All About Operational Audits PDF
All About Operational Audits PDF
In This Article
Mentioning the word audit can conjure up thoughts of financial audits that are often done to assure stakeholders
that financial statements are accurate and complete. However, that’s not the only type of auditing that’s useful to a
business. Organizations of every type — government, universities, hospitals, manufacturers, banks, and others —
need to understand where they are doing well, and where they need to improve to achieve sustainable growth.
Many companies are looking to operational audits to create greater value by improving operational performance
including dimensions of quality, speed, agility, efficiency, environment, customer value, and cost.
This guide will help you understand the basics of operational audit processes with expert insights, checklists,
examples, and 15 downloadable templates to help you start gaining the internal business intelligence needed to
support informed decision making and continuous improvement.
While an audit is usually associated with financial matters, operational audits are more
comprehensive and go beyond financial data (although that type of reporting is often
included). The primary information sources are policies and achievements related to the
objectives of the organization.
Operational audits are a ‘deep dive’ into every facet of management. As a result, start-to-finish
time frames can vary from a few weeks to many months, depending on scope, complexity,
and size of the organization, and whether the audit is for the entire entity or a particular
business unit. Unlike financial audits, which are conducted by external entities, operational
audits are often carried out by an internal auditor.
To clarify the many different moving parts involved in this type of audit, expert and
instructor/mentor Seetharam Kandarpa offers his observations and best practices.
Seetharam Kandarpa (https://www.linkedin.com/in/seetharamkandarpa/?ppe=1), Pharmaceutical GMP
Professional (ASQ-CPGP) and Quality Auditor (ASQ-CQA) is Chief Manager of Quality
Assurance (Corporate) for Abbott Healthcare Pvt. Ltd. in Mumbai, India. Kandarpa has broad
experience in handling regulatory inspections of USFDA, MHRA, WHO, TGA, KFDA, PMDA,
and other agencies. He applies his expertise to quality system elements such as personnel
training, quality risk management, deviation, change control, internal audits, complaints,
recalls, and CAPA. Kandarpa provides coursework, mentorship, and shares his expertise and
information at his website (http://seetharamkandarpa.webnode.in/about-me/?
utm_source=copy&utm_medium=paste&utm_campaign=copypaste&utm_content=https%3A%2F%2Fptop.only.wip.la%3A443%2Fhttp%2Fseetharamkanda
rpa.webnode.in%2Fabout-me%2F).
Products Solutions Pricing Customers Support Resources More
In addition to the information Kandarpa provides in this article, you can review his latest
instructional SlideShare, Auditing Fundamentals (https://www.slideshare.net/ramu9682/asq-cqa-part-1-
auditing-fundamentals).
Part of the objective should also be to maintain quality in the auditing process. “The standards
that apply are defined by ISO 19011 (https://www.smartsheet.com/iso-9000-certifications-and-training), and
that is what I recommend as a best practice,” says Kandarpa. The graphic below covers the
main standard areas that govern audits:
Source: How to ConductProducts
a Quality Internal
Solutions PricingAudit, Seetharam
Customers KandarpaMore
Support Resources
1. Integrity: Withstand pressures that may be exerted and take care to comply with any legal
requirements.
2. Fair Presentation: Present all results fairly and report significant concerns.
3. Due Professional Care: Use diligence, due care, and reasoned judgments in every
situation.
Understanding the true status of operations is the basis for a healthier, more competitive, and
more profitable organization.
Kandarpa says that from an overarching perspective, operational audit programs are valuable
to four entities:
The Organization can achieve its aims by applying disciplined, systematic methods to assess
and advance the effectiveness of control, risk management (https://www.smartsheet.com/enterprise-
risk-management-guide), and governance processes.
The Individual can continuously improve their ability to apply knowledge and skills to
deliver the intended results.
The End User or Consumer receives more cost efficient and high-quality products or
services.
Organizations can expect to achieve five primary goals or main advantages by performing any
operational audit:
Influence Positive Change: Understand how future processes, policies, procedures, and
other types of management are producing maximum effectiveness and efficiency.
Review Internal Controls: Establish the potential impact of successes and failures in the
specialized functional areas of operation.
Understand Risks: The type of risks associated with business and operational risk range
from business interruption, employee omissions or errors, IT system failure, product
failure, safety and health issues, loss of key employees, fraud, loss of suppliers, and
litigation.
Inform Senior Management: The results of the audit should appear in a clear report that
provides objective analysis, appraisals, recommendations, and pertinent comments
concerning the activities reviewed.
Change Management
Change management (https://www.smartsheet.com/essential-guide-everything-change-management)needs to
be well-handled. The results of the audit will likely lead to multiple changes, and team
members and managers may have difficulty adjusting to different expectations, processes,
personnel, or budgets. Change can also affect teamwork, but those issues can be mitigated.
To learn about how to manage and build strong teams who can deal with change, review
Everything You Need to Know About Team Assessments (https://www.smartsheet.com/all-about-team-
assessments).
A helpful tool to help manage change is to use RACI (Responsible, Accountable, Consulted,
Informed) principles to achieve change that may result from an operations audit. Get more
details on how to implement RACI effectively by reading A Comprehensive Project
Management Guide for Everything RACI (https://www.smartsheet.com/comprehensive-project-management-
guide-everything-raci-b), which also includes free templates to help teams cope and flourish during
times of change.
Operational Audits: As noted, operational audits focus on the review and assessment of
single or multiple business processes.
Investigative Audits: When a company suspects a risk of security breach, or when one
has occurred on the part of an individual or department, there is often an investigative
audit to understand causes and additional background information and research.
Compliance Audits: Compliance audits review the level of compliance with external
regulatory requirements or internal policies.
