3.5 Internal Audits as an Improvement Technique

3.5 Internal Audits as an Improvement Technique

Where the CQIA Body of Knowledge places a topic tells you how it will be tested. Internal audits appear as entry III.B.5, inside Improvement Techniques, alongside brainstorming, PDCA, affinity diagrams, and cost of poor quality. ASQ is signalling that the audit is not primarily a compliance ritual — it is a structured method for discovering improvement opportunities. Expect scenario items that ask what an auditor should do, not items that ask you to recite clause numbers.

---

1. The Three Audit Parties

Candidates lose points by confusing these three, and the distinction is purely about who performs the audit relative to whom is audited.

Internal audit is first-party. A supplier audit you conduct at your vendor's plant is second-party. A registrar's surveillance visit is third-party. Only the first of these belongs to BoK entry III.B.5.

---

2. Audit Classification by Subject

Independently of the party, audits are classified by what they examine:

• System audit — evaluates the whole management system against a standard such as ISO 9001. Broadest scope.
• Process audit — evaluates one process against its defined method: are the inputs, controls, settings, and outputs as specified?
• Product audit — evaluates a finished item against its specification, effectively re-inspecting a product already accepted.

Scope narrows from system to process to product; sampling depth increases in the same direction.

---

3. What ISO 9001:2015 Clause 9.2 Requires

Clause 9.2 is short and testable. Internal audits must be conducted at planned intervals to determine whether the management system conforms both to the organization's own requirements and to the standard, and whether it is effectively implemented and maintained. The organization must:

• Plan, establish, implement and maintain an audit programme, including frequency, methods, responsibilities, planning requirements, and reporting — and the programme must take into account the importance of the processes concerned, changes affecting the organization, and the results of previous audits. Risk drives audit frequency; a troubled process is audited more often than a stable one.
• Define the audit criteria and scope for each audit.
• Select auditors and conduct audits so as to ensure objectivity and the impartiality of the audit process. This is the source of the rule that auditors must not audit their own work.
• Ensure results are reported to relevant management.
• Take appropriate correction and corrective action without undue delay.
• Retain documented information as evidence of the programme's implementation and the audit results.

ISO 19011 provides the guidance on how to actually audit management systems — auditor competence, the audit process, and programme management. ISO 9001 says audits must happen; ISO 19011 describes how to do them well.

---

4. The Audit Lifecycle

PROGRAMME PLANNING  ->  AUDIT PLAN  ->  OPENING MEETING  ->  EVIDENCE GATHERING
       ^                                                              |
       |                                                              v
   FOLLOW-UP / VERIFY  <-  CORRECTIVE ACTION  <-  REPORT  <-  CLOSING MEETING

1. Programme planning. Set the annual schedule using process importance, change, and prior results.
2. Audit plan and preparation. Define scope, criteria, and dates; assign an independent audit team; build the checklist from the actual requirements.
3. Opening meeting. Confirm scope, schedule, method, and how findings will be communicated.
4. Evidence gathering. Interview, observe the work, and examine records. Follow the process approach: trace a real transaction end to end rather than reading procedures in a conference room.
5. Closing meeting. Present findings to the auditee so there are no surprises in the report.
6. Report. Document each finding with the requirement, the evidence, and the nonconformity statement.
7. Corrective action. The auditee analyzes root cause and determines the action. The auditor does not.
8. Follow-up and closure. The audit closes only when the auditor verifies the action was implemented and effective.

---

5. What Makes a Finding Legitimate

Every audit finding rests on three legs. Remove any one and it is an opinion, not a finding.

Objective evidence must be verifiable — records, observed conditions, statements confirmable from more than one source. "Several operators seemed unfamiliar with the procedure" is not objective evidence; "three of four operators interviewed could not locate the current revision of WI-204" is.

Grading Findings

The Independence Rule and the Small-Organization Problem

Auditors must not audit their own work. In a small company where the quality manager wrote every procedure, this is genuinely hard. Accepted solutions are cross-functional auditing — a trained production supervisor audits purchasing and vice versa — or engaging an external contract auditor. What is not acceptable is having the process owner audit their own process and declaring it independent.

---

6. Why This Is an Improvement Technique

An audit programme that produces only pass/fail conformity verdicts is being underused. Its improvement value comes from the data it generates:

• Pareto the findings by clause and by process to see where the system is systematically weak.
• Track repeat findings. A nonconformity that recurs after a closed corrective action proves the root cause analysis was wrong — usually a containment action mistaken for a corrective action.
• Feed audit results into management review. ISO 9001 requires it, and it converts audit output into resourced action.
• Harvest the OFIs. Auditors see every process in the organization and are uniquely positioned to spot practices that one area does well and others could adopt.