Internal audits, findings, and the audit program

Open: Audits. Typical leads: Internal Auditor and Quality Manager. Purpose: plan the audit program, conduct audits against it, retain findings and their verification, and show what the program delivered.

Plan the audit program

Open: Audits > Program and coverage. One program covers one period.

1. Under Plan a program, enter the Period name, Starts and Ends dates, Coverage (which processes, areas and shifts), Frequency rationale (why this often), Risk basis (process status and importance, customer impact, prior findings), and the Owner.
2. Choose Create program. Norma assigns an APG reference and the program starts as Draft.
3. When it is agreed, choose Approve program. Norma records who approved it and when. Only an approved program can take audits.
4. At the end of the period, choose Close program. A program with audits still planned or under way cannot close until they are closed, cancelled, or deferred.

An approved program is not edited; plan a new program for the next period. The program page lists each audit on it with its state and reason.

Schedule and start

1. Under Schedule audit, enter Title, Scope, Criteria, and Planned date.
2. Choose the Auditor. This organization lists your people; Outside auditors (consultant keys) lists consultants holding a live key, with their practice.
3. Choose the Process owner of the audited process, or leave it Not named. The owner cannot be the auditor.
4. Choose the Program, or Not on a program for an audit outside the plan, such as a customer escalation. On a program, the planned date must fall inside its period.
5. Choose Schedule audit. Norma assigns an AUD reference.
6. When the audit begins, choose Start audit. It moves to In progress.

If the auditor owns the process, or is a consultant who would be auditing their own work, the audit is refused unless you write an Independence exception (optional): why the audit can still be relied on, and who reviews it, in at least 20 characters. A consultant needs the exception when they hold a Build key or wrote or approved a controlled document in your organization; the Auditor list marks them (needs an independence exception). The exception is shown on the audit and its report. An Audit Room grant is never accepted as an internal auditor.

Start audit takes a Plan snapshot: the criteria as written, the standard editions adopted that day, each clause the criteria name with its title, any clause number no adopted edition carries, the findings other audits had open, and the auditor, process owner, exception, and program. Later edits to the criteria or a revised standard do not change it. Audits started before 1.5.0 say no snapshot was taken.

Record findings

While the audit is In progress, record what you examined under Evidence samples: What was sampled (a purchase order, a training record, a part), its Identifier, optionally Examined on, What was found (Conforming, Nonconforming, or Not applicable), and an Observation, required when the sample is nonconforming. Choose Record sample. Samples belong to the audit, so an audit that found nothing still shows what its conclusion rests on.

Use Record finding with Classification (Major, Minor, Observation, or OFI), Clause reference, Statement — the requirement it falls short of, and how — and Objective evidence — what was seen — which record, which sample, which date. Samples no finding has claimed yet are listed under Evidence samples this finding rests on; tick the ones this finding rests on and leave the evidence box empty to have the sentence written from exactly those rows, or write your own. A sample can be cited by one finding only.

Raise a CAPA from a finding with Raise CAPA when corrective action is needed. The link is retained on the audit and CAPA histories.

A Major or Minor finding is a nonconformity and closes only after follow-up verification. When you have gone back and checked the fix, enter what was checked and what was seen and choose Record verification; Norma records who verified it and when. Only then does Close finding appear, with its closure note. An Observation or OFI closes on its closure note alone. Findings recorded before 1.5.0 close on a note as before. A finding may be closed after the audit itself is closed; it has its own follow-up life.

Close the audit

An audit must be started before it can be closed. Enter the Report summary that identifies what was covered, the conclusion, and outstanding matters, and choose Close audit. While findings remain open the lifecycle rail lists No finding left open as unmet; the audit can nevertheless be closed with findings open, and the closure records how many were open. Those findings still require verification and closure; after the audit closes, the header offers Close open findings.

The controlled Close with no findings option, where shown, requires an In progress audit, no still-open finding, and a written note. Do not use the wording to disguise unresolved findings. A permitted reopen requires a reason and retains the earlier closure in history.

When an audit does not go ahead

An audit that will not run should say so rather than stay Planned and read as overdue. On a Planned audit, open Not going ahead? and choose the Outcome:

• Deferred to a new date: enter the New planned date (deferral only). The audit still counts in the period it was originally planned for; the new date applies when you start it.
• Cancelled: it is not happening.
• Not applicable: the process is out of scope or gone.

Enter a Reason of at least ten characters and choose Record outcome. The reason appears on the audit, the chain, the coverage report, and the register export. An audit with open findings cannot be set aside until they are closed.

Use the audit evidence

Open the audit's Activity and Record chain to show planning, start, findings, verification, CAPA links, and closure. Reports > Audit program coverage counts the audits planned in the period as Planned, Completed, Overdue, Cancelled, Deferred, and Not applicable, and each figure opens exactly those audits. Overdue means Planned or In progress past its planned date. Use Audit finding closure and the register to identify open findings. Open the coverage report before a management review or a surveillance audit.

The Internal Auditor functional role supports the audit program; it is different from a read-only external auditor's Audit Room. It does not by itself grant document approval, NC disposition, or CAPA effectiveness closure. Combining roles can broaden a person's authority, so preserve the independence required by your own audit procedure when making assignments.

Tip: Write findings so the CAPA can be raised from them without a second conversation: the criterion, the evidence you saw, and the gap between them, each as its own sentence. "WI-2208 Rev E requires an in-process bore check every 10 pieces; job 4590's inspection entries show none between piece 1 and piece 40" is a finding. "Inspection not followed" is not.

Completion check: the audit sits on an approved program or is deliberately off one; the audit summary is retained; each major or minor finding is verified before it closes; outstanding work has an owner through the appropriate follow-up records; audits that did not run carry their outcome and reason; and the audit closure is not being mistaken for closure of every finding.

In the user guide

This article is chapter 26, "Audits and Findings", of the NormaQMS User Guide (NORMA-UG-001), which is under Help > User guide. Chapter numbers in the text refer to that guide.