Internal audit procedure
SOP template
Check this template against your local regulations and your own policies before you use it.
| SOP no. | Version | Effective date | |||
|---|---|---|---|---|---|
| Owner | Approver | Review date |
Purpose
To check, on a planned schedule, that the business does what its policies and procedures say and what the rules require, and to find problems before a customer, an incident or a regulator does.
Scope
Every area, site and process covered by the business's policies, procedures and obligations register. External audits and inspections follow their own process; this procedure covers the ones the business runs itself.
Responsibilities
| Role | Responsibility |
|---|---|
| Audit coordinator (often the quality or compliance manager) | Writes the yearly audit plan, assigns auditors, keeps the reports and tracks actions to closure. |
| Auditor | Plans and runs the audit, gathers evidence, records findings fairly and writes the report. |
| Area manager | Makes people and records available, agrees the findings, and owns the corrective actions. |
| Owner or senior manager | Approves the audit plan, reviews results and makes sure actions get the time they need. |
Definitions
- Finding
- Something the auditor found, graded as a major or minor nonconformity, an observation, or good practice.
- Nonconformity
- Where what happens doesn't match the policy, procedure or rule. A major one is a breakdown or a risk of harm; a minor one is a one-off lapse.
What you need
- The yearly audit plan
- The internal audit checklist for the area
- The audit report template and the corrective action register
Procedure
Plan the year's audits
List the areas to audit and when, so each one is covered at least once a year. Audit higher-risk areas, and ones with recent incidents or complaints, more often.
Choose an independent auditor
Pick someone trained who doesn't work in the area or check their own work. A small business can swap auditors with another team or use an outside adviser.
Prepare the audit
Read the policies, procedures and past findings for the area, agree the date with its manager, and adapt the internal audit checklist.
Open the audit
Meet the area manager briefly to confirm the scope, the timetable and who the auditor will speak to.
Gather evidence
Watch the work, talk to the people doing it and check records against the procedure. Sample several records rather than one.
- Note what you saw, who you spoke to and which records you checked
- Record good practice as well as problems
Grade the findings
Decide whether each finding is a major or minor nonconformity, an observation or good practice, with the evidence that supports it.
Caution: Report what the evidence shows, not who was at fault. An audit that feels like blame stops people being open.
Close the audit
Go through the findings with the area manager, agree they're accurate, and agree who will own each action.
Write and send the report
Write it up with the audit report template within a week, and send it to the area manager and the owner.
Raise and follow up actions
Add each nonconformity to the corrective action register with an owner and due date, then check at the due date that it was done and worked.
Records
- The yearly audit plan, with the dates each audit was done.
- Completed audit checklists and notes.
- Audit reports, kept for as long as your retention rules say.
- Corrective actions raised from each audit, and how they were closed.
Related documents
- Internal audit checklist
- Audit report template
- Corrective and preventive action procedure
Revision history
| Version | Date | What changed | Approved by |
|---|---|---|---|
