Internal audits, findings, and the audit program

Open: Audits & Review > Audits. Typical leads: Internal Auditor and Quality Manager. Purpose: plan the audit program, conduct audits against it, retain findings and their verification, and show what the program delivered.

Plan the audit program

Open: Audits & Review > Audits > Program and coverage. One program covers one period.

1. Under Plan a program, enter the Period name, Starts and Ends dates, Coverage (which processes, areas and shifts), Frequency rationale (why this often), Risk basis (process status and importance, customer impact, prior findings), and the Owner.
2. Choose Create program. Norma assigns an APG reference and the program starts as Draft.
3. When it is agreed, choose Approve program. Norma records who approved it and when. Only an approved program can take audits.
4. At the end of the period, choose Close program. A program with audits still planned or under way cannot close until they are closed, cancelled, or deferred.

An approved program is not edited; plan a new program for the next period. The program page lists each audit on it with its state and reason.

Schedule and start

1. Under Schedule audit, enter Title, Scope, Criteria, and Planned date.
2. Choose the Auditor. This organization lists your people; Outside auditors (consultant keys) lists consultants holding a live key, with their practice.
3. Choose the Process owner of the audited process, or leave it Not named. The owner cannot be the auditor.
4. Choose the Program, or Not on a program for an audit outside the plan, such as a customer escalation. On a program, the planned date must fall inside its period.
5. Choose Schedule audit. Norma assigns an AUD reference.
6. When the audit begins, choose Start audit. It moves to In progress.

If the auditor owns the process, or is a consultant who would be auditing their own work, the audit is refused unless you write an Independence exception (optional): why the audit can still be relied on, and who reviews it, in at least 20 characters. A consultant needs the exception when they hold a Build key or wrote or approved a controlled document in your organization; the Auditor list marks them (needs an independence exception). The exception is shown on the audit and its report. An Audit Room grant is never accepted as an internal auditor.

Start audit takes a Plan snapshot: the criteria as written, the standard editions adopted that day, each clause the criteria name with its title, any clause number no adopted edition carries, the findings other audits had open, and the auditor, process owner, exception, and program. Later edits to the criteria or a revised standard do not change it. Audits started before 1.5.0 say no snapshot was taken.

Audit checklists

An audit checklist is the list of questions to ask and records to pull on an internal audit, with the clauses each one checks. Keep your checklists in one library and attach them to audits, so every audit of a process asks the same things and you can show your registrar what you looked at. Open Audits & Review > Audits > Checklists. Anyone with Audits can read the library; people who plan audits can add and change checklists. If the library is empty and you don't plan audits, it says so and tells you that a person who plans audits can add one.

Start from a starter. The first time you open the library it offers ten starter checklists taken from the Norma Word pack: the floor checks to make on every audit, and one each for order review, purchasing and receiving, production, inspection and release, NCR and corrective action, calibration, training, document control and management. Each shows how many items it has. Select Add to copy one into your library, then change it to fit your shop. Items that start "AS9100D:" only apply if you are certified to AS9100D. Delete them, or mark them N/A on the audit.

Write your own. Under Write a checklist, give it a title, the process it covers if it covers one, and one item per row: the question or the records to pull on the left and the clauses it checks (for example 8.4.1) on the right. Empty rows are skipped. Norma numbers it ACL-0001, ACL-0002 and so on.

Change a checklist from its own page: edit the title, process or items (clear an item's text to remove it), or select Deactivate to stop offering it on audits. Changing a checklist never changes an audit it was already attached to. The audit keeps the questions it actually asked. Each checklist's record history shows every change.

Attach a checklist to an audit. On a planned or in-progress audit, pick a checklist under Attach a checklist. Its items are copied onto the audit as numbered lines. You can attach more than one, and later ones are added after the lines already there. A checklist already on the audit isn't offered again.

Remove a checklist attached by mistake. Each checklist on the audit is listed under Attach a checklist. Select Remove beside it to take its lines off the audit. You can remove a checklist only while the audit is planned or in progress and none of its lines has an answer. Once a line has an answer, it's part of the audit's record: mark the lines you don't need N/A instead. The removal is saved on the audit's record history.

Answer the lines while you audit. Once the audit is started, each line has a result (Conforming, Nonconforming, Opportunity or N/A) and a box for what you sampled, such as "PO-10442, PO-10450". Select Save answer. You can change an answer while the audit is in progress.

