internal audit introduction-15042024.ppt

ISO internal Audit trainig

1. INTERNAL AUDIT
TRAINING
By: Chris Ng
Visualogic Management Sdn Bhd

2. Training DetailsTraining Details
HRD
Time: From 9:00am – 5: 00pm
Attendance
Training evaluation
Tea Break 10:30am – 10:45am
Lunch 12:30pm - 1:30pm
Tea Break 3:30pm – 3:45pm

3. COURSE OUTLINES
Section 1 : Introduction To Internal Audit
Section 2 :Audit Preparation
Section 3 :Audit Methodology
Section 4 : Audit Reporting

4. Promote objectivity and consistency into your company’s
Audit Process.
Assist Auditors to prepare and conduct meaningful Audits
to improve Audit Effectiveness in your company.
Provide participants with practical experience
To view auditing as a tool for management to assess
effectiveness and suitability of Management Systems in
your company.
COURSE OBJECTIVES

5. SECTION 1
INTRODUCTION TO
INTERNAL AUDIT

6. WHAT IS INTERNAL AUDIT
•Systematic, independent and documented process
for obtaining audit evidence and evaluating it
objectively to determine the extend to which agreed
criteria are fulfilled

•Purpose of Audit
 To evaluate the need for improvement
 Check compliance

7. INTERNAL AUDIT - REQUIREMENTS
•Programmes and schedules
–reflect interested parties requirements
–take into account previous audit results
•Procedures - audit objectives
–Audit scope
–Frequency
–Methodologies
–Responsibilities
–Requirements for conducting and reporting audits

8. CONCEPTS OF AUDIT

Instruments
Criteria
Evidence
Findings
Conclusion(s)
Reporting

9. INTERNAL AUDIT BASIC STEPS
Pre Audit On Site Post Audit
Agree Objectives,
Scope and Criteria
Plan
Select Team
Methodology
Working Documents
Audit Schedule
Familiarise/
Preliminary
Document Review
Introduction
Collect Evidence
•Document Review
•Interview
•Site Inspection
Verification Assessment
Debriefing
Write Report
Action Planning
Follow-Up
Activities

10. ISO 19011: 2018
•Audit Guide
•Released on July 2018
• Prepared jointly by
- ISO / TC 176 SC 3 ( QMS )
- ISO / TC 207 SC 2 ( EMS )
•Replace ISO 10011 –1 : 1990, 10011 – 2 1991,
ISO 10011 – 3 : 1991, ISO 14010 : 1996,
ISO 14011 : 1996 and ISO 14012 : 1996

11. TERMS & DEFINITIONS (ISO 19011:2018)
•AUDIT CLIENT- organization or person requesting an audit
•AUDITEE- organization being audited
•AUDITOR- person with the competence to conduct an audit
•AUDIT TEAM- one or more auditors conducting an audit,
supported if needed by technical experts
Note 1: One auditor of the audit team is appointed
as the audit team leader.
Note 2: The audit team may include auditors-in-
training.

12. TERMS & DEFINITIONS (ISO 19011:2018)
•TECHNICAL EXPERT- person who provides specific
knowledge or expertise to the audit team
Note 1: Specific knowledge or expertise relates to
the organization, process, activity to be
audited, language or culture
Note 2: A technical expert does not act as an
auditor in the audit team and operate under
direction of auditor

13. AUDITS PROGRAM
Independent (3rd party) no business
relation e.g. certification body audit

Types Of
Audit
Internal (1st party) own people
External (2nd party) with business
relation e.g vendor audit, customer
audit

14. AUDITS PROGRAM
Organization SC /
VendorCustomer
DOE DOSH
SIRIM
1
st
Party
2
nd
Party
2
nd
Party
3
rd

Party
3
rd

Party

15. International
Accreditation
Forum (IAF)
Accreditation
Body
Certification
Body
Companies
ISO 9001, 14001 etc
EN 45012 or ISO17021
e.g. Pacific Accreditation Cooperation(PAC),
Europe Accreditation Cooperation(EA),
Inter-American Accreditation Cooperation
(IAAC)
e.g. SIRIM QAS S/B [M’SIA],
RWTUV [GERMAN],
BSI [UK],
LLOYDS [UK],
GCC [Australia],
e.g. DSM (M’sia), UKAS, RAB, JAB,
DAR, SCC...
ACCREDITATION BODY &
CERTIFICATION BODY

