Internal auditing, the process by which an organization examines its ability to meet internal and external requirements, can be one of the most effective tools for triggering continual improvement. It can also be an expensive waste of time and a source of endless frustration and conflict. Which it becomes for you depends on how your organization plans and manages its audit system.
内审——组织用来检测自身满足内部和外部要求的过程，可以是激发持续改进最有效的工具之一。也可以浪费大量的时间和无穷无尽令人失望和矛盾的根源。内审成为有效的工具还是麻烦取决于你的这种如何策划和管理审核体系。
Auditing is not only a balancing act--identifying positive and negative aspects of a company’s performance--but also a planned activity, with auditors and auditees agreeing on the audit’s time, place and scope. Surprise audits are neither necessary nor desired. Internal audits generally use an organization’s existing personnel for the task, although outsiders are occasionally called in.
审核不仅仅是平衡的艺术——识别公司业绩正反面，同时也是策划好了的活动，审核员与被审人员同意审核的时间，地点和范围。突袭式的审核即没必要也不要求如此。内审通常利用组织内现有人员完成，尽管有时会找组织外人员来做内审。
Internal audits offer huge benefits, both to the organization’s top management and the auditors. Top managers can:
* Discover what’s really going on within the organization, which allows for more objective decision making
* Learn of potential problems before they explode into issues that pose significant risk to the organization
* Ascertain where failures occur, enabling the containment of these problems and initiation of corrective action
* Identify where resources should be directed
* Determine how effective their training efforts are
* Learn which processes and personnel are particularly effective, which can trigger recognition
内审对最高管理层和内审员都有很多益处。最高管理层可以：
* 发现组织内在干什么，这样可以做出客观的决策
* 发现潜在问题，在其成为给组织造成重大问题前
* 确定故障在何处发生，从而抑制这些问题并采取纠正措施
* 识别资源投放的方向
* 确定培训的有效性
* 发现特别有效地过程和优秀员工，可以引发再识别过程
For their part, internal auditors:
* Gain exposure to other parts of the organization, which broadens their experience
* Are exposed to best practices they can implement in their own departments
* Learn how they contribute to the organization’s success, which increases motivation and employee retention
* Expand the organization’s competency and knowledge base through their experience
内审员则可以：
* 在组织内的其它部门亮相，扩大他们的阅历
* 展示他们改进自身部门的最佳方法
* 发现内审员如何为组织的成功做出贡献，这可以激发动力和员工的凝聚力
* 利用内审员的经验开展组织的能力和知识库
An effective internal audit system must work in concert with other systems, especially corrective and preventive action. An internal audit takes a snapshot of the organization, identifying nonconformities, opportunities for improvement and positive practices. Auditors don’t propose specific actions, fixes, solutions or recommendations. They simply identify where failures and successes occur. By their nature, audits typically identify more failures than successes, and these failures are called audit nonconformities.
有效地内审必须与其它方法相呼应，特别是纠正/预防措施。内审就是给作者拍快照，识别不合格、发现改进和积极实践的机会。内审员并不提供特别的行动、纠正、解决方案或建议。他们只是简简单单地识别失效和成功发生在何处。审核发现失效多于成功，这种失效称之为审核不符合项。
Requirements vs. opinions 要求与观点
To identify a nonconformity, a requirement is needed. You might have a concern, remark or opportunity, but it’s not a nonconformity unless it’s clearly tied to a requirement, a fact that’s often overlooked.
识别不符合项就需要要求。你可以对某事有种关切、评论或机会，但那不是不符合项，除非此事与某项要求有明显的联系，这是常常被忽视的事实。
Any activity, process or outcome that doesn’t meet requirements is a nonconformity. A number of sources, such as ISO 9001, inspection checklists, purchase orders and product specifications, could introduce specific requirements the organization must implement. The auditor’s opinions, notions, philosophies and personal experiences, however, don’t constitute requirements. When people audit with an eye toward driving continual improvement, requirements are sometimes “invented,” albeit usually with good intentions. One of the best techniques for ensuring audit nonconformities are written correctly is insisting that they’re structured in two parts:
任何未能满足要求的活动、过程或输出就是不符合项。组织必须实施的特定要求有很多，如ISO 9001，检查表，采购订单和产品规格。但内审员的观点、想法、概念和个人经历并不构成要求。当人们带着想要启动持续改进的目光进行审核时，就常常“发明”要求，虽然常常带有好的意愿。保证正确书写审核不符合项最佳的方法之一是坚持把不符合项分成两部分：
Requirement--Exactly what the organization has committed itself to do
要求——组织已经承诺的准确内容
Finding--Exactly what the organization has or hasn’t done that contradicts the requirement
发现——组织已经或没有做的与要求相抵触的准确内容
Objective evidence 客观证据
Objective evidence is a factual recounting of what was seen, heard or experienced during the audit. Gathering this evidence takes the most time and effort.
It is recorded in the “finding” portion of the requirement and describes exactly how the organization failed to fulfill the requirement.
客观证据是在审核过程中看到的、听到的和感受到的事实叙述。收集证据最耗时耗力。把它记录在要求的“事实”一栏，准确描述组织如何未能满足要求的事实
Objective evidence meets a number of criteria. Among other things, it’s:
客观证据要满足许多标准。
* Not subject to bias or prejudice. Auditors can’t allow their personal feelings to influence their interpretation of the evidence.
* Traceable. As many identifiers as possible should be recorded (e.g., date, time, function, department, machine, customer, order number and product code).
* Expressed as simply as possible. Sometimes auditors will provide a paragraph or more of detail, thinking that more data will provide more convincing evidence. However, the objective evidence is best streamlined and to the point.
* 没有主观偏爱或偏见。不允许内审员个人情感影响对证据的解释
* 可追溯性。记录可能多的识别符（即日期、时间、功能、部门、机器、顾客、订单号、产品编号）
* 描述的越简单越好。有时候内审员要提供一整段细节描述，以为数据越详细证据就越令人信服。但是客观证据最好是简洁的直指要害。
Objective evidence is stated in such a way that the first half of the nonconformity directly contradicts the requirement. Enough detail is provided to facilitate traceability--but not so much that it overwhelms. Auditees expect concise and clearly written findings.
