Ross Woods, 3rd ed, 2021
This book is for first-time lead auditors. It presumes that you have done an orientation to quality auditing and, preferably, also done an audit as audit team member.
As a lead auditor, you will have general oversight of all aspects of the audit, involving the following:
Familiarize yourself with your own organization's requirements. It will probably have its own policy, procedure and protocols on how to conduct all stages of the audit.
You are appointed to be in charge of the audit (lead auditor) to lead an audit of an institution of some kind.
You will be given a brief. These vary from the highly specific to the fairly general. An internal audit brief most likely comes either from the Board, your organization's Chief Audit Officer, or perhaps the CEO.
Sometimes the client is not the auditee. For example, Joseph Bloggs wants to buy XYZ Corp. One of the conditions of sale is an independent audit. Bloggs is the client who will get the report, but he is not the auditee. If the client is not the auditee, some standards specify that it is the client's responsibility to provide the auditee's management with a copy.
Agreement.The auditee agreed to the audit. If the client is not the auditee, you will need written agreement from the auditee. If it is a big audit, it should be in writing before you go too far, otherwise you can get it later at the entry meeting.
Authority. You are given written authority to conduct the audit. This could be a letter or other kind of written authorization. For internal auditors, it could be a Board minute, an audit committee minute, or a letter.
Scope. The authorization will specify the scope of the audit, that is, the extent of activities to be audited. Scope may be defined by location, compliance standards, or particular programs. Some scope definitions have some kind of rider allowing the auditor to follow up anything they find during the audit that appears out of order, even if it is outside the particular standard.
Boundaries of scope. The scope statement might also specify boundaries. For example:
Purpose.The purpose of the audit is to establish compliance or otherwise with a relevant standard (or standards). It may be:
In education, the purpose will most likely be specified as compliance with a quality framework, relevant legislation, and the organization's own policies and procedures. It may also mention any other compliance documents.
It might also require you to either find an existing standard or develop a new standard to address audit purposes. (See above in the section on audit standards.)
Get a general idea of the organization you are going to audit so you can plan for it better.
If possible, check the results of previous audits. This will highlight any higher risks, and give you a better idea how the entity works. Ask if there are any outstanding issues from previous audits. For example, you may be doing the audit to check whether serious non-compliances have been rectified. There may be recommendations that you should read.
Identify the stakeholders. The stakeholders in an audit are anybody involved in the entity that is being audited according to the audit scope.
Relevant people inside the organization usually include:
Outside your organization, they can be:
Check the kind of data. If it is mainly computer data, you must have sufficient computer skills to navigate the software, although you may (and probably should) ask the auditee for help. You are not expected to be familiar with their software, especially as many organizations use bespoke software or make bespoke modifications. It is unreasonable of an auditor to ask the auditee to print off computer data only so that you can read it on hard copy.
Choose a standard (or standards). You might choose from many different kinds of relevant standards, for example:
Read through the standards and evidence guidelines very carefully. Ask about anything you don’t understand. You will be expected to have a good working knowledge of the standard that you are using and be able to guide your team, and to make reliable judgments on compliance with it. If there are evidence guides, or any statements interpreting the standards, then you should thoroughly familiarize yourself with them.
In an ideal situation, you would go through the entire standard and discuss it sentence by sentence as a group, examining the examples of evidence and looking at possible interpretations. This might be very time-consuming but will probably produce the best results. In any case, you will need to have a very sound understanding of them before you start auditing.
You need to see the relationships between different parts of the standard. The tricks and traps are the relationships between similar items in different parts of the document. For example:
In a franchise or licensing arrangement, just because the center has done it right doesn’t mean that their partner organizations do it equally well. Having satisfactory policies and procedures does not ensure that they are uniformly well implemented. For example, the central college might provide all the information that should be provided to applicants. Partners, however, could easily bypass some information and fail to refer prospective students to the website.
