Role
Internal auditor
Who decides which area is audited this year - a plan from three years ago or what has actually changed? Whether internal audit finds anything depends on that answer.
Intro call
Four questions we would start with
Who decides on the audit plan?
And whether that decision looks at risk, at process changes and at last year's findings, or at the calendar.
What do you not know about an area until you walk into the audit?
Usually a great deal - and that is exactly why preparation takes more time than the audit itself.
How long does it take before a finding turns into a closed action?
If it is months, the audit produces lists rather than change.
What is left after an audit when the auditor leaves the company?
Whether the knowledge of where and why the same findings keep coming back is written down or personal.
We take over the preparation and the chasing, you keep the judgement and the conversation
Assembling the plan, preparing the material, tracking findings and watching dates can be taken off the desk. Judging conformity and the conversation with the audited area stay with the auditor.
- The audit plan rests on risk and on change. - An area where a process was changed, or where nonconformities keep recurring, moves up the queue by itself.
- The preparation arrives ready. - The documents in force, the previous findings and the open actions for that area are laid out before the auditor starts reading.
- A finding is a case with a date. - With an owner, a reminder and a closing status - not an item in a report.
Scope
What can be taken off internal audit
Twenty example tasks. Each one has a human approval point. Below is a selection, and the scope we fit to your management system.
The audit plan
- A summary of areas with the date of the last audit
- Pointing out areas with open findings
- A proposed annual plan based on risk and change (decision: the lead auditor)
- A schedule with resources and dates
Preparing an audit
- The set of documents in force in the area
- Findings from previous audits of that area
- The list of open actions concerning the area
- A draft list of questions against the standard and the process (content: the auditor)
Conduct and findings
- Recording a finding with the evidence and the reference to the requirement
- Classifying the finding (decision: the auditor)
- A draft audit report (approval: the auditor)
- Passing the findings to the area owner
Post-audit actions
- Running an action with a date and an owner
- A reminder before the date passes
- A signal when an action is overdue
- Assessing whether the action was effective (assessment: the auditor)
- Pointing out findings that recur in the same area
Preparing for an external audit
- A summary of the evidence required by the standard
- The status of open actions as at the audit date
- Material for the management review
A day's work
Today
- The audit plan comes from the calendar and from last year's plan
- Before an audit you collect the documents yourself from four places
- You reconstruct last year's findings from the reports
- You chase post-audit actions by email and reminders
- Overdue actions surface at the management review
- You cannot see that the same finding is back for the third year running
With AI assistance
- The plan is proposed on risk and change, you approve it
- The material for the audit is laid out before it starts
- The previous findings for the area are in one view
- Actions remind themselves, with a date and an owner
- An overdue action speaks up before it reaches a report
- Recurring findings are pointed out as a pattern, not as an impression
- Coverage of areas
what has changed gets audited, not what is in the calendar
the plan rests on risk and change
- Effective actions
fewer findings closed formally with no effect
effectiveness is assessed after the date
- Ready for an external audit
the evidence is gathered beforehand, not in the week before
the summary is built as you go
- Findings coming back
you can see what returns despite closed actions
findings are linked to the area and its history
We start with tracking findings, because they are what gets lost most often.
- Step 1
A register of findings and actions
Every finding with an owner, a date and a status. Usually it emerges at the outset how many actions have been open longer than anyone thought.
- Step 2
Reminders and overdue signals
Watching the dates stops being the auditor's work.
- Step 3
Audit preparation
Documents, the area's history and open actions laid out before you walk in.
- Step 4
A risk-based plan
A proposed annual plan based on change and recurring findings. Last, because it needs the history from step 1.
Common questions
Questions that come up at the first meeting
Will the system classify a nonconformity by itself?
No. Classifying a finding has consequences towards the standard and towards the client, so it stays the auditor's decision. The system can propose the reference to the requirement and recall similar findings from the past.
Will an auditor still be needed?
An audit rests on conversation and observation, and that is its whole value. We take over the preparation: gathering the documents, the area's history and the open actions, which today eats more time than the audit itself. An auditor who walks in prepared spends more time in the area, not less.
Does this fall under the AI Act?
Internal audit is not a high-risk use. The point to watch is that findings are linked to processes and areas rather than to names - we keep the register by area and requirement, because an audit is there to fix the system, not to assess people.
Still have a question that is not here? Book a call
Next step
How many post-audit actions in your company have been open for more than a year?
We will show you what internal audit looks like when the preparation arrives ready and an action has a date and an owner.