客观证据用这样的方式描述：头半段直接说明不符合项与要求相抵触的地方。提供足够的细节以便追踪——但不要太多以至于让人不知所措。
Consider the following correct audit write-up:
看看以下正确的审核描述方法：
* Requirement: The general manager stated that all employees are expected to understand the facility’s key measures and how to contribute to them. (Note that the requirement comes from the general manager’s statements, which function as requirements when he’s talking about something under his control.)
* 要求：总经理要求所有员工了解该公司的关键措施以及如何为此尽职尽责（注意，要求来自总经理，可作为总经理控制下的要求）
* Finding: Three out of five employees sampled randomly in the shipping department didn’t understand the facility’s key measures or how to contribute to them. (Note that the finding’s language mirrors that of the requirement, stating exactly how the organization failed to meet its commitment. The sample size is defined, and the location is also identified. Employee names, however, are appropriately omitted.)
* 事实：在发运部门随即抽取了五名员工，有三个不知道该公司的关键措施以及如何为此尽职尽责（注意“事实”的语言映出要求的内容，准确叙述组织如何未能满足其承诺的。确定抽样数量，发现的地点。但是恰当地去掉了员工的名字）
Now look at this incorrect write-up:
现在看看不正确的写法：
* Requirement: All employees should understand key measures. (Note that it isn’t clear whether this is an opinion or a requirement. Where did this “should” come from?)
* 要求：所有员工应该了解关键措施（注意这没有清晰这是个观点还是要求。其中“应该”从何而来呢？）
* Finding: Employees were ignorant of the organization’s objectives and strategic direction, and they were obviously unprepared to assist in continual improvement. (Note that here, the finding’s tone is subjective and accusatory. Sample size and other identifiers are omitted, which provides insufficient traceability.)
* 事实：员工不知道组织的目标和战略方向，很明显他们没有对持续改进做好准备。（注意，此处“事实”的语气说主观的和指责性的。忽略了抽样数量和其他识别符，这样未能提供足够的可追溯性）
It generally takes a number of audits before an inexperienced auditor can confidently draw conclusions from objective evidence and write nonconformities clearly and concisely. Practicing the audit process with an experienced auditor is time well spent.
通常，在没有经验的审核员可以自信地从客观证据中得出结论，清晰而准确地写出不符合项之前需要大量的审核。与经验老道的审核员一起训练审核过程是个节省时间的捷径。
The system, not the people 体系而不是人
One of the best ways to understand the system and its effectiveness is through people: how they receive and interpret information, carry out instructions, produce goods and deliver services according to requirements, and satisfy customers. Nevertheless, an audit must always focus on the system itself.
了解体系及其有效性最好的方法之一是通过人：他们知道和解释信息的方式，指导书执行情况，安装要求生产产品和提供服务的情况，满足顾客的情况。然而，审核必须关注于体系本身。
Some auditees might suspect that an audit constitutes a personal attack on their jobs, and auditors must be prepared for that reaction. They should calmly explain that the audit process is all about the system, put the auditees at ease and depersonalize the process as much as possible. If people are uneasy about the audit process, they won’t provide objective evidence, and the audit, in turn, won’t trigger continual improvement.
某些被审人员怀疑审核对他们的工作进行人身攻击，并且准备好应对审核员。他们平静地解释审核过程是针对体系的，让被审人员放宽心，审核过程尽可能的去掉个人因素。如果人们对审核过程感到担忧的话，人们就不提供客观证据，你们审核就无法启动持续改进。
Does this mean people never screw up? Of course not. But when failures are identified during an audit, they’re system failures. Very few nonconformities occur due to willful employee misconduct. If someone makes a mistake or fails to carry out a job step, it’s usually because the system is flawed and error-prone. Fix the system, and people will have less opportunity to screw up.
这是否意味着人们不再砸锅了？当然不是。但当审核时发现了失效情况，这是体系失效。只有极少数的不符合项是由于员工任意所为。如果某人做错了或未能按照作业步骤行事，那通常是因为体系有缺陷，有防错的可能。修正体系，人们就较少的砸锅机会。
Auditing strategic processes 审核战略过程
Not all organizational processes have the same strategic significance. An internal audit system that’s oriented toward continual improvement will focus on strategic issues. Most management system standards such as ISO 9001 require that organizations schedule audits based on status, importance and prior audit results. This means organizational processes with more strategic importance will be audited more often.
The following audit questions reflect on processes that typically have high strategic importance:
不是所有的组织过程具有相同的战略意义。以持续改进为导向的内审则侧重于战略问题。大多数质量管理体系如ISO 9001要求组织基于状况和重要性以及以往审核的结果制定审核计划。这意味着经常要审核组织更具有战略重要意义的过程。以下审核问题关注具有高战略重要性的过程：
* Customer satisfaction. What methods does the organization use to capture customer perceptions? How are data on customer perceptions reported and analyzed? Has overall customer satisfaction improved?
* 顾客满意。组织使用什么方法去获取顾客感受方面的信息？如何报告并分析顾客感受方面的数据？顾客整体满意度得到提高了吗？
* Corrective and preventive action. Is there proof that root causes or potential root causes are being identified? Are actions taken to eliminate root causes or potential root causes? Are data on corrective and preventive actions reported and analyzed?
* 纠正和预防措施。有识别根本原因或潜在原因的证据吗？对根本原因或潜在原因采取措施了吗？对纠正和预防措施的数据上报和分析了吗？
* Leadership. Has the organization determined its mission and strategy? Are organizational performance and direction communicated throughout the organization? Has top management led the review and action on key measures and other important information that indicates organizational success?
* 领导力。组织是否已经确定其使命和战略？是否将组织业绩和方向在组织内传达？最高管理层已经对关键措施和表明这种成功的其它重要信息进行评审和采取措施了吗？
* Internal auditing. Do auditing schedules clearly reflect the strategic importance of processes and the results of previous audits? Does the organization’s management take corrective action on nonconformities raised by audits? Are the corrective actions effective, based on the evidence?