If you can't find a suitable standard of any kind, you might have to write a new one. Before you start, check what requirements it must meet.
You then have two options. The first option is to simply be able to adapt an existing standard by editing it in a word processor. Keep notes of the principles you use to change it and put them in a preface. If you do it well, the new standard will comply with the original, and further validation will be quite easy.
The second option is to write a new one from scratch. This might not be difficult if you can be fair on all stakeholders, cover all normal eventualities, and write in clear, plain English.
The hard work is in getting all stakeholders to agree on it. If you have very few stakeholders and will only use it once for a specific purpose, it might not be too difficult. But your task could be quite difficult if:
Some kinds of internal audits and some audit standards encourage a general assessment of business risk before the audit.
You can make a preliminary evaluation during planning in order to better plan the audit. These may be based on off-site consultations or reviews of relevant organizational documentation, information and data.
During the audit you need to notice risk factors rising and falling. An auditee might be much better or worse than it looked at first site.
Identify and record the risks. If you think it's a real risk that affects what the entity does, you need to put it in writing. Existing lists of risks will probably be helpful, but do not blindly follow them. You need to identify risk factors s for each case.
Generally speaking, an audit is lower risk if:
Consider the size of the organization. Being large or small does not determine compliance levels, but it does suggest that you might audit them in different ways.
Some small organizations have weak systems and improvise a great deal. If the auditee is a large organization operating over a number of sites or in a range of activities, you normally need to consider the risk for each site or kind of activity. If an organization has operations in a range of sizes, an auditor would target the larger ones, and consider only a sample of the smaller activities, all other factors equal.
Consider these factors:
This gives a result as follows
You need to put a strategy in place for anything that gives a result of nine or above.
Your risk analysis will be based on the above, and may include:
Most audits use simple methods, such as interviews, observing activities, examining internal documentation and records (for example, meeting minutes, reports, or log books) and examining of reports from external sources, e.g. external laboratory reports and vendor ratings.
Alternative methods may also involve discussion groups, surveys, alternative information, and data. Some kinds of audits use sampling techniques. In most cases, a rule of thumb is quite sufficient, but if you are sampling sizable amounts of data, you will need to get mathematical data on the size of a representative sample.
A few audits also require laboratory testing and skills assessments of staff. These are naturally more complex, and may depend on specialist subject matter expertise. There are many possible methods and you may combine them. Assessment methods may include:
In any case, the principal of validity still applies: the way you assess something must be a good fit for what is assessed.
Prepare your audit plan. It must be written down, even if it follows a set approach. It must also be flexible enough to allow necessary changes of emphasis, and allow individuals to be identified when they have significant responsibilities.
Your plan usually needs to specify:
Note: If client and auditee are separate entities the plan for report distribution should protect the interests of both.
The audit plan may also address:
The audit plan form in this website will be appropriate for all normal audits. But you might need to write a separate planning document, and get it approved by your supervisor or stakeholders.
Audits have simple schedules if they are all on one site, involve small numbers of people, and have priority over other activities.
After that, it can be quite difficult. Get it in writing and have all stakeholders check it. Include places, time, meetings with individuals, equipment, etc.
Some audits have complex budgets if they:
You might need financial resources, such as budget allocations, travelling/subsistence allowances, and motor vehicle hire.
You might also need physical resources, such as motor vehicles, measuring equipment, photographic equipment, computer equipment, office location, personal protective equipment, telephone equipment, stationery, documentation (e.g. standards), electronic recording, and office communication equipment.
What if things don't go as planned? You might blow the budget. Then what? What if a car breaks down?
If an auditee objects to something you want to do as auditor, it is usually because they are nervous and defensive; they are not necessarily hiding a non-compliance. It is first of all a matter of conflict resolution, and a calming deflection might work wonders.
If the auditee continues to object, simply mark it as non-compliance due to lack of evidence. This is unlikely, as the negative result is not in their interests.
