9.2 Internal Audit [ISO 45001 Procedure & Checklist]

Who Should Perform the Internal Audits?

Internal audits are most effective when conducted by persons or departments independent of the functions being audited.

Such audits should provide the accountable executive and senior management with feedback on the status of:

• Compliance with regulations
• Compliance with policies, processes and procedures
• The effectiveness of safety risk controls
• The effectiveness of corrective actions
• The effectiveness of the OH&S Management System

Some organizations cannot ensure appropriate independence of an internal audit, in such cases, they should consider engaging external auditors (e.g.; independent auditors or auditors from another organization).

Internal Audit Training

It is critical that due care be taken in selecting staff to perform the role of internal auditor. Individuals who show potential as auditors should be given formal training by a registered training organization. The required level of competence of all internal auditors is maintained via refresher training or, more importantly, active participation in the audit program.

Apart from having the appropriate training, selected staff should also possess the necessary personal qualities and attributes that enable them to act in accordance with the principles of auditing. It is strongly recommended that the internal auditors widely publish an audit program, as it will provide a useful planning tool for key stakeholders.

9.2.1 General - The Internal Audit Process

The internal audit process itself should cover all facets of preparing for and conducting audits based on a sound audit program: audit scope, audit criteria, references, definitions, audit schedule, audit performance, follow-up audits, corrective action, audit documentation, audit failure and management review.

The Health and Safety Manager should ensure that internal audits are conducted by staff who do not work in the area being audited. It should be noted that the exchange of internal auditors among different organizations can be a useful process. The exchange of auditors, where possible, can also be used to enhance the value of the audit and the individual auditor’s competencies.

Planning of internal audits should take into account the safety criticality of the processes, the results of previous audits and assessments (from all sources), and the implemented safety risk controls. Internal audits should identify noncompliance with regulations and policies, processes and procedures. They should also identify system deficiencies, lack of effectiveness of safety risk controls and opportunities for improvement.

9.2.2 Internal Audit Programme

Planning of internal audits should take into account the safety criticality of the processes, the results of previous audits and assessments (from all sources), and the implemented safety risk controls. Internal audits should identify noncompliance with regulations and policies, processes and procedures. They should also identify system deficiencies, lack of effectiveness of safety risk controls and opportunities for improvement.

Assessing for compliance and effectiveness are both essential to achieving safety performance. The internal audit process can be used to determine both compliance and effectiveness.

The following questions can be asked to assess compliance and effectiveness of each process or procedure:

Determining Compliance

• Does the required process or procedure exist?
• Is the process or procedure documented (inputs, activities, interfaces and outputs defined)?
• Does the process or procedure meet requirements (criteria)?
• Is the process or procedure being used?
• Are all affected personnel following the process or procedure consistently?
• Are the defined outputs being produced?
• Has a process or procedure change been documented and implemented?

Assessing Effectiveness

• Do workers understand the process or procedure?
• Is the purpose of the process or procedure being achieved consistently?
• Are the results of the process or procedure what the “customer” asked for?
• Is the process or procedure regularly reviewed?
• Is a safety risk assessment conducted when there are changes to the process or procedure?
• Have process or procedure improvements resulted in the expected benefits?

In addition, internal audits should monitor progress in closing previously identified non-compliances. These should have been addressed through root-cause analysis and the development and implementation of corrective and preventive action plans.

Use an Internal Audit Programme to ensure that the ‘process names’ identified in the Process Matrix & Application form are copied into the internal audit program.

In conjunction with Top management, the Health and Safety Manager should devise a 10-year Internal Audit Programme. When designing the audit program, you should ensure that customer feedback, organizational changes, and risks and opportunities are brought into consideration.

The frequency of audits depends on the criticality of each process and the perceived need to audit, but all processes and areas are audited at least once every two years. Critical processes generally interact with the customer directly and are therefore audited annually, or more regularly as required. Develop the 2-year internal audit program with specific dates and durations of each planned audit.

Workers must be included in the audit process and the development of the audit program. Retain the audit program and the audit results as documented information.

You should consider process status in terms of maturity and stability; a more established, proven process will be audited less frequently than a newly implemented or recently modified process and should receive a lower status score. Conversely; processes which are not performing to the planned arrangements, should be assigned a higher status score.

You should consider process importance as the degree of direct impact that process performance has on customer satisfaction; i.e., could the process provide the customer with nonconforming product? Support processes should be given a lower ranking than the manufacturing/service provision processes. In addition, the results of previous audits should be considered too. Processes that have been audited recently that have shown effectiveness and improvement should be audited less frequently.

Using an Internal Audit Checklist

The audit checklist is one of the many tools available from the auditor’s toolbox that helps ensure your audits address the necessary requirements.

The checklist stands as a reference point before, during and after the audit, and will provide the following benefits:

• Ensures the audit is conducted systematically
• Promotes audit planning
• Ensures a consistent audit approach
• Actively supports your organization’s audit process
• Provides a repository for notes collected during the audit process
• Ensures uniformity in the performance of different auditors
• Provides reference to objective evidence

Use an Internal Audit Checklist that integrates the requirements of ISO 45001:2018 and presents them as questions.

Using this audit checklist to undertake a clause-by-clause audit works very effectively for the initial audits in preparation for implementation, gap analysis or certification. However, once your health and safety management system is implemented, your organization is expected to develop a process approach to its auditing program.

Use a process audit report (from the internal audit procedure). It requires the auditor to review the inputs, risks, controls, activities, equipment, materials, personnel, and methods of measurement for each process. You can cross-refer the clause references in the process audit report to the internal audit checklist questions.

Use a Template - Don't Try to Do it all Alone!

Our templates will help you to assess the status of your existing health and safety management system and identify process weakness to allow a targeted approach to prioritizing corrective action to drive improvement.

• Audit checklist metrics dashboard graphically displays status attributes
• Quickly identify and target system weakness
• Real time charts display audit result data - ideal for reports or presentations

The dashboard provides fast and reliable access to system and process metrics, precluding the need to know where all performance data is stored, or for having to locate the metrics champion for current data. It also reduces the likelihood that data is lost when metrics owners change or leave the company and reduces the learning curve for new metrics owners.

• Clearly illuminates under-performing metrics for prompt management attention
• Provides a unique management ally during internal and external audits
• Improves meeting efficiency by segregating metrics.

Documented Information

Auditors should not necessarily expect to find a documented internal audit procedure in place. However, they must be able to access documented information confirming the implementation of an audit program by the organization.

Documented information must also be available to evidence the results of audits.