* 内审。审核计划清晰反映出过程的战略重要意义和以往评审结果了吗？组织的管理层对审核出来的不符合项进行纠正措施了吗？证据能说明纠正措施有效吗？
* Design and development. Are design inputs and outputs recorded and approved? Is progress against the design plan periodically reviewed? Is the design process’s output validated under conditions of application or use?
* 设计开发。设计输入输出进行记录和得到批准了吗？是否对设计计划进行阶段性进展评审？是否在实际应用条件下或使用中进行确认设计过程的输出？
* Transformation. How is work planned and scheduled? What information guides work performance in general? How do employees receive feedback on their work? Do employees understand how their efforts affect key measures?
* 转化。如何进行策划和安排时间？通常什么样的信息指导工作业绩？员工如何得到关于他们工作情况的反馈？员工知道他们的工作影响关键措施吗？
These audit questions are examples and might not be applicable to all organizations. Other processes could have strategic significance, depending on the organization’s nature and competitive environment.
以上审核问题都是例子，不能适用于所有的组织。由于组织的性质和竞争环境的不同，其它过程也可能具有战略意义。
Training auditors 培训内审员
Many audits produce poor results because auditors haven’t received proper instruction or been given opportunities to practice what they’ve learned. The organization must invest the necessary time and effort in making its auditors competent and confident before they’re assigned an audit.
许多审核的结果不理想是因为内审员没有得到正确的指导或没有足够的机会去实践其所学。组织必须在内审员进行内审前，投入必要的时间和精力提高内审员的能力和信心。
Auditors must be familiar with:
* Practical interpretations of the standard adopted by the organization
* The audit’s purpose and how it drives continual improvement (i.e., by providing a balanced picture of the organization and triggering corrective and/or preventive actions)
* Phases of the audit and various activities within each phase
* Sources of audit requirements (e.g., the standard, procedures or sales orders)
* Methods of gathering objective evidence and drawing valid conclusions
* Diplomacy skills and effective interpersonal communication
* Audit role-playing under controlled conditions
* Writing nonconformities in the prescribed format
* Actual auditing with an experienced auditor
内审员必须熟悉：
* 组织采用的标准在实际工作中的解释术语
* 内审的目的以及内审如何导致持续改进的原因（即，通过提供和谐的组织描述和启动纠正和/或预防措施来实现）
* 审核阶段以及每个阶段的各个活动内容
* 内审要求的来源（即，标准、工作程序或销售订单）
* 收集客观证据以及得出正确结论的方法
* 交流技巧和有效地人与人之间的沟通能力
* 在受控条件下审核工作模拟
* 在定制表格内填写不合格项
* 与经验老道的审核员一起实际审核
Auditor training doesn’t necessarily need to be formal or even classroom-based. The style and format of training will differ significantly from one organization to the next. However, auditors must have a conceptual understanding of the process and a practical grasp of techniques, both backed up by sufficient practice. When auditors truly understand their roles and responsibilities, the process should result in strategic continual improvement.
内审员的培训不需要十分正式，甚至不需要上课。培训的风格和形式都有很大的不同。但是内审员必须对过程有概念性的了解和对技术的实际应用有所掌握，这都以需要大量的实践作为支撑。当内审员真真切切地了解他们的职责和角色时，过程就会导向战略性的持续改进。
A successful audit almost always results when an individual takes personal ownership of the process. He or she must be able to carry out the following five complex and linked activities, which create strategic continual improvement.
当个人具有过程的所有权时，常常导致内审成功。他/她能够采取以下产生战略性持续改进的五个复杂而又相互联系的方法。
1 Audit scheduling 审核进度表
An audit schedule defines the auditing that will take place during an extended period of time, usually six months or a year. The purpose of the schedule is to communicate when and where the audit team’s services will be needed, when the organization can expect to be audited, and what requirements will be included in the audit.
审核进度表确定审核的时间，通常半年或一年。进度表的目的是传达审核的时间和地点，组织期待审核的时间，以及审核所要包括的要求。
Audits scheduled far in advance always produce better results. Note, too, that the processes considered more strategically important to the organization are scheduled for audits more often. Processes and functions that have performed poorly in previous audits are also scheduled for frequent audits. Regardless of other considerations, all processes, functions and departments within the scope of the management system must be audited at least once a year.
审核进度表定的越早越好。同时要注意，认为越重要的过程审核的次数越多。在以往审核中不理想的过程和职能口也要定出时间进行多次审核。无论其它考虑如何，在质量管理体系内的所有过程、职能口和部门每年至少审核一次。
The schedule can be keyed to organizational processes, departments, functions, facilities, an ISO standard element or something else. However, it must clearly communicate which audits are coming up and when. Audit schedules should provide enough detail to guide the overall process and help with the next step, audit planning.
进度表应该与过程、部门、职能口、车间、ISO标准要素或其他相协调。但是，进度表必须清晰传达进行哪个审核和什么时候进行审核。审核进度表应该提供足够详细的信息以统领所有过程并顺利进行到下一步，审核计划
2 Audit planning审核计划
An audit plan is focused, detailing a single audit’s scope, objectives and agenda. The plan provides a chronology of the audit from start to finish: which processes will be audited, exactly when they’ll be audited, who will do it and which requirements will be audited in each segment. Even details such as meetings, breaks and lunches are shown on the plan in order to clear up any timing conflicts between auditees and auditors and keep the audit on track.
审核计划关注单一审核范围、目的和议程的细节。审核计划定出审核从开始到结束的时间表：审核那些过程，审核什么内容，谁去审以及在每个区域审核什么要求等细节。审核计划甚至包括开会、早餐和午餐这样的细节，以便消除审核员与被审人员在时间问题上的误会，并是审核按计划进行。
Typically, the audit plan is distributed several days prior to the audit. Auditees often request alterations to the plan based on logical concerns and existing commitments. By all means, modify the plan to accommodate them. The one variable that usually never changes, however, is the audit’s scope.