16. CERTIFICATION BODY
An impartial body, government or non-governmental, processing
the necessary competence and reliability to operate a certification
system and in which those with an interest in the process of
certification are represented without any single interest
predominating.
1. LOCAL Certification Body
- Sirim QAS Sdn Bhd
 NON-LOCAL Certification Body Operate in M’sia
2. LLOYDS
3. RWTUV
4. BUREAU VERITAS
5. DNV
6. SGS YARSLEY
7. GCC

17. ACCREDITATION BODY
(Accreditation of Certification Bodies)
Responsibility for accrediting Certification Bodies to perform
assessments and award certification against the International
Standard.
 United Kingdom Accreditation Service (UKAS)
Standards Malaysia
 Joint Accreditation System of Australia and New Zealand
(JAS-ANZ)
 National Institute of Metrology, Standardization and
Industrial Quality, Brazil (INMETRO)
 Standards Council of Canada (SCC)
 Hong Kong Laboratory Accreditation Scheme (HOKLAS)
 The Japan Accreditation Board for Conformity Assessment (JAB)

18. 18
CERTIFICATION BODY

19. TYPES OF EXTERNAL AUDIT
Combined Audit
-When two or more management system are
audited together. Eg. ISO 9001( QMS ) & ISO
14001 ( EMS )
Joint Audit
- When two or more audit organization cooperate to
audit single auditee. Eg. SIRIM & DOE

20. EXTERNAL AUDIT PROGRAMME
a)Adequacy Audit
b)Preliminary Audit
c)Compliance Audit
d)Surveillance Audit
e)Re assessment

21. SECTION 2
AUDIT PREPARATION

22. PREPARING FOR AUDIT
Plan
Select Team
Methodology
Working Documents
Audit Schedule
Preliminary Document Review
Agree Objectives, Scope & Criteria

23. OBJECTIVES, SCOPE AND
CRITERIA
•Audit Objectives e.g. to verify the status of
implementation of System
•Scope: Physical boundaries, department / site /
branch to be audited
•Criteria :
» Policy
»Procedure
» Internal requirements
»Customer complaint etc

24. PRE-AUDIT ACTIVITIES
•Establish & implement systems as per standards - to
be done by auditees
•Develop & establish internal audit system - to be
done by Management Representative
•Clear understanding of audit assignment and
commensurate preparation - auditors

25. AUDIT PLAN
•Audit team - finalise leader/members
•Methodology - Review of documentation/ records,
Interviews and cross verification, Site inspection
•Working documents
•Audit schedule - allocation of proportionate time

26. INTERNAL AUDIT FREQUENCY
•Consider certification agency’s requirement
•Consider interested parties requirements
•Practice ranges from monthly to yearly, depending on
your needs

27. AUDIT SCHEDULE
•Company-wide audit plan in line with internal
procedure
•Plan for at least one year cycle
•Audit need not cover the entire scope every
time.
•For each individual audit, prepare detailed
programme, including time, auditors and
coverage.

28. Objective of Audit
Parts of Management System
Parts of Organisation
Personnel you want to see
Timetable of events
AUDIT PLAN CONTENTS

29. PREPARE WORKING DOCUMENTS
•Working documents facilitate the auditor’s
investigation.
•These may include:
–Checklists and Procedures used for evaluating
Standard / requirements
–Forms for documenting supporting audit evidence
and audit findings
–Meeting and Interview recording forms

30. DEVELOPING CHECKLISTS
•Primarily concentrate in two areas:
–Standard Requirements eg, ISO 9001, ISO 14001
etc
–Site Activities
•Selection and purchasing of raw materials
•Storage and handling of raw materials
•Manufacturing processes, assembly and packaging
(Note: checklists are not mandatory)

31. DEVELOPING CHECKLISTS
•Purpose
–Ensure a systematic and structured approach
–Ensure nothing is omitted to achieve objectives
•Methods
–Identify the objective of the checklist
–Identify the key steps in achieving the objective
–Sub-divide each key item into more detailed items
–Take each of those and divide still further

32. PRELIMINARY DOCUMENT
REVIEW
•Decide what documentation will need to be reviewed
–manual, procedures,
–Product and interested party requirements
–Policy, objectives & targets
–Interested party complaints
•Review procedures and documents against
requirements, relevant laws and other requirements.
•Make notes on implementation areas that need
verification.
•Do not draw any conclusions, or make any
assumptions at this stage.