You will need forms and questionnaires to work with.
Audit tools are instruments for collecting evidence and conducting the analysis and evaluation. They are not the same as the audit criteria or benchmark.
They may be developed specifically for the purpose, adapted from existing tools, or already existing commercial products. They will include performance checklists, sets of interview questions, descriptions of required characteristics to be checked. You will also need working papers, records, a way to document the auditee's systems, ways to control for errors (e.g. potential error matrix) and audit reporting.
It is good practice to have a five-column checklist on a landscape layout. The five columns are:
Check:
The head auditor should contact the auditee and set up the audit. Give them the agreed period of notice and inform them of any conditions applied.
Your list. Make a list of all the documents will you need so you don’t forget anything. These will include current checklists and questionnaires, entry meeting agendas and forms, and authorizations, You might also need briefing documents for your audit team members or for auditees.
Who? The audit team will liaise with a key person, whose title will probably be administrator or manager. The key person should be able to give you priority with no interruptions from phone calls, other responsibilities, or appointments. Ask whether other staff will be available.
Where? If you have never been there, make sure you know exactly how to get there. Finding an address might not be enough; you might need to know where in the building it is. Where can you park your car? What is the probablility of traffic delays?
When? Set a date and a start time. Give them time to organize their information and check that other personnel will be available.
How long? Set an end date, but consider the possibility that a full audit can take longer that planned if you find that evidence is insufficient or there are other sites to visit.
What? Explain what will be audited and make sure that the auditee knows how to be audited. Ask whether you will be able to observe the organization’s activities. For example, if you are auditing an educational institution, you might ask whether classes will be held during that time and whether you could observe them.
What on-site resources might you need? Usually you'll just need to borrow a desk, but you might also need an interview room, a meeting venue, and perhaps even materials, stationery, or equipment.
What is the auditee responsible for? The auditee is responsible to:
The audits begins with an opening meeting with senior auditee management, called an entry meeting. Organize the entry meeting in advance at a mutually agreed time
As a formal meeting, the entry meeting should:
Keep a signed written record of any decisions made.
It is also highly advisable to ask whether they have done an internal audit or some other kind of compliance check. If they have, it means that they have already done lot of work interpreting the standards for their situation and locating evidence. Ask for a copy and it will simplify the audit greatly. You might only need to go through it in detail and check that it is correct.
The audit process (with the forms and meetings in this website) gives you a communication strategy that is adequate for almost all smaller organizations. However, in a much larger audit, you may also need to put a more comprehensive communication strategy in place. It might include:
Besides being transparent about what the team will do, all members of the audit team need to establish rapport so that people feel that you are working together with them. Listing your experience or credentials might make you sound pompous, and a friendly, collaborative attitude will normally get you further.
You will need to communicate effectively with a range of different people in the organization. You may have to navigate cultural issues that affect communication. Getting people on side is a large part of the auditing. This includes:
This is basically doing what you have planned. You will mostly be interviewing, checking documents, and observing. In a few cases, however, you might conduct tests, e.g. control systems, staff competence.
Document everything during the audit. Use forms and checklists to record all observations and evidence, and relate them to standards.
Stay alert to evidence relevant to audit results. Auditees often don't know what is relevant and may be more compliant (or non-compliant) than they think.
As a member of an audit team, you have the authority to interview various people in the auditee organization and observe what they do. In an educational institutition, you should try to observe some classes if you can.
Do interviews in private because the answers may be different if others are present. While you're at it, you should if possible, discuss the auditee's self-assessment checklist. Interview people at different levels, e.g. management, administration and workfloor. Substantiate your observations and verify information by independently getting the same information from other sources.
Lead questions give you a good overall picture of what is happening, so you can locate the aspects you need to concentrate on and treat them fairly in context. Done well, they also help put the auditee at ease.
Here are some ideas for starters:
Do people understand what to do and do it correctly?