通常，审核计划在审核前七天发出。被审人员经常基于自身的考虑和承诺，需要做些修改。尽一切可能修改计划以适应他们。但有个东西通常不再改变，就是审核范围。
3 Audit supervision 审核监督管理
The audit’s on-site phase consists primarily of gathering evidence. The lead auditor takes part in this and also manages the overall process. These duties typically include:
现场审核主要包括手机证据。审核组长参与其中，同时也管理整个审核过程。其具有代表性的职责包括：
* Leading the opening meeting
* Managing and communicating changes to the audit plan
* Ensuring that the audit stays on track
* Insisting that auditors remain objective, consistently evaluating all evidence
* Encouraging auditors to write up their findings during the audit to avoid a time crunch directly before the closing meeting
* Reviewing all nonconformities to ensure that they’re logical, valid and clear
* Providing performance feedback to audit team members so individuals can target areas for their personal improvement
* Resolving all conflicts constructively
* Apprising the auditee of the audit’s progress
* Leading the closing meeting
* Ensuring that the entire audit is conducted professionally and positively
* 主持首次会议
* 管理和传达审核计划的变更
* 保证审核按计划进行
* 强调审核员保持客观地始终如一地评价所有证据
* 鼓励审核员在审核时写下他们的发现避免末次会议前时间不够用
* 评审所有不符合项，以保证这些不符合项是符合逻辑的，有效的和清晰的
* 给审核小组成员及时的反馈，这样小组成员就可以瞄准他们的需要改进的地方
* 积极解决所有矛盾和冲突
* 对被审人员在审核方面所取得的进展大加赞扬
* 主持末次会议
* 保证整个审核工作的专业性和积极肯定性
If these duties sound difficult, it’s because they are. Many organizations have ineffective audit processes because the so-called lead auditor doesn’t understand his or her responsibilities. An accredited lead auditor course is a very good investment for individuals who function as lead auditors for their organizations.
如果这些职责看起来很难，那是因为确实很难。许多组织审核过程无效就是因为审核组长不理解其职责所在。让那些在组织内实际发挥审核小组组长作用的人上审核组长称职课程是项很好的投资。
4 Audit reporting 审核
The first formal reporting that takes place during an audit is the closing meeting. The lead auditor presents a verbal summary of the audit, including positives and negatives. Depending on the audit’s size and duration, the closing meeting might last from 15 minutes to more than an hour. The meeting allows for back-and-forth dialogue between auditors and auditees. During the closing meeting, auditee management is presented with the written audit observations and/or corrective action requests, and these form the basis for discussion of the audit results.
第一个正式的报告发生在末次会议上。审核小组组长做口头审核总结，包括表扬和批评。根据审核范围和时间的长短，末次会议可进行15分钟到一个多小时。末次会议允许审核员和被审人员你来我往的对话。在末次会议上，在书面审核观察资料和/或纠正措施要求中提及被审部门的领导。
Subsequent to the closing meeting (and occasionally during the closing meeting), an audit report is presented to the auditee management. This summarizes the audit’s overall themes and trends. Usually it’s written by the lead auditor, based on evidence gathered by the entire audit team. The report doesn’t belabor every audit observation because these should have already been addressed during the closing meeting. Audit reports should be as concise and streamlined as possible. Graphics such as matrices and Pareto diagrams are helpful.
末次会议之后（偶尔也有在会议上）把审核报告递交给被审部门的领导。报告总结了审核的整体宗旨和倾向。通常是由审核小组组长基于整个审核小组收集的证据撰写报告。报告不对每个审核观察情况进行长篇大论，因为这些观察情况已经在末次会议上提到了。审核报告应该尽可能的简洁和简明。类似矩阵图和排列图是很用的。
5 Verification and closure 验证和关闭
The auditee management is usually asked to respond to audit nonconformities by an agreed date. The response should include investigation into the root cause, proposed corrective action and a date when the action should be completed.
通常要求被审部门的领导按期对不符合项做出反应。反应包括发现根本原因，提出纠正措施和措施完成的时间。
The lead auditor reviews the responses to determine whether the investigation and proposed corrective actions are adequate. This is the first stage of verification.
One of the most important jobs the lead auditor and auditing team can perform is a careful scrutiny of auditee responses. Accepting weak investigations and/or corrective actions does nobody any favors and certainly doesn’t trigger continual improvement. If a response doesn’t identify a plausible root cause or propose a corrective action related to it, the lead auditor must diplomatically reject the response and explain to the auditee why it’s adequate. The auditee is the audit process’s customer and should be treated with the same respect that any other customer would receive.
审核小组组长评价这些反应并确定根本原因的发现过程和提出的纠正措施是否适宜。这是验证的第一步。审核小组组长和审核小组最重要的工作之一就是仔细审查被审部门的反应。接受不积极的反应和/或纠正措施不是使大家满意，肯定不会激发持续改进。如果反应未识别出似是而非的原因或提出相关的纠正措施，审核小组组长必须巧妙地回绝，并对被审部门解释其原因。被审部门是审核过程的顾客应该受到与其他顾客相同的待遇。
The second stage of verification occurs when the auditee notifies the lead auditor that corrective action has been implemented. At this stage, the lead auditor or a team member will verify that the corrective action has been fully implemented and the root cause of the original nonconformity has been eliminated.
Verification is sometimes performed by reviewing records or documents submitted by the auditee; alternatively, an on-site visit is made to review evidence in person. The nonconformity’s nature and significance will determine whether on-site verification is necessary.
验证的第二步发生在被审部门通知小组组长纠正措施已经完成的时候。再次阶段，小组组长或小组成员验证纠正措施是否已经全部完成，产生不符合项的根本原因已经消除。
Once all audit nonconformities have been addressed with effective corrective action, the audit is considered closed. However, this doesn’t mean it’s forgotten. A high-level discussion of audit results is an important input to the business review process, and audit trends influence resource allocation and strategic decision making.