33. SECTION 3
AUDIT METHODOLOGY

34. EXECUTING THE INTERNAL AUDIT
Opening Meeting/briefing
•Document review
•Inspection
•Interview
Collecting Audit Evidence
Additional
requirements
•Verification
•Evaluation
Develop Audit Findings
Closing Meeting

35. OPENING AUDIT MEETING
Meeting with relevant responsible personnel to:
(e.g. Manager, Department Head)
a. Establish rapport (e.g. Introducing the audit team)
b. Review the purpose & scope of Audit
c. Inform the audit evidence base on sampling of information
d. Resources and facilities, work safety, emergency and security
e. Identify Escorts / Guides (applicable 3
rd
party only)
- witness
- guide
` - Provide clarification or assisting in collection information
- cannot participate in
f. Identify personnel to be interviewed / Audited
g. Confirm Schedule / Timing
h. Open for Questions

36. OBSERVING &
RECORDING EVIDENCE
•Use checklists
•Use appropriate data collection method/s:
–Physical observation of site activities and
conditions
–Interviews
–Examination of documents
–Follow, trace & review linkages
–Follow up on previous audit findings

37. OBSERVING &
RECORDING EVIDENCE (con’t)
•Manage time optimally (adequate depth and
spread)
•Consult team members (Back and forth
verification)
•Think and adapt on-line
•Interpret the requirements of audit criteria
correctly (consider auditees viewpoints and
explanations)
•Maintain objectivity and cool temper at all times

38. AUDITOR’S APPROACH
•Meet Area Representative First
•Explain Purpose of Audit
•Be Calm, Polite
•Avoid ‘nit-picking’
•Take good points into account
•Perform all tasks
•Avoid argument
•Audit against specification
•Respect confidentiality
•Audit system not individual
•Record objective evidence
•Speak Clearly and Listen Carefully

39. WHAT DO WE AUDIT AGAINST
•Conformance to the documented management system?
•Conformance to requirements?
•Effectiveness and appropriateness of system?
•Environmental, health & safety?
•Company rules / policy?

40. INTERVIEWING
Why?
•Obtain a balanced view
•Get the true response
•Accumulate data
•Develop subject matter
•Stimulate interest
•Determine interviewees knowledge and
understanding
•Facilitate conclusions

41. INTERVIEWING (con’t)
1.Identify individual to be audited
2.Introduce yourself
3.Explain why you are here
4.Ask open question (s)
5.Ask the detailed questions
6.Do ‘show me please’
7.Check facts and make notes
8.Thank Auditee
9.Identify next Auditee on trial

42. INTERVIEWING (con’t)
•Avoid sounding like an interrogator
•Remain objective, calm and friendly
•Listen, rather than talk, for at least 75% of the time
•Avoid trick, leading, ambiguous or multiple questions

43. INTERVIEWING (con’t)
Techniques:
•Who? the right person
•Match questions to levels of responsibility
–Executive officers should be asked questions
related to policy, management structures
–Operative should be questioned on his/her areas
of operation: equipment, procedures

44. INTERVIEWING (con’t)
Techniques:
•How?
–Elicit specific responses from specific questions
–Follow a “trail” of questioning to find out if
interviewee really understands an issue.
•Use “W” questions to secure facts
–what, which, why, when, where, who, how
• Avoid aggressive questioning
•Don’t intimidate the interviewee
•Don’t make him feel “in the wrong”

45. INTERVIEWING – ‘THE FILTER
FUNNEL’
Open questions
•Encourage Auditee to talk freely
•Use What, Where, When, Why, How and
Who?
Probing questions
•Follow-up or focusing on more precise
detail
Closed questions
•Used where you want to clear ‘Yes’ or
‘No’ answer
What do you do?
What about this?
Is it true that…?

