that need to be strengthened.
While a checklist can provide companies with guidance, this standardised approach often does not take into account a business’ unique vision, strategy and requirements or changing circumstances and is often strongly focussed on compliance and not busines improvement. If this is an option you are considering, it’s important to take such criteria into account, tailoring the checklist to your specific circumstances and reviewing its effectiveness regularly.
Alternatively, on average, one in three corporate internal audit departments across the globe are now opting to outsource at least some of this process, gaining advice and/or guidance from a consultant. This means they can conduct a thorough, objective internal audit that is fully documented, confidential and time efficient.
Common Mistakes Organisations Make
The internal auditing process is not often as straightforward as it seems, and it is not uncommon for organisations to make costly mistakes along the way. However, with the appropriate planning, guidance and value-driven approach, your business can minimise drawbacks, eliminate avoidable costs, benchmark your processes and get certified sooner.
Focusing Purely on Ticking Boxes: While organisations may be tempted to get their internal audit out of the way as soon as possible, cutting corners where they can, doing the bare minimum and hoping for the best can be both risky and ineffective. Focusing purely on ticking boxes might do the job now but, often, organisations find themselves achieving outcomes that simply are not sustainable. Rather, to get the most out of their internal audit, companies need to recognise the value in developing maintainable, responsive integrated management systems that improve efficiencies across their operations.
If organisations see internal audits as just another annoyance to get out of the way, rushing staff through the process, they’ll likely struggle to cultivate a culture of continual improvement and operational excellence – which is crucial in becoming certified or maintaining certification. When future external audits come around, they’ll also likely need to put in far more work to meet the minimum requirements again, as they may not have set a strong and flexible foundation.Poor Planning: For the internal auditing process to be optimised and effective, managers and supervisors need to be coordinated and unified in their efforts.
There are many audit paths that need to be pursued, so if management and supervisors aren’t working well cooperatively, it’s easy for efforts to become disjointed and for those auditing to miss key areas.
In overcoming this, organisations need to ensure they establish clear, shared direction that are well understood by all of those involved before starting to audit processes and address nonconformities.
With a detailed, realistic action plan, management can make sure the chosen approach is coordinated and collaborative, keeping everyone both on track and on the same page every step of the way.Lack of Objectivity: Conducting an objective and unbiased internal audit can be challenging and, often, this becomes more difficult if internal employees are completing the audit. In such instances, an employee’s pre-established understanding of the business’ processes and people can come into play, influencing what they report on or overlook – whether this is intentional or not.
If issues are disregarded and left to foster, they will catch up to you eventually, whether that’s in an external audit or the like – which will only set your business back in reaching compliance goals and deadlines.
Thus, organisations need to keep effective communication central in everything they do, making sure that auditors and auditees are encouraged to be honest and impartial and ensuring there is a focus on systems rather than the individual when pointing out issues. When completing audits, businesses also need to strike a balance between ensuring key points aren’t skimmed over or critiques diluted and avoiding conflict with process owners.
This is where outsourcing auditing often becomes all the more valuable and preferable for organisations. An auditor from outside the business likely has no ties with biases towards or alliances with company staff, meaning they can provide an impartial, fresh perspective on systems. After being reviewed by an outside source, processes and procedures that are widely accepted as the norm in an organisation may be found to have glaring non-conformances.Unqualified Auditors: While it may be tempting to cut corners and save costs by getting an unqualified individual to conduct your business’ internal audit, you risk wasting precious time, money and resources.
Without the appropriate experience and qualifications, an individual may lead your business down an entirely unnecessary path, where you end up focusing on areas that do not require attention or overlooking key areas of non-conformance. This can drag out the certification process, leaving staff tied up in redundant bureaucracy and paperwork.
Providing staff with sufficient, regular training is one option for minimising risk, supporting continual improvement and increasing the overall reliability of your auditing efforts.
An alternative is to enlist the help of a qualified internal auditing professional to conduct some or all of your business’ audits. This way, you can be confident that it is a reliable investment for your business.Poor Communication: During any stage of the internal auditing process, poor communication can hinder the overall effectiveness of your efforts.
If management communicates poorly with staff, this often becomes all the more obvious when performance isn’t up to the expected standard. In such instances, it is important that those involved take ownership of issues and avoid displaying outward suspicion, transferring blame or using an accusatory tone when speaking with employees.
If an organisation does not build strong communication channels and standards, they risk ending up with biased reports that overlook or underplay key points. This undermines the purpose of reporting in the first place, as the results will not provide an accurate representation of the business’ existing systems, making continual improvement all the more difficult.
The resulting auditing report also needs to be written in a way that is not only informative, detailing all of the important takeaways, but also clear, constructive and user-friendly. This means avoiding the use of a destructive and negative tone, while also ensuring it does not include information that is outdated, misleading or factually incorrect.
With clear, conscious communication during every stage of the internal auditing process, organisations can encourage and motivate their staff while also collecting more valuable and accurate insights from their efforts.Lack of Continuity: Internal audits are required to be completed regularly, as this helps organisations ensure that they are regularly looking for opportunities to improve the quality and effectiveness of their management systems. This means businesses can identify and start working to address any non-conformances or downfalls quickly, making continued compliance less of a burden than if such issues were left to foster and accumulate over months or years.
Organisations can fall into the trap of treating certification as something they can ‘set and forget’ – but this just makes continued compliance all the more difficult and there is a mad rush prior to the external audit to ‘tick the right boxes’.
Maintaining certification relies on businesses viewing compliance as an ongoing process. As such, even once they have reached their goals, organisations that get and stay certified do not become complacent and, rather, remain committed to constantly improving their systems, whether this means:
Regularly monitoring and reviewing the performance of systems
Providing additional training and education to employees
Communicating regularly and clearly with employees across all organisational levels to ensure they understand their role in achieving continued compliance
By frequently auditing processes, over time, organisations can foster a strong corporate culture of continual improvement, making ongoing compliance less of a burden.