Marketing Audits: A marketing audit is a broad, precise, and autonomous probe into the
marketing of a company or a business. An audit holds both an external situation analysis
and a thorough review of internal marketing goals, strategies, capabilities, processes, and
systems. The result is actionable recommendations to improve progress toward stated
goals.
Follow-Up Audits: After an operational audit report has been issued, it is standard practice
to follow up to evaluate corrective actions, usually within a six month period.
Establishing Objectives: Base objectives on management goals and priorities. Consider
the characteristics of products, projects, processes, and any changes to them. Take into
account management system requirements, contractual and legal requirements, and other
requirements. Evaluate suppliers and the needs and expectations of interested parties,
including customers. Take into account the auditee’s level of performance, risks, previous
audit results, and the maturity of the management system being audited.
Establishing the Audit Program: Identify the responsibilities of the audit program manager
and establish his or her competence of the person. Determine the scope and potential
risks, then set procedures and identify resources.
Implementing the Audit Program: Define the objectives, scope, and criteria, and select
the audit team members and assign responsibility to the audit team leader. Manage the
outcome and records.
Monitoring the Audit Program: Assess conformity with the program, schedule, and
objectives, and then assess the performance of the audit team members and the ability of
the audit teams to implement the plan. Evaluate feedback of all stakeholders. Some
factors can determine the need to modify the program, including audit findings, the
demonstrated level of management system effectiveness, and changes to the auditee’s
management system, standards, and other requirements.
Reviewing and Improving the Audit Program: Evaluate if objectives have been achieved.
Use lessons learned as inputs for continual improvement. The review should consider
results and trends, conformity with procedures, the evolving needs and expectations of
interested parties, records, alternative or new auditing methods, the effectiveness of the
measures to address associated risks, and confidentiality and information security issues
relating to the audit program.
Initiating the Audit: Establish initial contact with the auditee and any designated leaders.
Determine the feasibility of the audit and review the assignment to ensure the objectives
are achievable.
Preparing Audit Activities: Review pertinent documents. Prepare the audit plan, assign
work as needed, and organize necessary action plans and documents.
Conducting Audit Activities: Conduct a meeting to confirm that all parties agree to the
proposed plan. Introduce team members to management and each other. Double check
that you can perform the audit actions defined in the plan as intended. Review documents
as needed throughout the process. The team should regularly meet to review and
exchange information, assess progress, and reassign work if necessary.
Collecting and Verifying Information: After you receive the audit documents, review the
information sources. Audit the evidence and evaluate it against the audit criteria. Review
conclusions.
Products Solutions Pricing Customers Support Resources More
Generating Audit Findings: The findings will conform or not conform with audit criteria. For
a non-conforming finding, record the supporting evidence. Review the information with the
auditee to ascertain if the evidence is correct. The team should meet to review findings at
designated and/or appropriate audit stages.
Conducting the Audit Activities: Before the closing meeting to review findings, the audit
team should confer and collect information against objectives. The team should agree on
conclusions, prepare recommendations, and discuss follow-up. Have a closing meeting
facilitated by the team leader to present the findings and conclusions.
Preparing and Distributing the Audit Report: The team leader reports the results with a
complete, accurate, concise, and clear audit record, and delivers it within the agreed
period. In case of a delay, auditee and program manager should discuss why it happened.
The report must be dated, reviewed, and approved based on agreed upon procedures.
Distribute the report as defined in the plan to the appropriate recipients.
Completing the Audit: Work is complete when all planned audit activities are
accomplished. Documents are kept or destroyed based on the procedures and applicable
requirements set at the beginning of the audit. If disclosure is necessary, inform the audit
client and auditee as soon as possible. Add lessons learned from the audit to the
continual improvement process.
State Operational Audit Plan Example - Indiana Office of Management & Budget: Deloitte
& Touche performed an audit for the for the Indiana Department of Revenue for its
oversight agencies in 2012. You can review the full results in its Controls and Performance
Audit.
Hospital Operational Audit Plan Document Example - University of Texas (UT): The Office
of Internal Audit for UTHealth North conducted a risk-based audit which reviewed
equipment leases, acquisitions, maintenance, and warranties. You can examine the full
27-page document at Capital Equipment Operational Audit.
Public Facilities - The Port of Seattle: Airport public parking operation management
controls were reviewed to ensure that transactions were handled correctly in the Seattle-
Tacoma International Airport garage and to ensure facilities were well-managed. Examine
The Internal Audit Report: Comprehensive Operational Audit Airport Public Parking
Operation to see the results.
Credit Union - Sample Credit Union Report on Operations: This is a reporting template
credit unions follow to comply with National Credit Union Administration (NCUA) standards
for operations and management review. Examine the 22-page format in Sample Credit
Union Report on Operations.
Manufacturing - Factory Audit Report (Asia): Asian Inspection provides the means for its
customers to conduct operational audits. The format for a report includes workflow charts,
system management, labor, hygiene and social responsibility sections. View the 33-page
Factory Audit Report.
Products Solutions Pricing Customers Support Resources More
Create a Company Goal Tracker in Smartsheet
Change Management Process Template
Audits often signal the need for changes in the way you operate some -
or all - parts of your business. When it’s time to make organizational
changes, complete this template to follow your change management
procedures, from creating change request flows to reporting. Include
this flow chart for a visual representation of the process in your change
management plan. Breaking down each step provides clarity and an
easy reference for everyone involved.
Products Solutions Pricing Customers Support Resources More
Download Change Management Process Template
Word (https://www.smartsheet.com/file/ic-change-management-process-9024worddotx) | PDF
(https://www.smartsheet.com/file/ic-change-management-process-9024pdfpdf)
Discover why millions of professionals around the world use Smartsheet to work better.