一旦有效地纠正措施纠正了所有的审核不符合项，就可以认为审核工作结束了。但是，这不意味着审核就可以被忘记了。审核结果的更高层次的讨论是业务评审过程的重要输入，审核倾向影响资源的分配和战略性决策。
From Craig Cochran
内审——组织用来检测自身满足内部和外部要求的过程，可以是激发持续改进最有效的工具之一。也可以浪费大量的时间和无穷无尽令人失望和矛盾的根源。内审成为有效的工具还是麻烦取决于你的这种如何策划和管理审核体系。
Auditing is not only a balancing act--identifying positive and negative aspects of a company’s performance--but also a planned activity, with auditors and auditees agreeing on the audit’s time, place and scope. Surprise audits are neither necessary nor desired. Internal audits generally use an organization’s existing personnel for the task, although outsiders are occasionally called in.
审核不仅仅是平衡的艺术——识别公司业绩正反面，同时也是策划好了的活动，审核员与被审人员同意审核的时间，地点和范围。突袭式的审核即没必要也不要求如此。内审通常利用组织内现有人员完成，尽管有时会找组织外人员来做内审。
Internal audits offer huge benefits, both to the organization’s top management and the auditors. Top managers can:
* Discover what’s really going on within the organization, which allows for more objective decision making
* Learn of potential problems before they explode into issues that pose significant risk to the organization
* Ascertain where failures occur, enabling the containment of these problems and initiation of corrective action
* Identify where resources should be directed
* Determine how effective their training efforts are
* Learn which processes and personnel are particularly effective, which can trigger recognition
内审对最高管理层和内审员都有很多益处。最高管理层可以：
* 发现组织内在干什么，这样可以做出客观的决策
* 发现潜在问题，在其成为给组织造成重大问题前
* 确定故障在何处发生，从而抑制这些问题并采取纠正措施
* 识别资源投放的方向
* 确定培训的有效性
* 发现特别有效地过程和优秀员工，可以引发再识别过程
For their part, internal auditors:
* Gain exposure to other parts of the organization, which broadens their experience
* Are exposed to best practices they can implement in their own departments
* Learn how they contribute to the organization’s success, which increases motivation and employee retention
* Expand the organization’s competency and knowledge base through their experience
内审员则可以：
* 在组织内的其它部门亮相，扩大他们的阅历
* 展示他们改进自身部门的最佳方法
* 发现内审员如何为组织的成功做出贡献，这可以激发动力和员工的凝聚力
* 利用内审员的经验开展组织的能力和知识库
An effective internal audit system must work in concert with other systems, especially corrective and preventive action. An internal audit takes a snapshot of the organization, identifying nonconformities, opportunities for improvement and positive practices. Auditors don’t propose specific actions, fixes, solutions or recommendations. They simply identify where failures and successes occur. By their nature, audits typically identify more failures than successes, and these failures are called audit nonconformities.
有效地内审必须与其它方法相呼应，特别是纠正/预防措施。内审就是给作者拍快照，识别不合格、发现改进和积极实践的机会。内审员并不提供特别的行动、纠正、解决方案或建议。他们只是简简单单地识别失效和成功发生在何处。审核发现失效多于成功，这种失效称之为审核不符合项。
Requirements vs. opinions 要求与观点
To identify a nonconformity, a requirement is needed. You might have a concern, remark or opportunity, but it’s not a nonconformity unless it’s clearly tied to a requirement, a fact that’s often overlooked.
识别不符合项就需要要求。你可以对某事有种关切、评论或机会，但那不是不符合项，除非此事与某项要求有明显的联系，这是常常被忽视的事实。
Any activity, process or outcome that doesn’t meet requirements is a nonconformity. A number of sources, such as ISO 9001, inspection checklists, purchase orders and product specifications, could introduce specific requirements the organization must implement. The auditor’s opinions, notions, philosophies and personal experiences, however, don’t constitute requirements. When people audit with an eye toward driving continual improvement, requirements are sometimes “invented,” albeit usually with good intentions. One of the best techniques for ensuring audit nonconformities are written correctly is insisting that they’re structured in two parts:
任何未能满足要求的活动、过程或输出就是不符合项。组织必须实施的特定要求有很多，如ISO 9001，检查表，采购订单和产品规格。但内审员的观点、想法、概念和个人经历并不构成要求。当人们带着想要启动持续改进的目光进行审核时，就常常“发明”要求，虽然常常带有好的意愿。保证正确书写审核不符合项最佳的方法之一是坚持把不符合项分成两部分：
Requirement--Exactly what the organization has committed itself to do
要求——组织已经承诺的准确内容
Finding--Exactly what the organization has or hasn’t done that contradicts the requirement
发现——组织已经或没有做的与要求相抵触的准确内容
Objective evidence 客观证据
Objective evidence is a factual recounting of what was seen, heard or experienced during the audit. Gathering this evidence takes the most time and effort.
It is recorded in the “finding” portion of the requirement and describes exactly how the organization failed to fulfill the requirement.
客观证据是在审核过程中看到的、听到的和感受到的事实叙述。收集证据最耗时耗力。把它记录在要求的“事实”一栏，准确描述组织如何未能满足要求的事实
Objective evidence meets a number of criteria. Among other things, it’s:
客观证据要满足许多标准。
* Not subject to bias or prejudice. Auditors can’t allow their personal feelings to influence their interpretation of the evidence.
* Traceable. As many identifiers as possible should be recorded (e.g., date, time, function, department, machine, customer, order number and product code).
* Expressed as simply as possible. Sometimes auditors will provide a paragraph or more of detail, thinking that more data will provide more convincing evidence. However, the objective evidence is best streamlined and to the point.
* 没有主观偏爱或偏见。不允许内审员个人情感影响对证据的解释
* 可追溯性。记录可能多的识别符（即日期、时间、功能、部门、机器、顾客、订单号、产品编号）
* 描述的越简单越好。有时候内审员要提供一整段细节描述，以为数据越详细证据就越令人信服。但是客观证据最好是简洁的直指要害。
Objective evidence is stated in such a way that the first half of the nonconformity directly contradicts the requirement. Enough detail is provided to facilitate traceability--but not so much that it overwhelms. Auditees expect concise and clearly written findings.