Get candid appraisals, for example:
Interviewees often suggest improvements to auditors that their supervisors have never heard. You cannot presume that supervisors have actively listened for ways to improve. Besides, staff are often reluctant to suggest changes for fear that it will be interpreted as personal criticism.
Look at the auditee's documentation:
For other possible kinds of documents, see the Appendix.
Look for corroborating evidence and follow up potential problems. People write all sorts of things on bits of paper hoping that auditors will believe them. And people spin all sorts of tales. You don’t have to accept anything at face value.
Look for documentary evidence wherever possible. Ask different people questions independently about what actually happens. Take note of aberrations—things that don’t fit the pattern or potentially do not comply with policy. Ask why.
Actively explore anything that you suspect to be non-compliant. (As auditor, you have the authority to do so.) Identify any risk factors and check anything suspicious. Follow up clues on apparent noncompliance to standards, even if they are not on checklists. Remain alert to evidence that requires more auditing. Do not just passively accept whatever people show you, but avoid unfairly going on a witch hunt.
Explore evidence until you can draw conclusions based on a range of evidence over a period of time.
As you go, interpret evidence. You’ll often be asking questions like:
Evaluate the evidence and make a decision of compliant or non-compliant and record it as planned. If you find non-compliances, your responsibility is simply to identify them clearly. If the scope permits, you may suggest improvements.
When interpreting criteria, good auditors can differentiate between three things that can all look like non-compliances:
inadequatetrap
Many standards require that something be adequate
or sufficient.
Judgements based on these requirements depend on criteria for determining how much or how many is enough. (In some cases, the standard against which you audit will give a standard, but not always.)
Consequently, any judgement of inadequate
or insufficient
needs an expicit criteria, which you should put in your report, probably with an explanation of your reasons for your conclusions. Without it, your conclusions are no more than personal opinions.
See what needs to be investigated further. If you suspect a noncompliance or a risk during the audit, you have a right and duty to investigate it more thoroughly, even if it is not on your checklist. In general, this means gathering more evidence. This may be by:
The lead auditor can make changes to the audit while the audit is in process, with the written agreement of other parties. If the audit goals appear to be unattainable, the lead auditor should tell the client and the auditee as soon as possible.
Not many people like being audited. Most are nervous and can easily become defensive if they fear a negative result.
The worst case scenario in an audit is that a small miscommunication creates antagonism that snowballs and becomes too complex to sort out. If it degenerates further the audit might easily fail. Both the auditor and auditee become defensive and dig in on their positions, and the auditee might then clam up completely.
It leaves each side blaming the other. The auditor must give the auditee non-compliant on everything, as the auditee did not provide evidence of compliance. The auditee will complain that the auditor's attitude subverted the audit. The formal report might then contain mistakes and apparent dishonesty.
If you are an audit team leader, it is your role to efficiently resolve any problems arising with auditee and relevant parties. You don’t have the option of giving up the right to make the judgment of compliant/non-compliant.
What you can do:
If still in doubt in more serious cases, you might need to get a determination in writing. However, this will usually take too long for the audit and your audit report would probably advise that the matter should be reviewed, and give the reason for the ambiguity.
In the end, it is your call, and you will need to be able to prove that you are correct.
If necessary, an auditor can make changes during an audit while the audit is in process with the agreement of other parties.
If the audit goals appear to be unattainable, tell your supervisor and the auditee:
Prepare to give an oral report, with a written report to come later. Immediate feedback is most beneficial to the auditee. The longer they wait, the less they take notice of it. Unfortunately, this is not practical in a complex audit where you need considerable time to write and mull it over, or where considerable traveling is involved for another visit.
You might feel that you have very little to say in the exit meeting if you have been working closely with key people throughout the audit and communicating with them. But you must still hold the exit meeting to make sure that they understand your findings.
Think carefully about how you will tell people the compliance situation, any non-compliances, and possible improvements.
