Internal Auditing During COVID-19

19 June 2020

I’m sure you’ve all heard this a thousand times when I say ‘these are strange times!’, globally we’re experiencing something that not many of us have ever seen the like of before.

Both our personal and professional lives have been affected. We’re living and working in ways that if we’d been told one year ago we’d be forced to do these things, we’d probably have laughed out loud.

However during this crisis, to an extent, business has gone on. Organizations have continued to operate and usually in ways that are quite different from the standard processes they’d typically employ. With this in mind don’t you think this is actually the perfect time for an internal audit?

Think about it for just a minute. Rather than all of your employees coming to the same office, working at the same desks, using the same resources, we’re actually spread all over the place. Such changes have potentially introduced all sorts of new risks into our working day that could impact on our management systems. We need to ensure, now more than ever, that our people and processes are OK. What better way to do this than internal audits?

That said we may not have the same resources at our disposal in order to host an internal audit. Indeed we may be working from home and our ability to deliver a value adding internal audit may have been greatly reduced. But if we do have the capability we really should think about delivering Internal Audits.

Let’s remember why we do internal audits. We do them to gain an Independent, objective assessment, based on identified risks to our organizations, of how our processes are performing. We seek compliance with requirements and always look to add value. Our internal audit reports are then communicated within our organization. This information is used by senior management to assess how everything is going and to identify where improvement is needed. Again I ask you, isn’t this the perfect time for an internal audit?

The ISO standards themselves require us to complete internal audits at ‘planned intervals’. The scheduling of internal audits should take into consideration risks that the organization is facing. So when feasible the ISO standards require us to complete internal audits. So when you next speak with your external Assessor you may be asked why internal audits weren’t completed?

During the COVID-19 crisis we should be relying on not only the competence and tenacity of our staff, but also our management systems. These systems were developed and deployed to allow our organizations to function effectively and to help us ensure compliance and achieve our goals. However due to the changes we’ve been forced to make this might not be the case all of the time.

Also just because we are possibly working differently we can’t abandon our management systems. In fact every ISO standard includes requirements for making and managing change. Once we’ve made these changes a good way to ensure they’re effective is via an internal audit.

Potential risks that we may now be facing during the COVID-19 crisis could include:

Ensure Information Security and Data Protection whilst people are working from home.
Those people that are working from home, do they have suitable work environments? Do they have suitable equipment and means of communication with their colleagues?
Are Display Screen Equipment assessments needed? Those that are done are they sufficient and have appropriate actions been taken for any deficiencies identified?
Are staff member suffering from stress whilst working from home? Do they have any anxiety about the current situation, or when they may need to return to the workplace?
Are processes being followed and is suitable performance being achieved?
Have any changes to processes been suitably communicated and are they effective?
Are complaints being received or non-conformities identified being suitably recorded and appropriate corrective actions being taken?
As we return to work and new working practices are introduced, i.e. Social Distancing, Use of PPE, Cleaning Protocols, etc. Are these new practices being applied correctly?
As production processes are being started-up are they working correctly and are all safety and environmental measures being followed?
Are any new Compliance Obligations being satisfied? These could relate to Health and Safety or the Environment.

As you can see from this short list there may be lots of reasons to schedule an internal audit. However due to the way we’re currently working performing an internal audit may seem difficult. You may wonder how to communicate with your colleagues during the audit, or how you’ll gather objective evidence. Since the outbreak of the COVID-19 virus NQA has been completing all of our external audits remotely. We use a variety of platforms to communicate with our clients, all of which have proven very effective. NQA has found that the planning of the audit is the most important element. Potentially you could follow these steps for planning your own internal audits:

Clearly define the scope of your internal audit. For example it may relate to new working arrangements in response to the appearance of COVID-19.
A detailed audit plan can then be prepared. A good audit plan is the key to a good audit. The plan can list each element of the processes you’ll need to review to ensure these new arrangements are being followed.
You can then identify how you’ll interview the necessary people. This can be done via online meetings, or simply via a phone call. Gathering evidence can be done in a variety of ways; it can be done via mobile technology, evidence can be provided via emails, it can be provided via file hosting services, video footage can be shot, screens can be shared and evidence can be gathered via good, old-fashion interview - these can even be recorded if necessary.
Once you’ve completed your interviews and gathered your evidence the process of reporting and following up your findings will be the same as for every other internal audit you’ve ever completed.

If you yourself are working remotely you can use the above means to complete an internal audit for works being completed onsite, or within your company. We really aren’t limited by technology at this time. We only need to understand how we can exploit it to achieve our ends.

So I encourage you to think about the good, old, internal audit. They could prove very beneficial during these strange times.

I hope this blog has given you some food for thought when it comes to your internal audits. Unfortunately, due to the pressures that lots of us are currently facing, internal audits may be the last thing on your mind. But should you be in a position to complete internal audits please remember that you do have this incredibly useful monitoring tool in your toolbox. You only need to use them appropriately.

Authored by: Martin Little, NQA UK Field Operations Manager (Southern Region)