Afternoon all,

I wondered if any colleagues had experience of being audited by an organisation's internal audit team?

My turn has come around (part of the 2023 audit plan - I'm not under investigation!) and I value the scrutiny and oversight from a third party - after all, we can become complacent in our approach and it can be helpful to have an external eye cast its gaze over what you are doing from time to time.

However... we've just had our first meeting to agree Terms of Reference and I'm feeling a bit disenchanted by the whole process. Effectively, I'm being asked to define the risk areas for consideration, the questions to be asked and the key outcomes required for each. I queried whether the auditors had any experience of H&S and the answer was 'no' and that they didn't need any because 'all they will do is check what our policies say and whether they are being implemented properly'.

They've sent me the IAA guidance on H&S (very basic and I can see why they've come to me for input) but I guess I'm struggling to see where the value lies in what they are doing if the person they are auditing is the very person drawing up the questions. I will be using the process to highlight what I believe are areas of weakness, however, the potential for me to game the system is clear.

This is going to end up consuming a couple of days in work (preparing the questions, collating the evidence for review, various stage meetings, debrief and actions agreed) for something that I could draw up in an afternoon.

Does anyone else have any experience of being subject to internal audit? How did you find it? Was it valuable to your service? Did those carrying out the audit have any H&S knowledge?

Or was I being naive in hoping for some form of rigorous challenge here?

Yes, my H&S activities have been internally audited by non H&S people.  I certainly did not get any say in what the questions were going to be!

An experienced auditor can audit any topic.  They do this by first asking questions (and looking at documents) to determine what is supposed to happen (including what the standard they are auditing against says should happen).  Then they burrow into what actually has happened and whether or not it matches what is supposed to happen and whether there could be a better way of doing it ("better" doesn't necessarily mean "safer" but could also mean "more efficient").

What are they auditing against?  ISO 9001 or ISO 45001 or something else?  And to repeat Peter's very pertinent question, what exactly is being audited (you shouldn't ever feel it is you - it is processes that are audited, not people).

I have some minor quibbles with some of what has been said so far, mainly arising from what is meant by 'audit'.

However, the main point (to address the OP questions), is that I don't believe you need to know much at all about H&S to be an internal auditor auditing a company's H&S processes.  None of our internal auditors are H&S professionals (or even notably engaged in H&S in their other workplace duties).  As noted up the thread, these auditors are checking only that the company is doing what the company has said it will do - if it's written in the procedures you do it (or don't do it, if the procedures say don't do x y z), if it's not written it doesn't matter.

I would not expect to spend a great deal of time telling the auditors what to audit or giving them questions to ask - it should be written in the procedures.  If they are completely clueless you might spend some time running through an overview of the systems, but then I'd expect them to decide from that overview what to drill down into and ask to see evidence of.

I don't honestly expect these to be too challenging - I think the H&S people within a company know for themselves already where the company systems are weak and/or where there are failures in complying with them.

One of my quibbles - I would not expect this sort of audit to identify better ways of doing something - this is only about was it done in accordance with the procedures.  (In most systems, identifying the better ways is part of continuous improvement and is identified other than by auditors).  An auditor might, as a result of their digging, notice a possible improvement and raise it, but that would be as part of their role as a general member of staff to suggest improvements, not an auditor function.

The next different variation would be an audit against ISO19001 (or other system) - here the auditor will also be checking that what your preocedures say aligns with what the standard says they should say. In principle internal auditors could do that, but I wouldn't normally expect it (and ours don't).

A slight varation on that would be a client audit where an external auditor checks that what you do and say you do aligns with what the client requires.  This is similar to the ISO audit but will be checking against something defined (or referenced) in the contract docs.  Conceptually it's basically the same, but in my experience contract-specific requirements are less well thought out and break more easily at 'edge cases'.  These things also seem more changeable - clients suddenly add in new requirements (and may or may not give you enough notice to address them) - and more open to the whims or interpretation by the auditor.  These sometimes suggest things that they consider would be an improvement (but fairly often I / we don't agree).  Again in priciple an internal audit could do this, but ours don't.

Finally, we also have audits that are by a H&S professional / expert - we have appointed an external H&S professional organsiation to come into each of our sites annually and do an audit / inspection against statutory and good practice H&S requirements.  These people don't care much at all about our procedures, they are auditing against what they consider H&S systems and arrangements should be doing.  They are much more likely to find something like a missing fire instructions signage or document past its periodic review date.  These might suggest an improvement. These, I think, are the only sort of auditor taht actually needs H&S expertise.

