Internal audit measures the gap between what is written in the manual and what is done at the desk. Finding this gap is not a failure but a sign that the system works. When it is not understood that the audit targets the process and not individuals, however, findings start to be hidden and the measurement loses its value.
The purpose of the audit
Whether the defined arrangements are applied is tested. The view is on the process. The purpose is verification.
Measuring the process, not the person
The audit is not a performance appraisal. The target is the system. The distinction is made openly.
Setting the scope
Which steps will be examined is written in advance. An audit without a scope loses focus. A plan is made.
Examination of records
Process records are examined by sampling. If there is no record, the step counts as not done. The criterion is clear.
What the absence of a record means
A step said to have been done but with no record cannot be verified. The finding is recorded. The rule is applied.
Skipped steps
Jobs in which revision was skipped are looked for. The risk rises in busy periods. The finding is important.
Detecting shortcuts
Shortcuts formed under pressure become visible at audit. The cause is examined. The measure becomes structural.
The gap between written and done
If a gap is found, either the document or the practice is corrected. The decision is reasoned. Both options are legitimate.
Correcting the document
If the practice is better, the document is updated. Reality goes into writing. The arrangement matures.
Correcting the practice
If the step is really necessary, the practice is corrected. Training and reminders are used. A measure is chosen.
Audit frequency
The audit is carried out periodically. Auditing too often creates a burden. A reasonable interval is chosen.
Who carries out the audit
The auditor has not carried out the work being audited. Independence is preserved. The assignment is made accordingly.
Recording the findings
Findings are tied to a written report. A verbal warning cannot be tracked. A record is kept.
Linking to corrective action
For each finding a person responsible and a deadline are set. It is followed up. The loop closes.
Follow-up audit
Whether the measures taken have worked is looked at in the next audit. Closure is verified. The process is completed.
The risk of punitive use
If findings turn into a means of punishment, they start to be hidden. The data is corrupted. The system collapses.
Protecting an open culture
An environment is built in which reporting errors is safe. Only then is real data collected. Culture is decisive.
Reporting to management
Audit results are summarised and shared. Decisions are made with data. The report is kept short.
Sample selection
The jobs to be examined are chosen by an impartial rule. Easy files are not chosen. Discipline is preserved.
Writing the audit plan
What will be audited in which period is planned in advance. The plan is shared. Preparation becomes possible.
Reading findings positively
An audit that produces no findings shows not that the processes are flawless but that the audit was superficial; the health of the system is measured by the speed at which findings are found and closed. That is why the number of findings is not treated as an indicator of failure. The view is reversed.
Limits of the approach
Internal audit does not replace an independent external audit. An inside view has blind spots. The limit is accepted.