客观证据用这样的方式描述：头半段直接说明不符合项与要求相抵触的地方。提供足够的细节以便追踪——但不要太多以至于让人不知所措。
Consider the following correct audit write-up:
看看以下正确的审核描述方法：
* Requirement: The general manager stated that all employees are expected to understand the facility’s key measures and how to contribute to them. (Note that the requirement comes from the general manager’s statements, which function as requirements when he’s talking about something under his control.)
* 要求：总经理要求所有员工了解该公司的关键措施以及如何为此尽职尽责（注意，要求来自总经理，可作为总经理控制下的要求）
* Finding: Three out of five employees sampled randomly in the shipping department didn’t understand the facility’s key measures or how to contribute to them. (Note that the finding’s language mirrors that of the requirement, stating exactly how the organization failed to meet its commitment. The sample size is defined, and the location is also identified. Employee names, however, are appropriately omitted.)
* 事实：在发运部门随即抽取了五名员工，有三个不知道该公司的关键措施以及如何为此尽职尽责（注意“事实”的语言映出要求的内容，准确叙述组织如何未能满足其承诺的。确定抽样数量，发现的地点。但是恰当地去掉了员工的名字）
Now look at this incorrect write-up:
现在看看不正确的写法：
* Requirement: All employees should understand key measures. (Note that it isn’t clear whether this is an opinion or a requirement. Where did this “should” come from?)
* 要求：所有员工应该了解关键措施（注意这没有清晰这是个观点还是要求。其中“应该”从何而来呢？）
* Finding: Employees were ignorant of the organization’s objectives and strategic direction, and they were obviously unprepared to assist in continual improvement. (Note that here, the finding’s tone is subjective and accusatory. Sample size and other identifiers are omitted, which provides insufficient traceability.)
* 事实：员工不知道组织的目标和战略方向，很明显他们没有对持续改进做好准备。（注意，此处“事实”的语气说主观的和指责性的。忽略了抽样数量和其他识别符，这样未能提供足够的可追溯性）
It generally takes a number of audits before an inexperienced auditor can confidently draw conclusions from objective evidence and write nonconformities clearly and concisely. Practicing the audit process with an experienced auditor is time well spent.
通常，在没有经验的审核员可以自信地从客观证据中得出结论，清晰而准确地写出不符合项之前需要大量的审核。与经验老道的审核员一起训练审核过程是个节省时间的捷径。
The system, not the people 体系而不是人
One of the best ways to understand the system and its effectiveness is through people: how they receive and interpret information, carry out instructions, produce goods and deliver services according to requirements, and satisfy customers. Nevertheless, an audit must always focus on the system itself.
了解体系及其有效性最好的方法之一是通过人：他们知道和解释信息的方式，指导书执行情况，安装要求生产产品和提供服务的情况，满足顾客的情况。然而，审核必须关注于体系本身。
Some auditees might suspect that an audit constitutes a personal attack on their jobs, and auditors must be prepared for that reaction. They should calmly explain that the audit process is all about the system, put the auditees at ease and depersonalize the process as much as possible. If people are uneasy about the audit process, they won’t provide objective evidence, and the audit, in turn, won’t trigger continual improvement.
某些被审人员怀疑审核对他们的工作进行人身攻击，并且准备好应对审核员。他们平静地解释审核过程是针对体系的，让被审人员放宽心，审核过程尽可能的去掉个人因素。如果人们对审核过程感到担忧的话，人们就不提供客观证据，你们审核就无法启动持续改进。
Does this mean people never screw up? Of course not. But when failures are identified during an audit, they’re system failures. Very few nonconformities occur due to willful employee misconduct. If someone makes a mistake or fails to carry out a job step, it’s usually because the system is flawed and error-prone. Fix the system, and people will have less opportunity to screw up.
这是否意味着人们不再砸锅了？当然不是。但当审核时发现了失效情况，这是体系失效。只有极少数的不符合项是由于员工任意所为。如果某人做错了或未能按照作业步骤行事，那通常是因为体系有缺陷，有防错的可能。修正体系，人们就较少的砸锅机会。
Auditing strategic processes 审核战略过程
Not all organizational processes have the same strategic significance. An internal audit system that’s oriented toward continual improvement will focus on strategic issues. Most management system standards such as ISO 9001 require that organizations schedule audits based on status, importance and prior audit results. This means organizational processes with more strategic importance will be audited more often.
The following audit questions reflect on processes that typically have high strategic importance:
不是所有的组织过程具有相同的战略意义。以持续改进为导向的内审则侧重于战略问题。大多数质量管理体系如ISO 9001要求组织基于状况和重要性以及以往审核的结果制定审核计划。这意味着经常要审核组织更具有战略重要意义的过程。以下审核问题关注具有高战略重要性的过程：
* Customer satisfaction. What methods does the organization use to capture customer perceptions? How are data on customer perceptions reported and analyzed? Has overall customer satisfaction improved?
* 顾客满意。组织使用什么方法去获取顾客感受方面的信息？如何报告并分析顾客感受方面的数据？顾客整体满意度得到提高了吗？
* Corrective and preventive action. Is there proof that root causes or potential root causes are being identified? Are actions taken to eliminate root causes or potential root causes? Are data on corrective and preventive actions reported and analyzed?
* 纠正和预防措施。有识别根本原因或潜在原因的证据吗？对根本原因或潜在原因采取措施了吗？对纠正和预防措施的数据上报和分析了吗？
* Leadership. Has the organization determined its mission and strategy? Are organizational performance and direction communicated throughout the organization? Has top management led the review and action on key measures and other important information that indicates organizational success?
* 领导力。组织是否已经确定其使命和战略？是否将组织业绩和方向在组织内传达？最高管理层已经对关键措施和表明这种成功的其它重要信息进行评审和采取措施了吗？
* Internal auditing. Do auditing schedules clearly reflect the strategic importance of processes and the results of previous audits? Does the organization’s management take corrective action on nonconformities raised by audits? Are the corrective actions effective, based on the evidence?
