Short Answer
An internal quality audit moves through planning (defining scope, criteria, and schedule), execution (gathering and evaluating objective evidence), reporting (documenting findings and nonconformances), and follow-up (verifying that corrective actions are completed and effective).
Comprehensive Answer
Knowing the four phases is the easy part. The quality of an audit depends on what actually happens inside each one, and on the judgment calls auditors make when conditions are less than ideal. This article looks at the practical work within each phase, common pitfalls, and edge cases that tend to trip up audit programs.
Planning: Where Most Audits Are Won or Lost
Good planning turns an audit from a generic inspection into a targeted review. Beyond setting scope and schedule, planning should include these activities:
- Reviewing prior results. Earlier findings, open corrective actions, customer complaints, and process performance data show where risk concentrates.
- Selecting the audit team. Auditors must be competent in the process being reviewed and independent of it. Auditing your own work defeats the purpose.
- Preparing a checklist or question set. Treat it as a guide, not a script. Rigid checklists cause auditors to miss issues that fall outside the listed questions.
- Notifying auditees. Auditees should know the scope, timing, and the records they need to make available, so the audit does not stall for lack of access.
A common mistake is trying to audit everything in one cycle. A narrower scope examined in depth usually produces more useful findings than a broad, shallow sweep.
Execution: Evidence Over Impressions
Execution typically begins with an opening meeting that confirms scope, logistics, and how findings will be communicated. From there, auditors gather evidence through three main methods:
- Interviews with the people who actually perform the work, not only their managers.
- Observation of processes as they are carried out in practice.
- Record review of documents, logs, training files, and approvals, ideally sampled rather than cherry-picked.
Objective evidence means information that can be verified, such as a specific record, a dated approval, or a directly observed step. A statement like "the team seems inconsistent" is an impression. "Four of ten sampled work orders lacked the required sign-off" is evidence.
Edge Cases During Fieldwork
Several situations require judgment. If an auditee is uncooperative or records are missing, document the access limitation rather than assuming a failure or a pass. If an auditor spots a serious issue outside the planned scope, such as a safety or regulatory exposure, it should be escalated promptly instead of waiting for the final report. If evidence is conflicting, gather more samples before drawing a conclusion.
Reporting: Clear, Fair, and Actionable
A strong audit report states each finding against a specific requirement and supports it with evidence. Findings are often classified by significance, for example a major nonconformance affecting the system's ability to meet requirements versus a minor lapse or an isolated incident. Many organizations also record observations or opportunities for improvement that are not formal nonconformances.
Well-written findings share three elements:
- The requirement that applies (policy, procedure, or standard clause)
- What was found, with traceable evidence
- Why the gap matters
A closing meeting lets auditees confirm that the facts are accurate before the report is issued. This is not a negotiation over whether a finding exists, but it does prevent factual errors from undermining credibility.
Follow-Up: Closing the Loop
Follow-up is the phase most often neglected, yet it determines whether an audit changes anything. The process owner should be responsible for investigating the root cause, proposing corrective action, and setting a completion date. Fixing only the visible symptom, such as correcting one missing signature, leaves the underlying cause in place.
Verification has two layers. First, confirm the action was completed as described. Second, confirm it was effective, meaning the problem has not recurred. Effectiveness checks often require waiting long enough for the process to generate new records to review.
Handling Overdue or Ineffective Actions
When corrective actions slip past their dates, escalation to management should follow a defined path. When an action proves ineffective, the finding should be reopened and the root cause analysis revisited, not quietly closed.
How the Phases Feed the Next Cycle
Results from one audit should inform the next planning phase. Recurring findings, patterns across departments, and slow closure times signal systemic weaknesses that management review should address. Treating each audit as an isolated event wastes much of its value, while linking cycles together builds a program that steadily strengthens the quality system.