Internal Audit with in-house personnel

I recently joined a facility that will be having their certification audit in a few months. A bit of background: I had already worked a few years ago at this facility and the programs were written by me, the site has just followed what I created for these years.

We still need to do the internal audit and management/policy reviews. We are considering doing the internal audit in house (I have a certificate of training for this). My concern is that I joined as the person in charge of the department and would take over the SQF practitioner role. I plan to train someone else to do the internal audit with me (I would be auditing the current SQF practitioner, who will become my backup), but I would still be the lead/main auditor. We are not so small (over 200-300 employees).

In the past, we have hired a consultant to do the internal audit but had always wanted to transition to doing them in house. I am concerned that it will still be considered as 'auditing my own work' since it is the same department, even if someone else is auditing along with me. We prefer to do our internal audit as a 1 week long audit instead of spreading it out, it just works best this way for us and is written in the procedure this way as well.

Note: the current SQF practitioner would be working on the management review/annual reassessment before the internal audit takes place.

Any suggestions or examples are appreciated

The standard yearly management review should be done by those in upper management including the SQFP and backup.

As a long time consultant while I have been asked to do entire internals I have always turned this work down, because it is supposed to be handled INTERNALLY.  I have sat in on a review but never did one by myself as I found this to be wrong as personnel at a facility need to take that ownership.

So your internal review would be multi layered and not just you doing the review thus you avoid being the only one reviewing your own work. 

The standard yearly management review should be done by those in upper management including the SQFP and backup.

 

As a long time consultant while I have been asked to do entire internals I have always turned this work down, because it is supposed to be handled INTERNALLY.  I have sat in on a review but never did one by myself as I found this to be wrong as personnel at a facility need to take that ownership.

 

So your internal review would be multi layered and not just you doing the review thus you avoid being the only one reviewing your own work. 

Thank you for your response. For the management review it is strictly internal. In the past, the SQF practitioner does a preliminary review and then presents it to management to review as well.

The internal audit was previously done with a consultant and now we are looking for the best format to do it internally. In all honesty, it would be myself (QA director) and another person(different department) auditing the system. I have been previously asked to do it myself since I am not technically auditing my own work (I was not employed here until a couple weeks ago).

I personally think that the senior management should be driving the management review.   However, I totally understand why you do it that way.   

I personally think that your dual auditor approach is fine.   It would make it much harder to say that you were auditing your own work.  I could see an auditor raising a question if you were auditing a procedure that you wrote several years ago even if you left for some period of time.    

I do think it is good to have a consultant look at your program from time to time.   With the goal being finding as much as possible.   companies are often shocked at the discrepancy identified.   Sometimes your insurance carrier will cover this cost or even arrange these for you.

Hi MMQA,

It sounds to me like you should be developing an internal audit team for this. With a site of over 200 employees I would expect to see 5 plus internal auditors. You can then manage the internal audit program and join some audits to ensure consistency and competence. This would free up your time for the “Bigger Fish” that I’m sure that you have got to fry.

Personally, I prefer to conduct internal audits throughout the year or at least quarterly. If there are issues then this means you have time to take corrective actions and revisit. SQF doesn't require this but to me it makes sense.

I would conduct your internal audits before your management review as the results of internal audits should be reviewed during management review:

SQF Food Safety Code: Food Manufacturing, Edition 9 2.1.2 Management Review (Mandatory)

2.1.2.1 The SQF System shall be reviewed by senior site management at least annually and include:

……..

iv. Corrective and preventative actions and trends in findings from internal and external audits, customer complaints, and verification and validation activities;

Also note the Senior Site Management Team should be conducting the Management Review, although it is fine for the SQF Practitioner and yourself to be involved and to prepare the necessary information for review.

Kind regards,

Tony

I'd agree with TonyC that a company of your size should probably have a team of internal auditors! Your facility is likely large enough that doing the entire internal audit in a couple days is just going to be too much. You'll get a more insightful review if you split your audit up throughout the year. Personally I do a small section every 45 days. With a team dedicated to the internal audit, there is less of a concern about "auditing your own work", especially if the team comes from both QA and operations.

I have always run IA over the entire year, so every element is audited on a schedule

Training other department leads is helpful and is a fairly straightforward process, and the benefits of having other departments involved pays dividends and they look at process' differently 

Cramming it into 5 days (IMHO) renders it useless as you really can't give each element the amount of time it may/should have

I'm at a BRC location currently, but when I was at an SQF facility (100-150 personnel), I had the internal audits broken up into sections of the code and followed something like this:

1. Assign managers from different areas in teams of 2 to audit 1 section within a certain month. Include list of relevant documents they should use in their audit as well as emphasizing what clauses they should pay attention to when walking through the facility. 
2. Results would be reviewed at the next month's senior management meeting. Corrective actions would be determined at this meeting as well.
3. Review the policies & procedures for that section, which is when changes to those documents would occur as needed.
4. Senior management approval of revised policy/procedure. 
5. Upload revised policies & procedures to shared drive/intranet.
6. Training relevant personnel on any revisions to policy/procedures.

I trained all involved managers on how to conduct internal audits and did annual refresher training where I also went over what NC's we had from previous SQF re-certification audits and other areas to focus on based on our quarterly GMP inspection results, as well. It was a lot of prep work to start with, but it got much more consistent results for our internal audits, in terms of quality/effectiveness. When I had started there, the internal audits against SQF code were done by a single person, which was not effective at all.

Now I'm at a much smaller facility (20-30 personnel) and our internal audit team and senior management team are myself and my boss. But thankfully our auditors have been rather understanding of how difficult adhering to parts of the code can be when it's a very small site.