How does the internal audit activity go about prioritising its resources?

Now that’s a tricky one. I’ve seen lots of people come up with systems for prioritising what they’re going to audit, how they’re going to do it, and what’s involved in the internal audit process. My fundamental recommendation is to start with the really important stuff first, and then progressively less important stuff as it goes.

For example: things like in your quality management system, auditing processes that consistently upset customers.

If there is a particular thing that is a common thread with customer complaints, customer concern or issues with customers then that would be an area that I would be looking to view more often than other areas of the business.

From a safety perspective, looking at and reviewing any processes or controls around anything that could harm someone or make someone sick in the organisation. Similarly, from an environmental perspective, anything that’s going to cause significant environmental damage or has caused significant environmental damage would be the priority areas.

What I’ve observed across my career and across the thousands of companies would work with, are people defaulting to checking spelling, punctuation, and formatting. I am not an advocate for looking at and reviewing documents. If you’re finding you get too caught up in that and you’re not actually looking at how the operation runs then you’re not going down the right track. It doesn’t add any value to organisations and it certainly won’t get the attention of senior management if you all you do is belt them with recommendations on how documents are managed and how documents are handled. We are moving away from that and it’s not in the new versions of the standards, as they’re moving to an outcomes focus.

If your outcomes and the results your organisation are not as good as they should be then pick those areas to focus on.