Don't be a slave to your audit schedule

This Photo by Unknown Author is licensed under CC BY-SA

D​id you find it difficult to keep up with your schedule for planned management system audits last year?

Are you auditing the same procedures time after time?

Is the number of findings decreasing each time you audit?

​If you answered yes to at least one of these questions, then it may be that you are a slave to your audit schedule and stuck in the compliance audit trap.

In Are you stuck in the compliance audit trap?, I explained when organisations continue to look in the same place month after month and year after year, they are being lulled into a false sense of security as the number of non-conformance findings reduce.

Your audit schedule is your guide to what processes and activities will be audited over the coming period, and it is generally set for 12 months. In Are you still compliance auditing? I discussed that it was important to schedule internal audits around the highest risk processes and activities. Despite this, many organisations use the same schedule year after year becoming a slave to their audit schedule.

​To stop being a slave and get out of the compliance audit trap, you need to conduct audits based on risk. In applying risk-based thinking to how you schedule audits, consider the following;

• Audit processes that  add value  to customers
• Audit broken processes that cause complaints and/or non-conformances
• Do not audit processes that are not broken, except where there is a statutory or regulatory requirement to do so
• Reduce audit frequency of processes where the number of significant findings is falling
• Increase audit frequency for processes where the number of significant findings is increasing
• Increase audit frequency for processes that are out of control
• Audit new processes

With your audit scheduled according to risk, you would expect to find a few critical processes audited very frequently (=high risk), many processes are audited much less often (=medium risk), while most processes are not planned to be audited at all (=low risk).
 
Avoid becoming a slave to your audit schedule – review what you need to audit and move the emphasis off compliance towards improvement, thereby adding more value to your organisation.