What an auditor looks at
An experienced auditor does not count documents, they follow a chain: does the commitment in the policy have a counterpart in an objective, is the objective run by a process, does the process leave records, did a deviation in the records turn into an action, was that action's effectiveness verified.
When preparation starts
At the previous internal audit. An organisation that takes internal audit seriously does not prepare for the external one — it is already prepared. An organisation arriving with zero-finding internal audit reports usually gives itself away in the first hour.
Stages
- Document review: does the written system meet the standard's requirements.
- Site audit: is what is written actually done on site.
- Surveillance audits: repeated at intervals after certification — the system does not end with the certificate.
Three things to avoid
- Back-dating records. Dates that do not add up are the first thing an auditor notices, and they undermine confidence in everything else.
- Coaching workers on answers. Auditors ask people what they do; the gap between a rehearsed answer and real practice shows immediately.
- Hiding a finding. Presenting an open finding with a plan to close it is always better than having a hidden one discovered.
If a finding is raised
A finding does not mean the system has collapsed. What is expected is a corrective action plan that reaches the root cause and closes on the date promised.