An Internal Audit Programme That Finds Nothing
You manage the internal audit programme for a logistics group with 12 distribution centres, each about 20 GWh electricity and 4 GWh gas. The EnMS internal audits are performed by two facilities engineers from the operations department, one of whom is the energy manager. In the last 18 months, three audits were completed, all at the two newest sites; no audit has been done at the eight oldest sites, which include the four highest-energy sites. All three reports concluded 'no nonconformities'. The audit checklist has 40 yes/no questions and no sampling plan. Auditors received a one-day ISO 50001 awareness session. Because of the backlog, management proposes remote audits of four sites and reducing the programme to one audit per year. Management review records the number of audits completed as the only indicator. Internal audit results are not used to update the energy review or objectives.
1. Evaluate the effectiveness of the internal audit programme against ISO 50001 and ISO 19011, identifying the main risks.
Read the worked answer
Requirement check. 9.2 requires internal audits at planned intervals, with defined criteria and scope, auditors who are objective and impartial, and results reported to relevant management. ISO 19011 adds programme management, competence, a risk-based approach and evidence-based methods.
Impartiality is compromised. The energy manager audits the energy management system, and both auditors come from operations. That is self-audit of their own function and decisions. Even well-intentioned auditors struggle to challenge their own work.
Competence is inadequate. A one-day awareness session does not equip an auditor to plan an audit, sample energy data, test an energy review or evaluate EnPIs and baselines. No competence criteria or evaluation records are described.
Coverage is not risk-based. Three audits in 18 months, all at the newest low-energy sites, while the four highest-energy sites were never audited. The programme is following convenience, not risk.
Method cannot find anything. Forty yes/no questions with no sampling plan test document existence, not effectiveness. A programme with zero findings across three audits is more likely to indicate weak criteria, weak competence or fear of reporting than a perfect system.
Results are not used. Audit output does not feed management review meaningfully, the energy review or objectives. The only indicator is a count, which says nothing about whether audits improved the EnMS. The proposed reduction to one audit per year and remote-only coverage would worsen all of these risks. The programme is not effective.
2. Design a risk-based audit programme for the next 12 months, including resourcing, competence, schedule and use of remote methods.
Read the worked answer
Risk assessment. Rank the 12 sites by total energy (each is about 24 GWh, so 288 GWh group-wide), energy intensity, number of SEUs, recent changes, legal exposure, performance trend and history of findings. The four highest-energy sites and the two oldest, least-audited sites go first. Document the ranking so management can see why a site is or is not in the plan.
Schedule. Plan roughly six to eight audits in the first 12 months rather than trying to clear the entire backlog. Include the high-energy sites, one or two older sites, and follow-up on any findings. Set frequency by risk, not by a uniform annual rule, and state the multi-year coverage so every site is reached within a defined cycle.
Resourcing and impartiality. Remove the energy manager from auditing the EnMS. Use auditors from other regions, a trained corporate auditor, or an external auditor for the high-risk sites; facilities engineers can be team members but not leaders of audits covering their own site. Budget travel and time, and obtain top management approval.
Competence. Define criteria: ISO 50001 and ISO 19011 training, audit practice under supervision, technical understanding of warehousing energy uses, and evaluation of evidence. Train and qualify auditors, keep records, and evaluate performance after each audit.
Method. Replace the checklist with an audit plan, process-based questions and a sampling plan. Use remote methods for document review and interviews, but verify SEUs, metering and operational control on site. Record the method and any limitations in each report.
3. How should the programme be monitored and reported to top management?
Read the worked answer
Choose indicators that say something about the programme, not just activity. Useful measures: planned audits completed versus plan, coverage of high-risk and high-energy sites, findings by clause and severity, closure rate and time to close, whether findings lead to changes in the energy review, objectives or operational control, and auditor competence and performance. The number of audits alone is insufficient, and the number of nonconformities should never be a target, because that discourages honest reporting.
Report at the right level. Give top management a short quarterly summary and a fuller annual review: programme risks, coverage gaps, major findings and their consequences, resource needs and decisions required. Include internal audit results as a required input to management review (9.3) and show how they influenced objectives and the energy review.
Review and adjust the programme. At least annually, reassess the risk ranking and the audit frequency. If a site has a strong record and no changes, its interval can lengthen; if a site changes fuels, processes or load, bring its audit forward. Record the rationale for changes.
Integrate where sensible. Coordinate with ISO 14001 and quality audits to share planning, context and opening meetings, but keep EnMS-specific technical time and competence. Use the audit results to test whether the EnMS is improving energy performance, not merely whether records exist.
Keep records. Retain the programme, risk assessment, audit plans, reports, competence records and management review inputs as documented information so the programme can be shown to be implemented and effective.