Five Stages of an Internal Audit:
An internal audit compares how a process works with agreed requirements. It can help a team understand gaps and improve its controls, provided its scope, criteria and evidence are clear.
This guide is a starting point, not proof of auditor competence or a substitute for a required audit programme. Use auditors with suitable knowledge and impartiality, and obtain specialist help where the scope or applicable requirements call for it.
1. Plan the Audit
Before fieldwork, agree the audit objective, scope and criteria. Then organise the people and time needed to examine them:
- Scope and criteria: Define the processes and requirements to examine, such as customer orders, stock control or project planning. A focused first audit is useful, but it does not replace wider coverage required by your audit programme.
- Audit team: Choose people with the required competence and impartiality. Involve relevant expertise and manage conflicts of interest; do not assume a fixed team size fits every audit.
- Schedule: Agree dates, access and sufficient time with the process owner. Fit the audit into the required programme and the risks of the process.
2. Prepare Questions and Records
Review the process before the audit and prepare two things:
- Audit questions: Build questions around the agreed criteria. For example: how is an order received, who validates it, where is it recorded and how does production learn about it?
- Previous evidence: Review earlier audits, customer complaints and nonconformity records relevant to the scope. Use them to plan where to sample, not to assume the conclusion.
Start With the On-Page Checklist
Use the five-stage workflow checklist below and create your own questions, findings log and action plan. This article does not send files by email or provide an Audit Smart Kit download.
Go to the checklist3. Observe the Process and Collect Evidence
The aim is to assess the process against its requirements, not to assign blame. Use several sources of evidence:
- Observe actual work: Compare procedures with practice through observation and relevant records. Respect site access, safety and confidentiality rules.
- Interview the team: Ask the people who do the work to explain it. Use open questions such as "What gets in the way of this process?" and check the answers against records and observations.
- Collect objective evidence: If stock records differ or orders are late, examine the relevant transactions and dates. Record the sample and source, distinguishing verified evidence from an untested statement.
Common Mistakes to Avoid
- Looking for someone to blame: Focus findings on requirements, evidence and process controls.
- Relying only on written procedures: Check how work is actually done using suitable observations, interviews and records; the right approach depends on the audit scope.
- Filing a report without follow-up: Agree how findings will be addressed and how action effectiveness will be checked.
4. Report Findings Clearly
Make the report useful for decisions while retaining all findings required by the audit scope and criteria:
- Clear and complete: Summarise priorities, but do not cap the number of nonconformities or omit a finding because it falls outside a top-five list.
- Evidence-based: Link each finding to the applicable requirement and the objective evidence supporting it. Separate nonconformities from improvement opportunities.
- Action-focused: Ask the responsible team to assess causes and agree suitable correction and corrective action. A suggested stock-control fix is a hypothesis to test, not a substitute for cause analysis.
5. Follow Up Actions and Effectiveness
"An internal audit needs follow-up: track the action plan and check whether the measures work."
Keep a visible record of responsibilities, dates and verification:
- Assign an owner and due date for each agreed action, based on the risk and applicable requirements.
- Review progress regularly at an interval appropriate to the risk and agreed plan; weekly or fortnightly meetings are examples, not universal requirements.
- Verify effectiveness: Check whether the action addressed the cause and the issue has recurred. Retain evidence of the review rather than treating action closure as proof of success.
Interactive Audit Workflow Checklist
Tick a stage when you have completed and recorded its work. This tracker does not certify compliance or replace required audit evidence.
All five workflow stages selected.
Review the evidence and outstanding actions. Selecting every box does not prove that the audit is complete, compliant or effective.
Quick Glossary
Nonconformity: Failure to meet a specified requirement, such as an applicable contractual, legal or internal requirement.
Objective evidence: Information supporting a finding, with a recorded source and sample where appropriate.
Gemba: A Japanese term for the actual place where work happens. In process improvement, it means examining the work at its source.
Key Takeaways
- Start with a clear scope: A focused process audit can be a useful starting point while preserving the wider coverage your audit programme requires.
- Look for evidence, not blame: Assess the process against its requirements and record what supports each finding.
- Plan follow-up: Assign actions and check effectiveness instead of stopping at the report.