How to Run an Internal Audit Programme That Finds Real Issues

Internal audits often become checklist exercises that miss the things that matter. Here is how to redesign yours so it actually drives improvement.

If your internal audit programme is closing every audit with one or two minor findings, the programme is not working — it is performing.

Why most internal audit programmes underperform

Auditors audit their own departments or report into the people they audit.
The same checklist is reused every cycle, so blind spots stay blind.
Findings are downgraded to keep relationships smooth.
There is no link between internal audit results and management review.

A redesign that works

Independence. Auditors must report findings to a level above the audited area. In smaller sites we recommend cross-functional pairings (production audits quality, quality audits engineering, etc.) with QA Manager sign-off.

Risk-based scheduling. Audit frequency and depth should reflect risk, not the calendar. A high-risk allergen line might be audited four times a year; a low-risk packaging store once.

Vertical and horizontal slices. Mix process audits (a single clause across all areas) with vertical audits (one product traced from receipt to dispatch). Vertical audits expose the cross-functional gaps that process audits miss.

Competence. Internal auditors need refresher training every two years and at least one shadowed audit per year. Without it, audits drift into compliance theatre.

Measuring whether your programme is working

Track the ratio of internal-audit findings to external-audit findings. A healthy programme finds 5–10x more issues internally than the certification body finds externally. If the ratio is the other way around, the programme needs a redesign.