Your first internal audit, step by step

An internal audit sounds like something for big companies with a quality department. In fact it is a simple habit: once in a while, you look at how the work really happens, compare it with how you said it should happen, and fix the gaps. Small businesses that do this catch problems earlier and are far calmer when a customer or a certifier comes to check.

If you have never done one, the first is the hardest, because you are inventing the routine. This guide gives you a plan you can follow in a week.

What an audit is, and what it is not

An audit asks three questions about a part of your work:

1. Do we have a rule or a way of doing it that we agreed?
2. Do people follow it?
3. Does it do what we need?

It is not a hunt for someone to blame, and it is not a test of people. It checks the system. If you treat it as a trial, people will hide things and the audit will show you a tidier picture than the truth.

Choose one area and write down why

Do not audit everything. Pick one area for the first time. Good choices are the ones where a mistake costs money or trust: taking and fulfilling orders, handling customer complaints, invoicing, managing a supplier, or looking after customer data.

Write one sentence on the purpose. "To check that every customer complaint is logged, answered within two days and followed up with a fix" is a purpose you can test. "To look at customer service" is not.

Then choose the standard you audit against. It may be your own written procedure, a customer's requirement, a law, or a recognised standard such as ISO 9001 for quality or ISO 27001 for information security. If you have no written procedure yet, the audit still helps: it will show you what people actually do, which is what you should write down.

Pick the auditor and tell people

The auditor should not audit their own work. In a small team, ask a colleague from another area, or a trusted outsider. Give them an hour of preparation and the authority to ask questions.

Tell the people being audited when it will happen and what for. A friendly note is enough: "Next Tuesday Sara will look at how we handle complaints. She will read a few records and ask questions. It is about the process, not about anyone's performance."

Prepare the questions

Write 8 to 15 questions before you start, each of which can be answered by evidence. For the complaints example:

• Is there a written way to record a complaint? Where is it?
• Pick five complaints from the last three months. Is each one logged with the date and the customer?
• Was each answered within the time we promised?
• For each one, what was done to fix the cause?
• Do the people who handle complaints know the rule?

For each question, note what evidence would answer it: a record, an email, a screen, a person's explanation. Evidence beats opinion.

Do the audit

Sit with the work. Ask people to show you, not to tell you. Pick samples at random, not the ones people offer. Write down what you see in plain words, the date and where you saw it.

Some tips for the conversation:

• Be curious, not clever. "Show me how you did this one" gets better answers than "why didn't you follow the rule?".
• Ask open questions and let silences run a little.
• Say thank you. People are doing you a favour by being open.
• Do not fix things during the audit. Note them. Fixing as you go hides the pattern.

Judge each point

For every question, choose a result:

• Conforms: the rule exists and is followed.
• Observation: it works, but you see a risk or an idea.
• Minor finding: a gap that is not a serious risk, such as one record missing.
• Major finding: a serious or repeated gap, such as no record at all or a rule that is widely ignored.
• Not applicable: it does not apply, with a reason.

An issue needs a note: what you saw, where, and which rule it breaks. Keep the language neutral. "Three of five complaints had no reply date recorded" is a finding. "The team is careless" is not.

Write the report and agree on actions

A one page report is plenty: the purpose, the date, the auditor, the results, the findings and a sentence on the overall picture. Share it with the people audited before anyone else sees it, so they can correct a mistake of fact.

For each finding, agree on an action with an owner and a date. Aim to go beyond "we fixed this one" to "this will not happen again": ask why it happened, and change the thing that allowed it.

Close the loop

Set a date to check that each action worked. An audit that produces a list of findings and no follow up is a paper exercise. When the fix is checked, close the finding, and note the date.

Then plan the next one. Many small companies audit one area every month or quarter, so that everything is looked at over the year, and the riskiest areas more often.

Where nerix helps

Checks (early access) is built for this. The plan says what is checked, how often and by whom. A few days before a date, the check opens by itself with its questions filled in from a starting template; eight are ready, including a yearly internal check for ISO 9001 or ISO 27001, a supplier check, a process check and a weekly 5S check. Each question has the evidence asked for. You choose Conforms, Minor issue, Major issue, Observation or Not applicable and write what you saw, adding a link to the evidence. An issue needs a note, and a Not applicable needs a reason.

NXFIG0X Every finding becomes a task in Work with an owner and a due date, and it can be closed only after someone checks that the fix worked. In the chat you can ask nerix to help word a finding neutrally or to draft the summary. The judgment about what you saw stays with the auditor.

The short version

Choose one area. Write a purpose you can test. Use an auditor who is not auditing their own work. Prepare questions and look for evidence. Record findings in neutral words, agree on actions with owners and dates, and check that they worked.