Internal Audit and Management Review

Internal Audit and Management Review 

********** 

In many organizations, internal audits or management reviews are conducted only shortly before the certification auditors arrive, so that the organization can avoid a nonconformity for not having performed an internal audit or management review. This is a common but incorrect practice.

Many organizations treat internal audits and management reviews merely as a formality to be completed just before the certification auditors arrive, in order to avoid a nonconformity. While this may satisfy the minimum requirement of the standard, it defeats the real purpose of the management system.

What does the standard say?

ISO 9001 (and other management system standards such as ISO 14001, ISO 45001, ISO 27001, and ISO 30201) require internal audits (Clause 9.2) and management reviews (Clause 9.3) to be conducted at “planned intervals.” No fixed frequency is prescribed in the standard; however:

- The audit programme must be established taking into consideration the importance of the processes, the results of previous audits, and changes.

- The entire system must be covered within one cycle (normally one year).

- The management review must consider the required inputs (such as audit results, customer satisfaction, process performance, risks and opportunities, etc.) and shall result in concrete decisions and actions. 

Conducting the internal audit and management review only a few weeks before the external audit does not fulfil the spirit of “planned intervals” or the expectation of an effective system.

Disadvantages of this approach

- Loss of opportunity for continual improvement: Problems remain undetected throughout the year and surface only during the external audit.

- Insufficient time: There is not enough time to close findings, carry out root cause analysis, and verify the effectiveness of actions.

- Superficial audits: Audits and reviews conducted in haste are often formal in nature and add little real value.

- Perception of the certification body: Experienced auditors can easily recognize that all activities were performed only just before their visit. This raises questions about the maturity of the system.

Better approach 

It is in the organization’s interest to: 

1. Establish a year-round audit programme. Audit important or high-risk processes more frequently.

2. Conduct management reviews on a quarterly or half-yearly basis (or at least annually, with effective monitoring in between). Do not turn it into a mere data dump — ensure decisions are taken and resources are allocated.

3. Complete the final internal audit 6–8 weeks before the external audit, so that any nonconformities identified can be closed in time.

4. Treat the internal audit not as a “tool for finding nonconformities,” but as a “tool for improvement and verification of effectiveness.”

Conclusion

Internal audits and management reviews are not meant for certification; they exist for the continual improvement and risk management of the organization. Only when they are conducted regularly and sincerely does the organization derive real benefits — better processes, fewer problems, and a stronger system.

Organizations should avoid the situation described above and should continue to conduct internal audits and management reviews at regular intervals. This is in the organization’s own interest.

Regards,  

Keshav Ram Singhal