Internal audit procedure
Internal audit is the control that checks the other controls, so when it becomes a paperwork exercise nothing else can be trusted either. The two failures that matter are auditors reviewing their own work and findings raised without evidence, and both are easy to design out.
- 1
Quality Manager prepares an annual audit programme covering every area, weighted by risk and by past findings.
Quality Manager
Timing: Annually, before the year starts
Risk-weighted, not evenly spread. Auditing the well-run area as often as the troubled one wastes the programme's capacity.
- 2
Quality Manager assigns a Lead Auditor who is independent of the area being audited.
Quality Manager
Independence is the point. Someone auditing their own area will not find what they have stopped noticing, however honest they are.
Independent auditor available: go to step 3
No independent auditor: go to step 11
- 3
Lead Auditor confirms the scope, the criteria being audited against, and the date with the Auditee in advance.
Lead Auditor
Named criteria, not "a general audit". An audit with no stated criteria produces opinions rather than findings.
- 4
Lead Auditor reviews the documented procedure for the area before observing anything.
Lead Auditor
Read first, so you are comparing practice against the document rather than against your own assumptions about how it should work.
- 5
Lead Auditor observes the process being performed and interviews the people who perform it.
Lead Auditor
Observe the work, do not only read records. Records show what was written down; observation shows what happens.
- 6
Lead Auditor collects objective evidence for anything they intend to raise: a record, a photograph, a specific instance with a date.
Lead Auditor
Evidence, not impression. A finding without evidence will be argued away, and rightly so.
- 7
Lead Auditor classifies each finding as a major nonconformity, a minor nonconformity, or an opportunity for improvement.
Lead Auditor
Minor or improvement: go to step 8
Major nonconformity: go to step 10
- 8
Lead Auditor presents findings to the Auditee at a closing meeting, confirming each is factually correct before it is recorded.
Lead Auditor
Confirm the facts, not the conclusion. A finding the auditee disputes on facts is usually the auditor having misunderstood the process.
- 9
Auditee agrees a corrective action and a date for each nonconformity, and owns it.
Auditee
The auditee owns the action, not the auditor. An action owned by the person who found it never gets done.
Actions agreed: go to step 12
- 10
Lead Auditor notifies the Quality Manager immediately of any major nonconformity rather than waiting for the report.
Lead Auditor
Major means something is materially wrong now. Holding it until a report is circulated next week wastes the time that matters.
Escalated: go to step 8
- 11
Quality Manager arranges an external or cross-site auditor for that area, or documents why independence cannot be achieved and what compensates for it.
Quality Manager
In a small organisation full independence is sometimes impossible. Say so in writing and state the compensating control; do not quietly ignore it.
Resolved: go to step 3
- 12
Quality Manager verifies each corrective action was completed and was effective, and closes the finding only then.
Quality Manager
Timing: After the agreed action date
Closed on evidence of effectiveness, not on the action being marked done. A finding closed on a promise reappears at the next audit.
Effective, closed: the procedure ends
Not effective: go to step 9
Change these before you use it
- Define your major and minor nonconformity criteria concretely. Left to judgment, everything becomes minor.
- Set who can audit which areas, given your size, and record the compensating control where independence is genuinely impossible.
- Name the standard or criteria you audit against, and reference the specific clauses if you are certified.
- Set the verification interval in step 12 long enough that recurrence would actually have had a chance to happen.
- This is a starting point, not certification advice. Have it reviewed by whoever is accountable for your management system.
This is a starting point, not compliance advice. It is written to be adapted, and a procedure that touches access, money, or customer data needs to match how your business actually operates and whatever rules apply to you. Use it as a first draft to edit, not a policy to adopt.
Make it yours in a couple of minutes
Rather than retyping this and editing it, describe your own version of the process out loud or click through it once, and get a first draft with your actual steps, roles, and systems in it. No account needed to see the result.
No account neededNo credit cardSee the whole SOP before you sign up