Note: Some auditing standards require you to have already written the audit report for the exit meeting. In these cases, audit closing meetings are normally held within an agreed period after the client has viewed the written report.
Close the audit with a meeting to explain clearly the audit results. It should be documented. (See the model form.) Examine results and findings against audit objectives and present them to the auditee. Make sure that they understand the report. This normally means that you give them an opportunity to ask questions.
Get agreement on the arrangements for providing the written report.
Give them feedback. Tell them what they are doing excellently. Almost every organization does at least something very well. Suggest improvements where applicable, and explain and discuss the consequences of the audit outcome. Negotiate any follow-up process with client/auditee. Decide on any actions to correct non- compliances and get agreement on timelines for their completion.
Refer the matter to your supervisor if your audit decisions could be disputed, or if you fail to negotiate agreements about non-compliances and corrective actions.
Draft your written report. This is fairly easy if you have taken good notes as you go; even easier if you have used a well-designed form.
Put "Strictly Confidential" and the date on the front page, and list yourself as author. (You must take responsibility for your work.)
The report of audit results must be:
Otherwise, the report contents may vary according to the situation and the audit standards you are following. The report should contain:
Give the report some time to settle (at least overnight). As you reflect on it, you may realize that you have been too harsh or too lenient on some points.
You will need to make final recommendations on actions to be taken. If you are unsure for any reason, ask colleagues for their advice before you make anything final.
Then edit it to its final form.
At about this stage, you will need to record audit findings in your organization's information management system. (Usually that means giving the right person a copy for filing.) You might also have to lodge an internal report.
If you haven't done the exit meeting yet, you’re now ready for it. If you have already done it, then send the written report to the auditee and/or client.
The audit is completed on submission of the audit report and the closing meeting. The auditee is responsible for any corrective actions necessary.
Some kinds of quality audits end when the report is handed over and the exit meeting is done. The auditor is no longer responsible for what the auditee does. Some audit standards, however, require auditors to follow up on corrective actions. (A few audit standards blend the two. The auditor can hold the exit meeting and give the auditee a limited time period to submit further evidence before the report is finalized. This is fair as it takes the "sudden death" element out of the audit.)
Follow-up is usually a meeting with the client on agreed date after the auditee has had long enough to implement corrective actions. Other kinds of follow-up are:
It is good practice to do a review after each audit.
Your supervisor or a colleague will independently get feedback from the auditee. If you must do it yourself, it should be either anonymous or processed by a third party. Questions will most likely be something like this:
Then review your audit:
Some of the lessons learned will be personal ones for audit team members, such as how to put auditees at ease, use better questions, and resolve conflicts. You may also have a better idea of how different personalities function in an audit environment, and what they are good at and not so good at.
Other revisions will be more institutional, such as:
Other kinds of documents that may be audited:
"Handbook for Quality Audits of Organisations and Processes_, Ross Woods, January 2008 ©Ross Woods.
Complies with AS 3911.1-1992; NZS 10011.1-1992; ISO 10011.1-1:1990 published as Guidelines for Auditing Quality Systems Part 1: Auditing (Homebush, NSW: Standards Australia) (Wellington: Standards New Zealand) 1992.
Grant Gay and Roger Simnett, Auditing and Assurance Services In Australia, 2nd ed. (Sydney, McGraw Hill, 2003), Chaps 6, 7.
The head auditor is in charge of the audit and is responsible for the whole audit, including any members of the audit team. The head auditor:
If you have trainee auditors, you also need to make sure they know what to do and how to do it, and (later on) monitor how they are going.
Audit team members are only required to perform the duties assigned by a lead auditor, so the responsibility for the audit is ultimately not theirs.
The head auditor informs them what will be required of them. It may involve:
Students do not start as a head auditor and will be part of a team. However, the team might comprise only the lead auditor and the student. Later on, they may be given the role of head auditor, but will still work under supervision while in training.