We get all the above.  Actually they are (nearly) all worth the effort (but do come with varying degrees of pain and reward). 

Originally Posted by: Kate

Yes, my H&S activities have been internally audited by non H&S people.  I certainly did not get any say in what the questions were going to be!

An experienced auditor can audit any topic.  They do this by first asking questions (and looking at documents) to determine what is supposed to happen (including what the standard they are auditing against says should happen).  Then they burrow into what actually has happened and whether or not it matches what is supposed to happen and whether there could be a better way of doing it ("better" doesn't necessarily mean "safer" but could also mean "more efficient").

What are they auditing against?  ISO 9001 or ISO 45001 or something else?  And to repeat Peter's very pertinent question, what exactly is being audited (you shouldn't ever feel it is you - it is processes that are audited, not people).

Thanks Kate,

I agree with the audit process you've outlined and will be nudging them towards this rather than looking to me to devise the question set as currently suggested. 

The audit isn't being carried out against any recongised standard, just what the auditors feel is relveant (based on my advice!) which is part of what is making me uncomfortable about the whole process.

From talking to them, I get the impression most departments say/do whatever it takes to make them go away. Having someone questioning their approach and intended outcomes seems to have caught them off guard.

I don't currently feel like it's me being audited, but I'll be careful to make this clear to them in my advice. As a team of one there is sometimes to a tendancy to consider that the person is the process, if that makes sense.

Originally Posted by: achrn

I have some minor quibbles with some of what has been said so far, mainly arising from what is meant by 'audit'.

However, the main point (to address the OP questions), is that I don't believe you need to know much at all about H&S to be an internal auditor auditing a company's H&S processes.  None of our internal auditors are H&S professionals (or even notably engaged in H&S in their other workplace duties).  As noted up the thread, these auditors are checking only that the company is doing what the company has said it will do - if it's written in the procedures you do it (or don't do it, if the procedures say don't do x y z), if it's not written it doesn't matter.

I would not expect to spend a great deal of time telling the auditors what to audit or giving them questions to ask - it should be written in the procedures.  If they are completely clueless you might spend some time running through an overview of the systems, but then I'd expect them to decide from that overview what to drill down into and ask to see evidence of.

I don't honestly expect these to be too challenging - I think the H&S people within a company know for themselves already where the company systems are weak and/or where there are failures in complying with them.

One of my quibbles - I would not expect this sort of audit to identify better ways of doing something - this is only about was it done in accordance with the procedures.  (In most systems, identifying the better ways is part of continuous improvement and is identified other than by auditors).  An auditor might, as a result of their digging, notice a possible improvement and raise it, but that would be as part of their role as a general member of staff to suggest improvements, not an auditor function.

The next different variation would be an audit against ISO19001 (or other system) - here the auditor will also be checking that what your preocedures say aligns with what the standard says they should say. In principle internal auditors could do that, but I wouldn't normally expect it (and ours don't).

A slight varation on that would be a client audit where an external auditor checks that what you do and say you do aligns with what the client requires.  This is similar to the ISO audit but will be checking against something defined (or referenced) in the contract docs.  Conceptually it's basically the same, but in my experience contract-specific requirements are less well thought out and break more easily at 'edge cases'.  These things also seem more changeable - clients suddenly add in new requirements (and may or may not give you enough notice to address them) - and more open to the whims or interpretation by the auditor.  These sometimes suggest things that they consider would be an improvement (but fairly often I / we don't agree).  Again in priciple an internal audit could do this, but ours don't.

Finally, we also have audits that are by a H&S professional / expert - we have appointed an external H&S professional organsiation to come into each of our sites annually and do an audit / inspection against statutory and good practice H&S requirements.  These people don't care much at all about our procedures, they are auditing against what they consider H&S systems and arrangements should be doing.  They are much more likely to find something like a missing fire instructions signage or document past its periodic review date.  These might suggest an improvement. These, I think, are the only sort of auditor taht actually needs H&S expertise.

We get all the above.  Actually they are (nearly) all worth the effort (but do come with varying degrees of pain and reward). 

