Becoming an Excellent Auditor — Secrets to a Good Audit

An excellent auditor can bring value to an organization, while a poor auditor can shackle the organization with bureaucracy. The difference between the two usually depends on the auditor's different performances before, during, and after the audit.

Regarding management system audits, ISO 19011 provides relevant guidelines and specifies the competency requirements for auditors. In auditor training courses, basic knowledge of management system audits is usually taught, from preparing the audit plan to compiling the audit report. If fortunate, auditors can also practice personal audit behaviors and skills during the training. However, the real learning of management system audits should begin when the auditor conducts their first audit task.

An audit is a continuous process, and even experienced auditors personally feel that they learn something new in every audit.

The following content explains what auditors should do before, during, and after the audit to help them better implement management system audits.

Before the audit

Spending some time on effective audit planning before the audit can bring good returns to the management system audit, especially for remote audits. Audit planning is crucial to ensure the achievement of audit objectives, and before starting the management system audit, auditors must complete the following tasks:

Know the audit standards

Audits become complicated when an organization must meet different requirements.

When the auditee explains to the auditor what they are doing and how they do it, the auditor's brain simultaneously processes all relevant information and compares what they hear and see with the information in the auditee's management system documents. Additionally, the auditor must determine whether the actual content and situation explained by the auditee fully meet the relevant requirements. This requires the auditor to handle many things at once.

If the auditor does not know the audit requirements, they will spend a lot of time blindly searching for problems during the audit, like looking for a needle in a haystack, potentially missing audit findings that may be very important to the organization. In actual audits, it is not expected that auditors remember or cite every clause or content of the relevant audit requirements, but auditors should at least be aware of the existence of these requirements and be able to connect the key points to determine if something is not done correctly.

Understand the organization's context

The organization's external and internal factors, interested parties, and their needs and expectations define the boundaries, applicability, and risk level of the organization's management system operation. Understanding the organization's context allows auditors to plan audits with a greater focus on significant matters. Even when conducting internal audits, the organization's context should be considered to understand changes since the last audit and things the auditor might not know. This means that even an experienced auditor should not be overconfident, thinking they know everything, because things can change very quickly nowadays.

Prepare the audit route

Using checklists during audits is acceptable, but auditors should be aware that following a checklist might cause them to miss important issues and fail to see the full picture of management system implementation. Management system audits are based on sampling, and in most cases, it is impossible to examine every process and activity in detail. Therefore, auditors should spend more time focusing on higher-risk areas and aspects related to customers and the management system. Auditors can prepare a list of topics or processes to review during the audit while maintaining an open mind to follow up on issues that may arise. In remote audits, auditors can rely on remote audit guides to help use cameras on-site to ensure the auditor knows the dynamic situation of where the audit is being conducted.

During the audit

During the audit, the auditor should play a leading role.

Establish a platform and communicate auditor expectations

At the start of each meeting, the auditor should inform the auditee of the audit requirements and give them the opportunity to explain how the organization meets these requirements. At this time, allow the auditee to fully express themselves and speak freely about the management system implementation, while the auditor listens patiently, observes carefully, and draws correct conclusions. Remember, during the audit, the auditor is the leader, so do not ignore the audit objectives or let the audit deviate from the topic.

Move around, from big to small and from points to the whole

Auditors should follow downstream or upstream processes and move around. Start auditing from the overall perspective and delve into relevant issues as needed. Then, return to the overall level and connect various audit points. Usually, auditors list some nonconformities or observations, and if these findings are combined, they may form a larger issue related to a specific process, sometimes even involving management.

Auditors should not assume they can sit in a meeting room and conduct an effective audit without observing on-site activities and performing real sampling. In remote audits, auditors must tell the remote audit guide where to audit and what to review. The audit sampling arrangement should be chosen by the auditor, not the auditee, and this should be given special attention.

Reporting

At the end of each meeting, the auditor should summarize their observations and let the auditee know the auditor's views on the audit findings. The auditor may have found that the auditee's management system implementation is very orderly or requires further follow-up.

The auditor may encounter a nonconformity that is not yet serious enough to be considered a significant audit finding. However, it is crucial for the audit that the auditor confirms what they have found, giving the auditee the opportunity to clarify any questions about these findings. It should be noted that this reporting lays a good foundation for the final meeting and can help avoid potential conflicts.

After the audit

After the audit, the auditor will provide a clear and concise audit report. If the auditor cannot compile a clear and concise audit report from the audit findings, they must do further work to improve their overall audit capability. Anyone reading the audit report should be able to understand what the auditor's findings are, why the finding is a problem, and the objective evidence and respective requirements supporting the finding.

Management personnel should be able to understand the audit findings to take necessary corrective actions, and any other auditors should be able to follow up on these findings to confirm whether the corrective actions effectively address the related audit issues.

Auditor organizes their thoughts

During the audit, the auditor has interviewed several people, reviewed relevant records and procedures, and observed many business activities. The auditor should connect these audit points to draw certain audit conclusions. Before starting to compile the audit report, the auditor should review their audit notes made during the audit and organize their thoughts.

Have sufficient objective evidence to support each audit finding

If there is no objective evidence to support the audit findings, the auditee may doubt the findings. If the auditor does not have enough reliable objective evidence, they need to return to the auditee to find relevant objective evidence.

Let the "Audit Report" take a break

After the auditor drafts an audit report, they can set it aside for a few hours while doing other tasks. Then, the auditor returns with a clear mind to systematically and comprehensively review the draft to ensure the accuracy, sufficiency, and completeness of the audit report.

Become an excellent auditor

Over the past 20 years, with the development of management system standards and the increasing demands and expectations of various organizational stakeholders, the management system audit profession has become increasingly important. Remember, the audit report prepared by the auditor serves as input that may influence the organization's strategic decisions, which are closely related to the organization's future development. This is the greatest value that the management system audit profession brings to social and economic development.

Careful preparation before the audit, implementing good audit strategies during the audit, and taking appropriate actions afterward—these good audit secrets distinguish professional value-added audits from bureaucratic audits.

Professional value-added audits have great potential—auditors aspiring to engage in the management system audit profession should be diligent, honest, and impartial to become excellent auditors!