Are you stuck in the compliance audit trap?

This Photo by Unknown Author is licensed under CC BY-NC-ND

​You conduct regular internal audits to make sure that everyone is following procedures that keep people safe and products working correctly. These internal audits are necessary to

• comply with your own policies,
• demonstrate that you are acting responsibly, and
• meeting the requirements of the internationally recognised ISO management system standards.

While everything may appear to be fine, you can be stuck in the compliance audit trap without even being aware of it.

Auditors use standardised checklists when conducting internal audits so you can track outcomes over time. By including very specific questions on the checklist, you standardise the audit and make it possible for your most junior people to be able to conduct audits. This keeps costs to a minimum.

​By using the same checklist every time you audit, you can compare the outcome this time with the last. You observe that the number of non-conformances being found has decreased. This decrease of non-conformances would appear to represent an improvement. However, despite this improvement from compliance audits, other measures and indicators may provide conflicting information that the process being audited is not improving at all. This is what we call the compliance audit trap. ​

The compliance audit trap is where organisations continue to look in the same place month after month and year after year being lulled into a false sense of security as the number of non-conformance findings reduce. This is what we discovered happening back in the 1990’s. In Compliance Mindset Only Leads to Mediocrity, I cover what went wrong with the internal audit programmes in many companies that were early adopters of ISO 9001 certifications.

Internal auditing has progressed over the 25 years since. We know that compliance auditing is a trap that leads to mediocrity. We also know that excellence in auditing today involves three key areas. The first is to ensure compliance which is what all organisations have traditionally done. The second area is to mitigate risk, while the third is to drive continual improvement efforts. It is these last two areas that I find most organisations fail to take advantage of. Yet they can be so much better if they use all three areas in planning and conducting their internal audits.
 
How to avoid the compliance audit trap?

To maximise the value from your audit programme and avoid the compliance audit trap, there are three actions you need to take;

1. Expand your audit programme to include mitigating risk and driving improvement. This will ensure you continue to maximise the return on investment from your internal audits, even as the number of non-conformances you find falls, justifying the amount of resource going in to conduct these audits.
2. Schedule audits based on risk. Replace your time-based audit schedule with one where the few highest risk processes are audited more frequently than medium risk processes.  Discontinue auditing processes that are not broken.
3. Train internal auditors to maximise value. Auditors need to be upskilled in the internal audit process, and how they mitigate risk and drive improvement as part of internal audits. 

 
For more on how you can get more value from your audit programme, you can watch a replay of the Auditing for Excellence webinar.