Thirty Per Cent Off the Internal Audit Programme
You manage the internal audit programme of a logistics group: five depots, two workshops, head office, 1,100 staff. Last year every one of the eight sites was audited for two days each, by the same three auditors. One of them is the group EHS manager, who also owns the environmental processes being audited. Waste segregation has produced the same minor finding at two depots for three consecutive years. The budget has been cut by 30 per cent. New dangerous-goods regulations take effect this year, two depots have new site managers, and a 3,000 litre fuel spill at Depot C was notified to the regulator six weeks ago. Top management says coverage must stay 'full'.
1. Redesign the programme. What drives frequency and coverage under 9.2.2, and how do you respond to the demand for full coverage with 30 per cent less resource?
Read the worked answer
What 9.2.2 actually requires: an audit programme planned with frequency, methods and responsibilities that take into account the environmental importance of the processes, changes affecting the organisation, and the results of previous audits. It requires defined criteria and scope for each audit, auditor objectivity and impartiality, and reporting to relevant management. It does not require every site every year.
Redesign:
- Split the programme into common processes and site-specific processes. Waste management, contractor control, dangerous goods and management review can be audited once at head office and once at a representative site, rather than eight times. That releases days without losing coverage of the process.
- Risk-rank the sites: Depot C rises sharply (notifiable spill, so emergency preparedness, spill response and 8.2 are in scope this year); the two depots with new managers are medium risk (change of ownership of process); depots with stable performance and no changes drop to a longer cycle.
- Process-based rather than site-based audits for the dangerous-goods regulations, run as a single topic audit across a sample of three sites, so the new legal requirement is tested properly instead of superficially everywhere.
- Attack the repeat finding: three years of the same minor finding is itself a programme failure. Audit the waste process for its causal chain, not the bins.
Answer to top management: full annual coverage of every site is not the same as effective coverage of the significant aspects. Present the risk ranking as the justification, and state explicitly which risks are covered and which are deferred, so the deferral is their decision on the record, not yours in private.
2. What impartiality and competence problems exist, and how do you resolve them with less money?
Read the worked answer
Impartiality: the EHS manager auditing the processes she owns fails the requirement that auditors be objective and impartial. She may be audited (her area is auditable) and she may sponsor the programme, but she cannot audit her own work. Options: remove her from audits of the EMS processes she owns and use her on operational areas outside her responsibility, or move her to a programme-owner role with no audit delivery.
Competence:
- Dangerous-goods regulation is new; competence must be established before the audit, through training or by bringing in a competent person.
- The Depot C spill demands someone able to audit incident investigation, root cause and emergency response - not a generalist reading a spill kit checklist.
- If external auditors are used for the gap, the programme still has to define the criteria, the reporting line and quality review, and retain the records (9.2.2 and 7.5).
Doing this with less money:
- Train two or three operational staff as cross-site auditors; they are cheaper than external resource and provide built-in independence from the site being audited. Budget one week of training against the days saved.
- Consolidate mandatory training with the audit topic - auditors trained in dangerous goods deliver that audit themselves.
- Reserve external spend for the high-risk, high-technical areas (the spill, the regulatory change) rather than spreading it across all sites.
3. How do you monitor whether the programme is effective, and what do you take to management review?
Read the worked answer
Effectiveness measures (not activity counts alone):
- Coverage of significant environmental aspects and compliance obligations against plan, not number of audits held.
- Repeat findings, tracked by process - the waste segregation result is the headline indicator and shows the previous programme was not effective.
- Closure timeliness and verified effectiveness of corrective actions (10.2), distinguishing correction from verified corrective action.
- Realisation of planned audit days and the reasons for shortfall.
- Findings that escalate to significant environmental impact or regulatory exposure, and what changed as a result.
To management review (9.3): audit results are a specified input, so report the trend, the resource constraint and its consequence in risk terms - which aspects are now audited less often and what could go undetected. Ask for a decision, not sympathy: approve the risk-based programme, approve the auditor training, or accept in writing the risk of deferring specific sites.
Also flag: the programme itself is a process that needs a review cycle. If the 30 per cent cut produces no measurable loss of coverage of significant aspects, the previous programme was over-resourced; if it does, the decision to cut was made by default rather than deliberately. Either conclusion belongs in the review.