Internal audit is the clause external auditors probe hardest, and the one SMEs most often treat as a formality. Done as paperwork, it wastes a week a year. Done properly, it is the single most useful management tool in a quality system, because it is the only mechanism that systematically compares what you say you do with what you do.

Plan by Risk, Not by Rotation

A programme that audits every clause equally every year spends most of its effort on areas that never fail. Weight the plan towards processes with customer impact, recent non-conformities, new staff, changed equipment or known complaints. Record the reasoning — an auditor will ask why the programme looks as it does.

Audit the Process, Not the Document

Reading a procedure back to its author proves nothing. Follow a real job through the process. Ask the operator to show you the record. Trace one order from receipt to despatch and see whether the evidence exists at every control point. Findings that come from evidence are the ones that produce change.

What a Competent Internal Audit Produces

Independence in a Small Company

Nobody should audit their own work, which is awkward when the department is three people. The usual solutions are cross-auditing between functions, training a second internal auditor outside the area, or engaging an external party to run the programme. Any of the three satisfies the standard; none of them requires a large team.

Close the Loop, or the Audit Was Theatre

The failure we see most often is a corrective action recorded, dated and never verified. Closure requires evidence that the cause was addressed and that the problem has not returned — checked at a later date and signed off. Without that step, the same non-conformity reappears at the next external audit, and the auditor will note that your system did not catch it.

An internal audit programme that finds real problems is a sign of health, not weakness. A programme that finds nothing, year after year, tells an experienced auditor exactly what has been happening.