Thanks Achrn,

I agree with what you are saying about the definition of audit. In defence of other respondents, I think my original post may have led them away from thinking about this as a 'traditional' audit by virtue of the auditors asking me to come up with a question set when a review of actions against published policies/procedures would seem more logical.

I think one of my key takeaways from all commenters is the need for me to formalise some of my procedures.

We aren't currently looking at formal accreditation or external audit just yet, but it is something I've highlighted in my continuous improvement plan and may happen at some point in the future.

I'll brace myself for the pain in anticipation of the reward!

My experience of auditors, both internal and external, has been that they have indeed raised "Opportunities for improvement" as well as "Non-conformities" as part of the audit process.  It is perfectly plausible of course that this isn't part of other audit programmes. 

Can I throw the cat amongst the pigeons! If the “Risk and audit committee” really want to  'ensure that the organisation is meeting its H&S obligations as an employer' they either need to get a suitably H&S qualified  external auditor in  or rather than an “audit” they request that you as the H&S person on the ground produce a H&S review which you can  present to them demonstrating how YOU deliver YOUR part of the  H&S process  and what the organisation needs to do in YOUR opinion to move H&S along. Since you are telling the auditors what to look for, why waste time and effort when you can tell them all about it directly with less opportunity for misunderstanding.

Hi Cambridge Fox

Well it seems to be a bit clearer now!

'ensure that the organisation is meeting its H&S obligations as an employer'

If the internal auditors are competent then they shouldn't need to know much about H&S to audit whether you (the organisation, NOT you the individual!) are properly implementing whatever policies and procedures are in place.

That's essentially a tick box exercise.

Procedure 2456 says that there has to be a documented risk assessment for whatever is being done.

So the auditors go out to the shop floor and look at a process and ask to see the documented risk assessment. If that is produced fine, if not there is going to be some variant of non-conformance report.

BUTTTT - just because there is a documented risk assessment shouldn't give the Risk and Audit Committee the comfort it needs that 'the organisation is meeting its H&S obligations as an employer'.

....for the simple reason that the risk assessment might be far from "suitable and sufficient" OR that it might not be adequately executed OR numerous other failings.

So, I think that the RAAC have set inappropriate terms of reference.

They could:

1. Ask YOU to do a gap analysis of the organisation's policy and procedures and implementation of same against legislation to come up with recommendations for improvements.

2. Get in auditors to do something similar, if they want an element of independence, but with a brief to audit with a focus on legislative compliance NOT compliance with the organisation's systems (though there is value in that as well).

Some considerable number of years back we infuriated one of the top bosses in a very large organisation, where part of our brief was to audit against OHSAS 18001, but we had drafted our own project brief as part of our proposal for the job and we had indicated that our primary focus would be on legislative compliance.

We looked at a postholder and their job description. The JD said that the postholder needed a minimum of 5 years working in the sector. They had been brought with a background in an entirely different sector.

This was prima facie evidence of sector-specific legislation and in terms of OHSAS 18001 required a Major Non Conformance Report. 

Said top boss commented that the organisation was deliberately trying to bring in new blood. 

That was fine by us, if the postholder had transferable skills and experience - so the problem was an unnecessarily prescriptive person spec - what it needed to say was NOT 5 years experience in that sector but 5 years experience in one or more sectors with comparable risks.

For exactly the same reasons as why this organisation was trying to bring in new blood, we had put together a team some of whom had little or no experience in the sector - because they would come with open eyes and be immune to the industry custom and practice.

One of our team spotted numerous examples of work at height with no fall protection and asked why. "We've always done it that way." In many other sectors very similar scenarios exist and with fall protection provided (so clearly reasonably practicable) so that was another NCR.

Whether the FAAC were to go for options 1 or 2 makes little difference on one issue. Unless they have an infinite budget they are never going to get an audit report that says (with competent honesty) 'the organisation is meeting its H&S obligations as an employer'.

...as audit is always a sampling exercise that never covers EVERYTHING in sufficient depth to provide an entirely clean bill of health!

So, perhaps what they should be asking for is an audit that seeks to identify issues where there is room for improvement with recommendations for how to do this and a proposed action plan.

If the RAAC want a puppet to give them the clean bill of health, then such a puppet is available but their report will be liable to be ripped to shreds when put to the test if it does not provide a valid assessment from an audit of sufficient depth.

So such a report at best could only provide temporary misplaced comfort to the RAAC - and they should know this!!