5 Recommendations For Your Internal Audit Program, And Why You Should Have Them
As a pharmaceutical company or as a supplier to pharmaceutical companies, your internal audit program is essential in ensuring your compliance status. You know the program is always subject of scrutiny during health authority inspections and customer audits.
An effective internal audit program will help your organization to be relaxed and confident during audits and inspections, will identify issues internally and will provide opportunities for improvement before external eyes start prying.
So far, nothing you didn’t know.
- But what are you going to do if your Internal Audits program is causing mostly headaches and the benefits of the program are lost?
- What if your internal audit program is a burden that adds no value to your organization?
- What if auditees start avoiding or even obstructing internal audits as they find it a waste of time?
To solve these problems and return the internal audit program to the effective and useful system it is supposed to be, here are our 5 recommendations you can do towards the common goal:
-
Have a Risk-based Internal Audit Plan:
“Risk-based” is the catch phrase in our industry. So, a risk-based internal audit plan should not be a surprise. Internal audits are a time-consuming activity for both the auditors as the auditees.In our work as an auditor, we are often surprised by Internal Audit plans that are still based on procedures developed over 10 years ago, with fixed audit frequencies for all departments and fixed duration for all audits.
Why not create a risk-based frequency approach: taking the criticality of the activities into account, as well as the number of customer audits/health authority inspections, the number of observations during previous audits, trend results from earlier years etc. And when you’re at it: why not base the duration of a certain audit on similar information.
By creating a risk-based audit plan you can use resources more effectively and may even save time. Essential is that the risk-based approach ensures everything is still covered in the program. Risk based is not a justification for not doing audits.
Creating a risk-based audit plan needs to be done carefully. Contact us if you need help setting this up.
-
Use Experienced auditors:
Experienced auditors are able to move through subjects quickly and can identify possible issues faster. Experienced auditors will also have seen certain problems before, in other departments or other companies. An experienced auditor will not provide the solution, as an auditor never tells the auditee what to do, but can indicate certain directions that may or may not have worked for others.Another useful trade of experienced auditors is that they can explain why certain improvements are needed and what their impact on the (end-product / patient) will be.
Lastly, an experienced auditor is capable of asking the relevant questions, and when needed, explain the reason of a question. This will increase the sense of usefulness of the audit by the auditee (in other words: not see the audit as a waste of time).
If you don’t have experienced auditors, hire them externally. If you organize and document it well, there is no reason why you could not use a consultant for your internal audits. We can provide you with both the experienced auditor as well as the justification.
-
Have Enough auditors:
Different people see different things, based on their background, experience and education. Auditees nor Auditors like the same questions over and over again as it does not add value to answer the same question over and over again. The same is for document review: The fifth review of a procedure by the same person, is not going to reveal a new issue.By making sure you have enough auditors you can keep things interesting for both the auditor and the auditee. The different approach another auditor will take may reveal a different view on the subject and further understanding for both auditor and auditee. This will increase the effectivity and with that, the usefulness of the audit. Combined with an experienced auditor, this may be a powerful tool in improving the entire quality system.
If you do not have enough auditors: provide training opportunities for new auditors, e.g. by acquiring the on-site internal auditor training we provide.
-
Express both positive and improvement items:
No one likes getting bad news. By indicating a number of things that are done right, people are more open to receiving the bad news. Focus on explaining the issues to be a company problem, not only of the auditee. When there are observations, make sure the auditee understands what the issue is and why. In our experience, when an auditee is convinced they have to do something, they will do it. Auditees are hardly willing to improve just because the auditor says so.It’s surprising how often internal audit reports state that, “for efficiency purposes” they are only lists of observations, bearing bad news and document only what is wrong. Not a fun thing to read.
Experience and training will teach auditors to work with auditees in a positive and constructive atmosphere. We can provide both the experience auditor as the training.
-
Evaluate your risk-based audit program:
After a year of performing internal audits, evaluation of the results is essential to improve the system. Many organizations limit this evaluation to the review of the individual audit result (e.g. number of observations). By evaluating the entire system, this will give you the input for the risk-based audit plan for the next year.But don’t forget to ask the auditees how they have experienced the program, what liked or disliked. Compare internal audit results with customer audits and health authority inspections and act if there are significant differences.
Evaluating your risk-based audit program needs to be done carefully as it determines the effectiveness of the audit program next year. Contact us if you need help.