46. DOCUMENT REVIEW
Ask to see, for example :
•Written manual and procedures
•Monitoring protocols
•Records (training, monitoring and testing results)

47. TAKING NOTES
•Try to keep flow of Audit
•Be open
•Use clipboard and/or logbook
•Record
•Suspected nonconformities
•Observations
•Info ‘to be provided later
•Items to be follow up
•Improvement ideas
•Positive evidence of conformance)

48. AUDIT FINDINGS
•Clear/ Unambiguous
•Supported by Evidence
•Accurate
•Identified with relevant clauses and
procedures
•Identified with functional area

49. VERIFY &
ASSESS AUDIT FINDINGS
•On completion of audit, prior to close
out:
–Review notes and checklists
–Cluster similar findings together
–Determine whether there is a non-
conformance with systems/standards
–Evaluate impacts of non-conformances
–Fill in the non-conformance report

50. NON - CONFORMITY
The non fulfilment of specified requirements
Types of Non conformity
a. Major
b. Minor
c. Observation

51. Major Non - Conformity
A non conformity that has the potential
to result in very serious consequences in
relation to achievement of quality or
effectiveness of the Management System

52. MINOR NON - CONFORMITY
A non conformity is considered minor
or non critical and unlikely to have
serious consequences

53. OBSERVATION
- A potential non conformity that will
affect the effectiveness of Management
System. However, not enough evidence
to judge the methods or process are not
fulfil the requirement.
-Follow up for next audit

54. CLOSING AUDIT MEETING
a.Remarks of thanks for Co-operation received
b. Lead Auditor summarise the Audit results /
findings and also strengths and weakness
c. Auditors present findings and results
d. Make recommendations
e. Agree on audit report / result and confirm follow-
up review dates
f. Open Questions
g. Conclusion

55. HANDLING OF EXTERNAL AUDIT
•If you are not the person in charge, DON’T answer on behalf,
refer to right person
•If you are the right person,
–Work as a team, you are not alone
–DON’T answer if you are not clear ( question or answer )
–Discuss before answer
–Answer to question that asked, DON’T provided other
information (that not requested)
–If you cannot find the record / data, inform auditor that you
will show to him later.
–DON’T waste auditor time

56. SECTION 4
AUDIT REPORTING

57. NON-CONFORMANCE & EVALUATION
•Non conformance should be raised clearly against
audit criteria
•State clearly the nature of non-conformance
–Absence of documentation
–Inadequate documentation
–Lack of implementation
–Incomplete implementation
–Lack of evidence

58. WRITING OF AUDIT FINDINGS
CLEAR
CONCISE
SUPPORTED BY EVIDENCE,
BASED ON FACTS

59. AUDIT REPORTS
•Reporting
–Document scope of the audit
–Provide management with information on state of
conformance
–Provide management with information on
suitability, adequacy and effectiveness of MS
–Reliability of monitoring and control
–Highlight need for any corrective action
•Compilation of audit findings
•Submit to Management Representative and auditees
•Prepare an action plan following the audit
•Use an MS for Continual Improvement

60. CONTENT OF AUDIT REPORT
•As per internal audit procedure
•Description of non-conformance
•Nature of proposed corrective action
•Auditee
•Auditor
•Verification

61. FOLLOW-UP ACTIVITIES
•Communicate
- Communicate to related interested parties
•Monitor action plan
–Ensure implementation of recommendations
–Should be formulated as soon as possible after their
acceptance
–The plan should have a timescale targets for each of action
points
•Set date for next audit
–The timing will be determined by the seriousness of the
deficiencies
–It is important that audits are not viewed as one-off events but
as part of a continuous process of improvement.

62. Question & Answer !!!

63. Thank You!!!!
VISUALOGIC ADVANTAGE SDN BHD (371033-T)
No, 56A, Jalan SS21/62, Damansara Utama, Petaling Jaya,
47400 Selangor, Malaysia
Tel:[phone] Fax:[phone]
Marketing: 012-207 3326 (Stacy) Technical: 012-873 2993 (Chris)