Auditing without a Procedure

How do you audit when there is no documented procedure to audit against?

Organizations are required to have a documented internal audit process. The documentation requirements give the responsibility of determining what documents are needed for control of its processes. As it is unique to each organization, the auditor will become responsible to determine that the necessary procedures and work instructions have been documented. 

How can an auditor determine if a process is controlled if there is no procedure or work instruction?

The auditor’s job is to determine if processes are being performed consistently, with consistent and acceptable results. The auditor can determine this by asking questions to people who perform this process. The auditors will ask each person individually so they cannot influence one another’s answers. When the process is in control, the answer will be consistent. Examples of questions asked include:

• Can you explain the steps to this process?
• What measuring and monitoring are required for this process?
• What are acceptable ranges for the equipment?
• What are the acceptance criteria for the product?
• What records do you need to complete for this process?

Audits should ask enough people in order to have a good sample size to truly understand if the process varies or is consistent. If the answers vary, there should be a procedure. The need of the procedure will vary depending on the complexity of the process itself. Learn more about preparing for an audit.