Does Your Organization Really Benefit from Internal Audits? Time for a Change?

Now that's interesting, especially to management...We have a Regulatory Engineer and he has been working to ensure that we meet all those crazy requirements. I will talk to him. In the past I believe my internal auditors have overlooked the opportunity to ensure that the company is aware of and addressing all the regulatory requirements. It might be good for our Regulatory Engineer to do some training with our audit group.

How about SOX? They also have requirements and do audits of their own. Do you see that fitting into our ISO Internal Audit program?

goodtimes said:

Now that's interesting, especially to management...We have a Regulatory Engineer and he has been working to ensure that we meet all those crazy requirements. I will talk to him. In the past I believe my internal auditors have overlooked the opportunity to ensure that the company is aware of and addressing all the regulatory requirements. It might be good for our Regulatory Engineer to do some training with our audit group.

How about SOX? They also have requirements and do audits of their own. Do you see that fitting into our ISO Internal Audit program?

Click to expand...

Now that's an improvement, getting your auditors to consider regulatory issues (especially new/changed regs)!

From experience, although there is potential to link to SOX, the culture of SOX audits is very compliance driven.

Re: Time for changes - Does your organization really benefit from internal audits?

I've also done both types- internal (which I did not like- because the company and I were not on the same page when it came to quality) and external (FDA not NB). True- auditing is auditing- but the dangling of a non-compliance carrot in front of management (i.e. civil money penalty, injunction, seizure, etc...) as a result of external FDA audits... really wakes up management. They are reactive, not proactive. But of course their goal is the artificial business goals to make sure they get their bonuses- not to make sure that compliant products are distributed to the public.

Coury Ferguson said:

And what conclusions have been determined with the data since the original thread started in August 2006?

Click to expand...

Any conclusions yet Andy?

Coury Ferguson said:

Any conclusions yet Andy?

Click to expand...

See #30!

AndyN said:

See #30!

Click to expand...

Thanks Andy, I must be loosing my eyesight in my old age.

AndyN said:

See #30!

Click to expand...

Based on what you said then, and the results shown now, hasn't there been some alteration to the results and %?

40% are saying they get value from them, and only 29% saying 'we'd drop 'em if we could'.

JaneB said:

Based on what you said then, and the results shown now, hasn't there been some alteration to the results and %?

40% are saying they get value from them, and only 29% saying 'we'd drop 'em if we could'.

Click to expand...

Not really, Jane since I also view "management not making them a priority" (they tolerate them, but wouldn't ask for them to be done) to be a similar state to "we'd drop them". Therefore, it's weighed heavily against the audits being of any real value.......

Now, I'm not saying that there aren't some places that do 'get it'. But they are way in the minority, I'd suggest. Often, it's because the audit process owner doesn't know how audits can give value (past simple compliance).

Therefore, the audits are done on a 'push' system, they don't report anything that management really care about (not following procedures etc.) or have an overwhelming amount of picky items which are them supposed to have full-blown Corrective Actions applied!

Has it really changed? No!

Just a couple comments:
1. To give value to the audits, I believe you have to use Internal Auditors that are highly respected by the auditee and those are hard to find. My experience tells me that process owners do not typically like to be told that maybe they can do something better by an outsider.
2. Simple compliance to me is very important. I keep hearing how we should be getting more from our internal audits. What's wrong with simple compliance? Isn't that why we started doing internal audits in the first place? Compliance to the ISO requirements is supposed to mean something to our customers.

goodtimes said:

Just a couple comments:
1. To give value to the audits, I believe you have to use Internal Auditors that are highly respected by the auditee and those are hard to find. My experience tells me that process owners do not typically like to be told that maybe they can do something better by an outsider.
2. Simple compliance to me is very important. I keep hearing how we should be getting more from our internal audits. What's wrong with simple compliance? Isn't that why we started doing internal audits in the first place? Compliance to the ISO requirements is supposed to mean something to our customers.

Click to expand...

Good points, thanks! I totally agree about the selection of auditors. I wish it was done more often the way you describe - with people who had earned some respect! It rarely happens that way, as you correctly say.

There's nothing wrong with simple compliance, in the early stages of implementation. However, I'm tempted to say that 'if you always do what you always did, you'll always be what you always were....."

Like a lot of things in life, a quality system goes through stages of maturity. Therefore, to see the maximum benefit from audits, the approach to doing them - in all respects - must also mature. My experience is that internal audits rarely mature, in fact they degenerate into 'going through the motions'. I'm not advocating compliance, per se, just saying that it shouldn't remain the focus.