2. WHAT IS AUDIT ?
• An audit is a systematic review of an organization's
operations, processes, and internal controls,
conducted by employees within the organization
against a set of requirements.
3. PURPOSE OF AN INTERNAL AUDIT
•Internal audits focus on measuring current
performance and finding areas for
improvement.
4. BENEFITS OF AUDITING
• Assure GMP, GHP and other applicable standards Compliance
• Detect Potential Problems
• Increased management awareness.
• Reduce Risk of failure
• Identifies improvement opportunities.
6. PRINCIPLES OF AUDITING: AUDITING IS CHARACTERIZED BY A NUMBER OF PRINCIPLES
A) Integrity: the foundation of professionalism Auditors and the
individual(s) managing an audit programme should:
— perform their work ethically, with honesty and responsibility;
— only undertake audit activities if competent to do so;
— perform their work in an impartial manner, i.e. remain fair and unbiased
in all their dealings;
— be sensitive to any influences that may be exerted on their judgement while
carrying out an audit.
7. b) Fair presentation:
Audit findings, audit conclusions and audit reports should reflect
truthfully and accurately the audit activities. Significant obstacles
encountered during the audit and unresolved diverging
c) Due professional care:
Auditors should exercise due care in accordance with the
importance of the task in carrying out their work with due
professional care is having the ability to make reasoned judgements in
all audit situations
8. • d) Confidentiality:
Auditors should exercise discretion in the use and protection of information acquired in
the course of their duties. Audit information should not be used inappropriately
for personal gain by the auditor or the audit client
• e) Independence:
Auditors should be independent of the activity being audited wherever practicable, and
should in all cases act in a manner that is free from bias and conflict of interest. For
internal audits, auditors should be independent from the function being audited if
practicable. Auditors should maintain objectivity throughout the audit process to
ensure that the audit findings and conclusions are based only on the audit evidence
9. f) Evidence-based approach:
Audit evidence should be verifiable. It should in general be based on
samples of the information available, since an audit is conducted
during a finite period of time and with finite resources. An
appropriate use of sampling should be applied
g) Risk-based approach:
The risk-based approach should substantively influence the planning,
conducting and reporting of audits in order to ensure that audits are
focused on matters that are significant for the audit client, and for
achieving the audit programme objectives.
10. MANAGING AN AUDIT PROGRAMME
• An audit programme should be established which can include audits addressing one or more
management system standards or other requirements, conducted either separately or in combination
In order to understand the context of the auditee, the audit programme should take into account the
auditee’s:
— organizational objectives;
— relevant external and internal issues;
— the needs and expectations of relevant interested parties;
•— information security and confidentiality requirements.
Competent individuals should be assigned to manage the
audit programme.
11. CONDUCTING AN AUDIT/ INITIATING AUDIT
• The responsibility for conducting the audit should remain with the assigned audit
team leader until the audit is completed including :
• Confirm communication channels with the auditee’s representatives,
• Confirm the authority to conduct the audit
• Provide relevant information on the audit objectives, scope, criteria, methods and
audit team composition
• Make arrangements for the audit including the schedule;
12. • During the audit, the audit team leader should periodically communicate the progress, any
significant findings and any concerns to the auditee as appropriate.
• Evidence collected during the audit that suggests an immediate and significant risk should be
reported without delay to the auditee. as appropriate, to the audit client.Any concern about an
issue outside the audit scope should be noted and reported to the audit team leader, for possible
communication to the audit client and auditee.
• If adequate documented information cannot be provided within the time frame given in the audit
plan, the audit team leader should inform both the individual(s) managing the audit
programme and the auditee. Depending on the audit objectives and scope, a decision should be
made as to whether the audit should be continued or suspended until documented information
concerns are resolved.
13. GENERATING AUDIT FINDINGS
• Audit findings can indicate conformity or nonconformity with audit criteria,
Nonconformities and their supporting audit evidence should be recorded.
• Nonconformities can be graded depending on the context of the organization
and its risks. This grading can be quantitative (e.g. 1 to 5) and qualitative (e.g. Critical,
minor, major). They should be reviewed with the auditee in order to obtain
acknowledgement that the audit evidence is accurate and that the nonconformities are
understood.Also Unresolved issues should be recorded in the audit report.
14. PREPARING AND DISTRIBUTING AUDIT REPORT
• The audit report should provide a complete, accurate, concise
and clear record of the audit, and should include or refer to the
following:
• audit objectives;
• audit scope, particularly identification of the
organization(the;
• identification of the audit client;
15. • identification of audit team and auditee’s participants in the
audit;
• dates and locations where the audit activities were conducted;
• audit findings and related evidence;
• audit conclusions;
• any unresolved diverging opinions between the audit team
and the auditee;
• confirmation that the audit objectives have been achieved
within the audit scope in accordance with the audit plan;
16. DETERMINING AUDITOR COMPETENCE
In deciding the necessary competence for an audit, an auditor’s knowledge and skills related to the following should be considered:
a) the size, nature, complexity, products, services and processes of auditees;
b) the methods for auditing;
c) the management system disciplines to be audited;
d) the complexity and processes of the management system to be audited;
e) the types and levels of risks and opportunities addressed by the management system;
f) the objectives and extent of the audit programme;
g) the uncertainty in achieving audit objectives;
h) other requirements, such as those imposed by the management or other relevant interested parties, where
appropriate
17. PERSONAL BEHAVIOR OF THE INTERNAL AUDITOR:
• Auditors should possess the necessary attributes to enable them to act in accordance with the principles of
auditing
a) ethical, i.e. fair, truthful, sincere, honest and discreet;
b) open-minded, i.e. willing to consider alternative ideas or points of view;
c) diplomatic, i.e. tactful in dealing with individuals;
d) observant, i.e. actively observing physical surroundings and activities;
e) perceptive, i.e. aware of and able to understand situations;
f) versatile, i.e. able to readily adapt to different situations;
•
g) tenacious, i.e. persistent and focused on achieving objectives;
h) decisive, i.e. able to reach timely conclusions based on logical reasoning and analysis;
18. h) decisive, i.e. able to reach timely conclusions based on logical reasoning and analysis;
i) self-reliant, i.e. able to act and function independently while interacting effectively with others;
j) able to act with fortitude, i.e. able to act responsibly and ethically, even though these actions may not
always be popular and may sometimes result in disagreement or confrontation;
k) open to improvement, i.e. willing to learn from situations;
l) culturally sensitive, i.e. observant and respectful to the culture of the auditee;
• m) collaborative, i.e. effectively interacting with others, including audit team members and the
auditee’s personnel.
19. KNOWLEDGE AND SKILLS FOR INTERNAL AUDITOR
• management system requirements and principles, and their application
• fundamentals of the discipline(s) and sector(s) related to the management systems standards as applied by the
auditee
• statutory and regulatory requirements and their governing agencies
• basic legal terminology
• contracting and liability
• successfully completing training programmes that cover generic auditor knowledge and skills;
• experience in a relevant technical, managerial or professional position involving the exercise of judgement,
decision making, problem solving and communication with managers, professionals, peers, customers and other
relevant interested parties