* 内审。审核计划清晰反映出过程的战略重要意义和以往评审结果了吗？组织的管理层对审核出来的不符合项进行纠正措施了吗？证据能说明纠正措施有效吗？
* Design and development. Are design inputs and outputs recorded and approved? Is progress against the design plan periodically reviewed? Is the design process’s output validated under conditions of application or use?
* 设计开发。设计输入输出进行记录和得到批准了吗？是否对设计计划进行阶段性进展评审？是否在实际应用条件下或使用中进行确认设计过程的输出？
* Transformation. How is work planned and scheduled? What information guides work performance in general? How do employees receive feedback on their work? Do employees understand how their efforts affect key measures?
* 转化。如何进行策划和安排时间？通常什么样的信息指导工作业绩？员工如何得到关于他们工作情况的反馈？员工知道他们的工作影响关键措施吗？
These audit questions are examples and might not be applicable to all organizations. Other processes could have strategic significance, depending on the organization’s nature and competitive environment.
以上审核问题都是例子，不能适用于所有的组织。由于组织的性质和竞争环境的不同，其它过程也可能具有战略意义。
Training auditors 培训内审员
Many audits produce poor results because auditors haven’t received proper instruction or been given opportunities to practice what they’ve learned. The organization must invest the necessary time and effort in making its auditors competent and confident before they’re assigned an audit.
许多审核的结果不理想是因为内审员没有得到正确的指导或没有足够的机会去实践其所学。组织必须在内审员进行内审前，投入必要的时间和精力提高内审员的能力和信心。
Auditors must be familiar with:
* Practical interpretations of the standard adopted by the organization
* The audit’s purpose and how it drives continual improvement (i.e., by providing a balanced picture of the organization and triggering corrective and/or preventive actions)
* Phases of the audit and various activities within each phase
* Sources of audit requirements (e.g., the standard, procedures or sales orders)
* Methods of gathering objective evidence and drawing valid conclusions
* Diplomacy skills and effective interpersonal communication
* Audit role-playing under controlled conditions
* Writing nonconformities in the prescribed format
* Actual auditing with an experienced auditor
内审员必须熟悉：
* 组织采用的标准在实际工作中的解释术语
* 内审的目的以及内审如何导致持续改进的原因（即，通过提供和谐的组织描述和启动纠正和/或预防措施来实现）
* 审核阶段以及每个阶段的各个活动内容
* 内审要求的来源（即，标准、工作程序或销售订单）
* 收集客观证据以及得出正确结论的方法
* 交流技巧和有效地人与人之间的沟通能力
* 在受控条件下审核工作模拟
* 在定制表格内填写不合格项
* 与经验老道的审核员一起实际审核
Auditor training doesn’t necessarily need to be formal or even classroom-based. The style and format of training will differ significantly from one organization to the next. However, auditors must have a conceptual understanding of the process and a practical grasp of techniques, both backed up by sufficient practice. When auditors truly understand their roles and responsibilities, the process should result in strategic continual improvement.
内审员的培训不需要十分正式，甚至不需要上课。培训的风格和形式都有很大的不同。但是内审员必须对过程有概念性的了解和对技术的实际应用有所掌握，这都以需要大量的实践作为支撑。当内审员真真切切地了解他们的职责和角色时，过程就会导向战略性的持续改进。
A successful audit almost always results when an individual takes personal ownership of the process. He or she must be able to carry out the following five complex and linked activities, which create strategic continual improvement.
当个人具有过程的所有权时，常常导致内审成功。他/她能够采取以下产生战略性持续改进的五个复杂而又相互联系的方法。
1 Audit scheduling 审核进度表
An audit schedule defines the auditing that will take place during an extended period of time, usually six months or a year. The purpose of the schedule is to communicate when and where the audit team’s services will be needed, when the organization can expect to be audited, and what requirements will be included in the audit.
审核进度表确定审核的时间，通常半年或一年。进度表的目的是传达审核的时间和地点，组织期待审核的时间，以及审核所要包括的要求。
Audits scheduled far in advance always produce better results. Note, too, that the processes considered more strategically important to the organization are scheduled for audits more often. Processes and functions that have performed poorly in previous audits are also scheduled for frequent audits. Regardless of other considerations, all processes, functions and departments within the scope of the management system must be audited at least once a year.
审核进度表定的越早越好。同时要注意，认为越重要的过程审核的次数越多。在以往审核中不理想的过程和职能口也要定出时间进行多次审核。无论其它考虑如何，在质量管理体系内的所有过程、职能口和部门每年至少审核一次。
The schedule can be keyed to organizational processes, departments, functions, facilities, an ISO standard element or something else. However, it must clearly communicate which audits are coming up and when. Audit schedules should provide enough detail to guide the overall process and help with the next step, audit planning.
进度表应该与过程、部门、职能口、车间、ISO标准要素或其他相协调。但是，进度表必须清晰传达进行哪个审核和什么时候进行审核。审核进度表应该提供足够详细的信息以统领所有过程并顺利进行到下一步，审核计划
2 Audit planning审核计划
An audit plan is focused, detailing a single audit’s scope, objectives and agenda. The plan provides a chronology of the audit from start to finish: which processes will be audited, exactly when they’ll be audited, who will do it and which requirements will be audited in each segment. Even details such as meetings, breaks and lunches are shown on the plan in order to clear up any timing conflicts between auditees and auditors and keep the audit on track.
审核计划关注单一审核范围、目的和议程的细节。审核计划定出审核从开始到结束的时间表：审核那些过程，审核什么内容，谁去审以及在每个区域审核什么要求等细节。审核计划甚至包括开会、早餐和午餐这样的细节，以便消除审核员与被审人员在时间问题上的误会，并是审核按计划进行。
Typically, the audit plan is distributed several days prior to the audit. Auditees often request alterations to the plan based on logical concerns and existing commitments. By all means, modify the plan to accommodate them. The one variable that usually never changes, however, is the audit’s scope.