Record a finding from a line. When a line is Nonconforming or Opportunity, select Record finding beside it. The finding form opens with the line's clauses and question already filled in. Write the statement the way you want it read, add your objective evidence or tick the samples it rests on, and save. The finding is linked to the line, and the line shows it.

Closing the audit. Every line needs an answer before the audit can close. N/A counts as an answer. The close form tells you how many lines are still open. While an audit is closed its answers can't be changed. If the audit is reopened, it goes back to in progress and the lines can be answered again.

Record findings

While the audit is In progress, record what you examined under Evidence samples: What was sampled (a purchase order, a training record, a part), its Identifier, optionally Examined on, What was found (Conforming, Nonconforming, or Not applicable), and an Observation, required when the sample is nonconforming. Choose Record sample. Samples belong to the audit, so an audit that found nothing still shows what its conclusion rests on.

Use Record finding with Classification (Major, Minor, Observation, or OFI), Clause reference, Statement — the requirement it falls short of, and how — and Objective evidence — what was seen — which record, which sample, which date. Samples no finding has claimed yet are listed under Evidence samples this finding rests on; tick the ones this finding rests on and leave the evidence box empty to have the sentence written from exactly those rows, or write your own. A sample can be cited by one finding only.

Raise a CAPA from a finding with Raise CAPA when corrective action is needed. The link is retained on the audit and CAPA histories.

A Major or Minor finding is a nonconformity and closes only after follow-up verification. When you have gone back and checked the fix, enter what was checked and what was seen and choose Record verification; Norma records who verified it and when. Only then does Close finding appear, with its closure note. An Observation or OFI closes on its closure note alone. Findings recorded before 1.5.0 close on a note as before. A finding may be closed after the audit itself is closed; it has its own follow-up life.

Close the audit

An audit must be started before it can be closed. Enter the Report summary that identifies what was covered, the conclusion, and outstanding matters, and choose Close audit. While findings remain open the lifecycle rail lists No finding left open as unmet; the audit can nevertheless be closed with findings open, and the closure records how many were open. Those findings still require verification and closure; after the audit closes, the header offers Close open findings.

The controlled Close with no findings option, where shown, requires an In progress audit, no still-open finding, and a written note. Do not use the wording to disguise unresolved findings. A permitted reopen requires a reason and retains the earlier closure in history.

When an audit does not go ahead

An audit that will not run should say so rather than stay Planned and read as overdue. On a Planned audit, open Not going ahead? and choose the Outcome:

• Deferred to a new date: enter the New planned date (deferral only). The audit still counts in the period it was originally planned for; the new date applies when you start it.
• Cancelled: it is not happening.
• Not applicable: the process is out of scope or gone.

Enter a Reason of at least ten characters and choose Record outcome. The reason appears on the audit, the chain, the coverage report, and the register export. An audit with open findings cannot be set aside until they are closed.

Use the audit evidence

Open the audit's Activity and Record chain to show planning, start, findings, verification, CAPA links, and closure. Reports > Audit program coverage counts the audits planned in the period as Planned, Completed, Overdue, Cancelled, Deferred, and Not applicable, and each figure opens exactly those audits. Overdue means Planned or In progress past its planned date. Use Audit finding closure and the register to identify open findings. Open the coverage report before a management review or a surveillance audit.

The Internal Auditor functional role supports the audit program; it is different from a read-only external auditor's Audit Room. It does not by itself grant document approval, NC disposition, or CAPA effectiveness closure. Combining roles can broaden a person's authority, so preserve the independence required by your own audit procedure when making assignments.

Tip: Write findings so the CAPA can be raised from them without a second conversation: the criterion, the evidence you saw, and the gap between them, each as its own sentence. "WI-2208 Rev E requires an in-process bore check every 10 pieces; job 4590's inspection entries show none between piece 1 and piece 40" is a finding. "Inspection not followed" is not.

Completion check: the audit sits on an approved program or is deliberately off one; the audit summary is retained; each major or minor finding is verified before it closes; outstanding work has an owner through the appropriate follow-up records; audits that did not run carry their outcome and reason; and the audit closure is not being mistaken for closure of every finding.

In the user guide

This article is chapter 27, "Audits and Findings", of the NormaQMS User Guide (NORMA-UG-001), which is under Help > User guide. Chapter numbers in the text refer to that guide.