Internal audit software: evidence, findings and closure review

What an audit programme adds to a checklist

A checklist records what one person saw on one day. A programme decides which parts of the management system are examined, how often, by whom, and what happens to the result. HSE's management guidance, HSG65, warns that paperwork alone is a poor measure of performance and ties the frequency of a review to the organisation's risk profile. The software should hold the programme as a versioned record: the scope of each audit, the reason a frequency was chosen and a dated history of changes, so a later reader can see why one area moved from yearly to quarterly checks.

Some intervals are fixed from outside. For the processes it covers, OSHA's process safety standard requires the employer to certify an evaluation at least every three years. For other audits the interval is your own decision. Ask the vendor for a schedule that combines an external outer limit with a shorter, risk-driven interval.

Who audits: competence and independence

HSE's guidance on who carries out a review says that someone independent, perhaps from another business area, can add value, and that reviewers need the training, experience and judgement for the task. The HSE leadership page adds that boards should keep auditors' independence and objectivity under review. OSHA's audit rule asks for a different quality: at least one person who knows the process. The two can pull apart, so what matters is a record of who was assigned and why.

In software that means a competence record for each auditor, linked to the audit types they may cover; an assignment step that compares the auditor's own department with the audit scope and warns or blocks; and a log of any override that names the approver. A free-text auditor field supports none of these.

The Internal Audit Workflow

Sampling and evidence

Auditors examine samples, not whole populations, so the sample has to be reconstructable. This is editorial practice rather than a requirement of the sources listed below. Keep the population examined (for example, every weld record raised in a quarter), the way the sample was drawn, each item looked at and its result, including the items that conformed. A finding can then point to a record identifier, revision, photograph or interview note instead of a sentence of free text.

HSG65 lists inspection reports, investigation reports, training records and risk assessments among the information a review should draw on, so evidence often lives in other modules. Check that an audit item can link to those records and keep the revision the auditor saw on the day, even if the record changes later.

Grading findings and verifying closure

The grading scale is yours to define. Common schemes separate a nonconformity from an observation or opportunity, and some split major from minor. The software should let you name the grades and say what each triggers: a corrective action, a response deadline or a review. A grade needs rules, and a change to it needs a trace of who made it and why.

A finding reaches closure through two decisions. OSHA's audit rule asks the employer to determine and document a response to each finding promptly and to document that deficiencies have been corrected, and its program evaluation guidance asks for prompt action that corrects the problem and prevents recurrence. HSE's guidance adds that you have to make sure the measures work. A tick from the action owner records the first decision only. Verification is a second record, made by someone else once the fix has had time to show a result.

Connection to NCR, CAPA & Management Review

Ask each vendor which findings become quality events and which stay as audit actions, and who is responsible once a record moves. Where records pass between applications, check that the link and the reviewer's responsibility survive. A one-off file export is not a configured integration.

For management review, HSG65 expects a report to senior leaders at least annually and describes review as the step that closes the loop, because its outcomes become the next plan. OSHA's evaluation guidance says to review audit results to confirm that shortcomings are being found, and the process safety rule requires the two most recent audit reports to be kept. A useful programme summary compares planned with completed audits, counts findings by grade and age, flags repeats and lists overdue verifications for a chosen period. The management review guide covers the meeting itself.

What the software must hold at each step

Worked example (fictional): welding records at Marlowe Coachworks

Trace the sampled evidence

The exercises in this guide are proposals for a demonstration, not outcomes from testing performed for it. Bring a representative record, a deliberate error and the user roles you need. Write down what was shown, the configuration used and what is still open.

Ask to see permissions, earlier values and the export you would use on leaving. Check whether the quote covers outside contributors, reviewers, API use, data migration, validation support and training. A listed connection or published API is not evidence that a customer has completed an integration.

What the sourced profiles document

The researched profiles describe audit scope in different terms. Intelex publishes scheduling by frequency and risk, classified findings and due-dated action plans. Benchmark Gensuite presents qualified-auditor assignment, review of draft findings and corrective-action closure as a connected lifecycle. QT9 QMS lists approval, rejection and verification steps with actions raised from findings, and Qualio lists scheduled audit tasks with evidence and links to CAPAs or nonconformances. Treat these as starting points for the questions below, not confirmation that a product meets them.

Questions for the vendor

Buyer acceptance criteria