How to Run Internal Audits That Add Value

If your internal audit only produces a checklist, a few minor findings and a folder no one reopens, it is not doing its job. Businesses usually feel the cost of that later - in a certification audit, a client prequalification review, a WHS incident, or a tender process where weak system evidence gets exposed. Knowing how to run internal audits properly means treating them as a management tool, not an admin exercise.

For Australian businesses working under ISO 9001, ISO 45001 or ISO 14001, internal audits are meant to test whether the system is actually working in operations. That means checking more than whether a procedure exists. You need to know whether people follow it, whether it suits the work being done, and whether it controls the risks it was designed to manage.

What internal audits are really for

An internal audit is not there to catch people out. It is there to test the health of the management system against planned arrangements, standard requirements and the reality of day-to-day operations. In practical terms, that means asking three straightforward questions: is the process defined, is it being followed, and is it effective?

That distinction matters. A business can have excellent-looking documentation and still fail an audit because controls are not implemented on site. Equally, a team may be doing the work well but relying on tribal knowledge rather than documented processes, which creates risk when staff change, work expands or a regulator asks for evidence.

A good internal audit closes that gap between paperwork and practice. It helps directors and managers see whether compliance controls are holding, whether operational drift is setting in, and where corrective action should be focused before the issue becomes more expensive.

How to run internal audits without turning them into paperwork

The most effective audits start well before the audit day. They begin with scope, risk and purpose. If you are auditing every department the same way, at the same depth, every time, you are probably wasting effort.

Start by deciding what needs to be audited, why, and how often. A low-risk administrative process may only need periodic review. A high-risk operational area, contractor management process or legal compliance process may justify more frequent and deeper auditing. Your program should reflect business risk, recent incidents, customer requirements, certification needs and known weak points in the system.

Once scope is clear, define audit criteria. That usually includes relevant ISO clauses, internal procedures, legal obligations, client requirements and any site-specific controls. Without clear criteria, findings become subjective and difficult to act on.

Preparation also means reviewing key documents before you speak to anyone. Look at previous audit findings, corrective actions, incident trends, KPIs, training records, risk assessments, inspection reports and management review outputs. This gives the audit direction. It also helps you avoid the common mistake of asking broad, unfocused questions that generate opinions rather than evidence.

Build an audit plan around risk and process flow

A practical audit plan follows the actual flow of work. If you are auditing procurement, start with supplier approval, then onboarding, then purchase controls, then delivery verification and performance review. If you are auditing WHS consultation, follow the process from hazard reporting through risk assessment, control implementation and review.

That approach tells you much more than auditing documents in isolation. It also makes interviews more useful because staff can explain the process in context rather than trying to recite a procedure.

In higher-risk sectors, site verification matters. You cannot meaningfully audit plant controls, contractor induction, hazardous chemical management or emergency readiness from a desk alone. Documentation may say one thing. The work area often tells the real story.

What to check during the audit

Evidence is the centre of a credible internal audit. You are looking for objective evidence that the system is implemented and effective. That usually comes from a combination of document review, interviews, records sampling and observation.

Interview process owners and workers in plain language. Ask them to explain what they do, when they do it, what records they keep and what happens when something goes wrong. Then test that against procedures and actual records. If a supervisor says pre-starts are completed daily, sample recent pre-start records. If a procedure says supplier evaluations occur annually, check whether they actually happened and whether poor performers were acted on.

Sampling is important, but it needs judgement. Too small a sample gives false comfort. Too large a sample turns the audit into a resource drain. The right sample size depends on process risk, volume, history and consequences of failure. A business dealing with high-risk contractors, environmental controls or critical customer specifications should audit more deeply than one reviewing a low-risk office process.

Look for effectiveness, not just conformity

This is where many internal audits fall short. They confirm that forms exist and boxes are ticked, but they do not test whether the control is working.

Take training as an example. It is easy to verify that induction records exist. The harder and more useful question is whether the training is appropriate, current and reflected in work practices. The same applies to risk assessments, maintenance schedules, incident investigations and corrective actions. A process can be technically compliant on paper and still ineffective in operation.

That is why good auditors follow the evidence trail. If there has been a recurring hazard, did previous corrective actions address root cause? If not, the issue is bigger than one missed action. It points to a weakness in the corrective action process itself.

Writing findings that people can actually use

Poorly written findings create argument, delay and weak close-out. Strong findings are factual, specific and tied to criteria. They describe what requirement applied, what evidence was reviewed, what was found and why it matters.

Avoid vague statements such as staff were not aware of procedure requirements. State the exact issue instead. For example, if two sampled subcontractor files lacked evidence of licence verification required by the contractor management procedure, say that. Clear findings are easier to accept, easier to correct and easier to track.

It also helps to separate findings by significance. Not every issue is a major nonconformance, but not every issue should be dismissed as an observation either. The test is risk and impact. If the issue affects legal compliance, worker safety, environmental control, customer requirements or certification integrity, escalation may be warranted.

A useful audit report does more than list defects. It identifies strengths, recurring themes and system-level concerns. Management needs to see patterns, not just isolated errors.

Corrective action is where value is won or lost

An internal audit only adds value if findings lead to effective action. That means more than assigning tasks and due dates. The business needs to understand why the issue occurred and what change will prevent recurrence.

Sometimes the answer is retraining. Often it is not. Repeated audit findings usually point to a deeper problem such as unclear ownership, unrealistic procedures, weak supervision, poor record control or a process that does not fit operational reality.

Corrective actions should match the nature of the failure. If a SWMS is not being used in the field, the solution may involve revising the document format, improving supervisor accountability and changing how work is planned - not simply telling workers to comply. If supplier monitoring is inconsistent, the issue may sit with process design, procurement resourcing or unclear approval thresholds.

Close-out should include verification of effectiveness. Otherwise, actions become another paper trail. Check whether the fix was implemented, whether it changed behaviour and whether the issue has stayed closed over time.

Common mistakes when learning how to run internal audits

The biggest mistake is treating internal audits as a certification rehearsal rather than a business control. Certification matters, but the audit program should first help the business manage risk, improve process discipline and protect commercial credibility.

Another common problem is using auditors who know the standard but not the operation. Technical knowledge matters, but so does practical understanding of how work is actually performed. An audit that ignores operational context often produces findings that are technically correct but commercially unhelpful.

Independence also needs judgement. Auditors should not audit their own work, but in smaller businesses complete separation is not always possible. In those cases, use compensating controls such as cross-functional auditing, external support or stronger review of findings.

Finally, avoid over-auditing. More audits do not automatically mean better assurance. If the process is immature, focus on the areas that matter most and do them well. A targeted, evidence-based audit program will outperform a bloated schedule that nobody respects.

For businesses preparing for certification, managing contractor risk or strengthening tender readiness, internal audits should give leadership confidence that the system stands up in practice. That is the standard worth aiming for - an audit process that tells you the truth early enough to do something useful with it.