Insight

Time to end the ritual of annual internal audits?

At QFactorial we spend what many would say is an unhealthy portion of our lives giving and receiving audits of many kinds. The best kind of audits are those that take place in a positive, constructive, value-adding mode, without sacrificing the imperative of independent challenge.

This is best achieved when audits are part of the fabric of business operations, providing regular, informed, relevant and timely input to decision-making. These audits can be characterised as conversations about improving the business. Luckily, many of our clients prefer this approach.

Sadly however we still come across situations where an internal audit takes place once a year, just before the annual external audit, effectively as a dress rehearsal to make sure all the boxes are ticked. Doing it this way is of course the cheapest method of maintaining compliance. But it also guarantees you get the least benefit from the audit process because:

The auditor knows you are box ticking and is not motivated to add value by digging deep and finding real issues.
Your team knows you are box ticking and treats the whole process as an exam to be passed and forgotten until next year.
You know you are box ticking and therefore driven to minimise disruption and hoping for zero audit findings.
Looking at your management systems and compliance obligations once a year means that you are not looking at them for the other 11 months. That’s a very clear indication of how much you really care about this stuff.
An auditor preparing for an annual audit is pretty much starting from scratch and will need to re-learn your organisation and systems and audit the entire standard/scheme in one go. Realistically, they will only have time for basic compliance checks, so value-adding conversations will be limited.
Any meaningful findings from the audit can (and often do) lie dormant for 11 months until the pre-audit panic is triggered again, and off we go round the merry-go-round.

There is a better way. You don’t have to go crazy and do an audit every week. But breaking the audit topics into bite-size chunks spread across the year makes a lot of sense:

It allows the internal auditor breathing space to prepare a focused audit, digging deeper to find issues and underlying causes before they escape and become problems.
It shows your team that you care about compliance and continual improvement throughout the year, so they are more likely to do the same. It’s the difference between culture and bureaucracy.
It allows you to direct the audits at current areas of risk/concern at the time when scrutiny is needed, not months after the event. You can control the audit programme and use it as a business tool.
It removes the aura of pre-audit panic associated with external audits. Whenever they show up, you know you are already on top of the situation.

If you are stuck in annual box-ticking mode and want to evolve into value-adding audit mode, give us a shout. Whatever the flavour – quality, sustainability, InfoSec, supply chain, etc – let’s discuss strategy, tactics and how to do audits in a better way.

If you are stuck in annual box-ticking mode and want to evolve into value-adding audit mode, give us a shout.