通常，审核计划在审核前七天发出。被审人员经常基于自身的考虑和承诺，需要做些修改。尽一切可能修改计划以适应他们。但有个东西通常不再改变，就是审核范围。
3 Audit supervision 审核监督管理
The audit’s on-site phase consists primarily of gathering evidence. The lead auditor takes part in this and also manages the overall process. These duties typically include:
现场审核主要包括手机证据。审核组长参与其中，同时也管理整个审核过程。其具有代表性的职责包括：
* Leading the opening meeting
* Managing and communicating changes to the audit plan
* Ensuring that the audit stays on track
* Insisting that auditors remain objective, consistently evaluating all evidence
* Encouraging auditors to write up their findings during the audit to avoid a time crunch directly before the closing meeting
* Reviewing all nonconformities to ensure that they’re logical, valid and clear
* Providing performance feedback to audit team members so individuals can target areas for their personal improvement
* Resolving all conflicts constructively
* Apprising the auditee of the audit’s progress
* Leading the closing meeting
* Ensuring that the entire audit is conducted professionally and positively
* 主持首次会议
* 管理和传达审核计划的变更
* 保证审核按计划进行
* 强调审核员保持客观地始终如一地评价所有证据
* 鼓励审核员在审核时写下他们的发现避免末次会议前时间不够用
* 评审所有不符合项，以保证这些不符合项是符合逻辑的，有效的和清晰的
* 给审核小组成员及时的反馈，这样小组成员就可以瞄准他们的需要改进的地方
* 积极解决所有矛盾和冲突
* 对被审人员在审核方面所取得的进展大加赞扬
* 主持末次会议
* 保证整个审核工作的专业性和积极肯定性
If these duties sound difficult, it’s because they are. Many organizations have ineffective audit processes because the so-called lead auditor doesn’t understand his or her responsibilities. An accredited lead auditor course is a very good investment for individuals who function as lead auditors for their organizations.
如果这些职责看起来很难，那是因为确实很难。许多组织审核过程无效就是因为审核组长不理解其职责所在。让那些在组织内实际发挥审核小组组长作用的人上审核组长称职课程是项很好的投资。
4 Audit reporting 审核
The first formal reporting that takes place during an audit is the closing meeting. The lead auditor presents a verbal summary of the audit, including positives and negatives. Depending on the audit’s size and duration, the closing meeting might last from 15 minutes to more than an hour. The meeting allows for back-and-forth dialogue between auditors and auditees. During the closing meeting, auditee management is presented with the written audit observations and/or corrective action requests, and these form the basis for discussion of the audit results.
第一个正式的报告发生在末次会议上。审核小组组长做口头审核总结，包括表扬和批评。根据审核范围和时间的长短，末次会议可进行15分钟到一个多小时。末次会议允许审核员和被审人员你来我往的对话。在末次会议上，在书面审核观察资料和/或纠正措施要求中提及被审部门的领导。
Subsequent to the closing meeting (and occasionally during the closing meeting), an audit report is presented to the auditee management. This summarizes the audit’s overall themes and trends. Usually it’s written by the lead auditor, based on evidence gathered by the entire audit team. The report doesn’t belabor every audit observation because these should have already been addressed during the closing meeting. Audit reports should be as concise and streamlined as possible. Graphics such as matrices and Pareto diagrams are helpful.
末次会议之后（偶尔也有在会议上）把审核报告递交给被审部门的领导。报告总结了审核的整体宗旨和倾向。通常是由审核小组组长基于整个审核小组收集的证据撰写报告。报告不对每个审核观察情况进行长篇大论，因为这些观察情况已经在末次会议上提到了。审核报告应该尽可能的简洁和简明。类似矩阵图和排列图是很用的。
5 Verification and closure 验证和关闭
The auditee management is usually asked to respond to audit nonconformities by an agreed date. The response should include investigation into the root cause, proposed corrective action and a date when the action should be completed.
通常要求被审部门的领导按期对不符合项做出反应。反应包括发现根本原因，提出纠正措施和措施完成的时间。
The lead auditor reviews the responses to determine whether the investigation and proposed corrective actions are adequate. This is the first stage of verification.
One of the most important jobs the lead auditor and auditing team can perform is a careful scrutiny of auditee responses. Accepting weak investigations and/or corrective actions does nobody any favors and certainly doesn’t trigger continual improvement. If a response doesn’t identify a plausible root cause or propose a corrective action related to it, the lead auditor must diplomatically reject the response and explain to the auditee why it’s adequate. The auditee is the audit process’s customer and should be treated with the same respect that any other customer would receive.
审核小组组长评价这些反应并确定根本原因的发现过程和提出的纠正措施是否适宜。这是验证的第一步。审核小组组长和审核小组最重要的工作之一就是仔细审查被审部门的反应。接受不积极的反应和/或纠正措施不是使大家满意，肯定不会激发持续改进。如果反应未识别出似是而非的原因或提出相关的纠正措施，审核小组组长必须巧妙地回绝，并对被审部门解释其原因。被审部门是审核过程的顾客应该受到与其他顾客相同的待遇。
The second stage of verification occurs when the auditee notifies the lead auditor that corrective action has been implemented. At this stage, the lead auditor or a team member will verify that the corrective action has been fully implemented and the root cause of the original nonconformity has been eliminated.
Verification is sometimes performed by reviewing records or documents submitted by the auditee; alternatively, an on-site visit is made to review evidence in person. The nonconformity’s nature and significance will determine whether on-site verification is necessary.
验证的第二步发生在被审部门通知小组组长纠正措施已经完成的时候。再次阶段，小组组长或小组成员验证纠正措施是否已经全部完成，产生不符合项的根本原因已经消除。
Once all audit nonconformities have been addressed with effective corrective action, the audit is considered closed. However, this doesn’t mean it’s forgotten. A high-level discussion of audit results is an important input to the business review process, and audit trends influence resource allocation and strategic decision making.
一旦有效地纠正措施纠正了所有的审核不符合项，就可以认为审核工作结束了。但是，这不意味着审核就可以被忘记了。审核结果的更高层次的讨论是业务评审过程的重要输入，审核倾向影响资源的分配和战略性决策。
From Craig Cochran
没有评论:
发表评论