ISO internal audits and compliance gap assessments
An internal audit gives management a structured view of how requirements are being implemented and where action is needed. The safety consultant provides internal audits and gap assessments for laboratories and organisations, based on the agreed standard, activities and scope.
Systems and activities covered
Support can cover ISO/IEC 17025 laboratories, ISO 9001 quality management, ISO 14001 environmental management and ISO 45001 occupational health and safety management.
An engagement may address a complete system, a selected process, preparation for external assessment or the follow up of previous findings.
How an audit is approached
Scope and criteria
The objectives, applicable requirements, participants and available evidence are agreed. Planning also considers auditor competence and objectivity, including any previous involvement in the processes being reviewed.
Documents and implementation
Procedures and records are considered alongside interviews, process sampling and observations where appropriate. In a laboratory, following a selected test from the initial request to the issued report can reveal how different parts of the system interact.
Clear findings
The report identifies the requirement, relevant evidence and finding. This helps the organisation understand what needs attention and how subsequent action can be evaluated.
Corrective action follow up
Support can include root cause analysis, allocation of responsibilities and review of the effectiveness of actions. The extent of follow up is defined as part of the engagement.
What will your organisation receive?
Documented findings and a basis for assigning and tracking further action. Any additional support for addressing gaps, conducting a follow up review or preparing management review information should be agreed in the scope.
How does a gap assessment differ from an internal audit?
A gap assessment maps the difference between the current position and a defined set of requirements or project objective. It is particularly useful when deciding priorities at the beginning of implementation or after a significant change. An internal audit evaluates operating arrangements against established criteria and seeks evidence of how the system works. The initial discussion identifies which task is needed, what information is available and the intended deliverables. This prevents a limited document review from being mistaken for a complete evaluation of complex operational activities.
How are samples and findings selected and documented?
The audit programme considers objectives, risk, previous findings and changes in the organization. Records, interviews and observations are selected to examine relevant processes and interfaces. Following one job from the original requirement through to the final report can reveal how responsibilities connect. The scope and sampling limits are recorded. A useful finding identifies the criterion, the evidence and the gap, allowing the process owner to understand what requires investigation. The report distinguishes nonconformities, observations and improvement opportunities according to the agreed framework and does not claim to cover activities that were outside the review.
What happens after the audit report is delivered?
The organization assigns responsibility and timing for each required action. Immediate correction is distinguished from action intended to prevent recurrence. Follow up examines implementation and whether the change has been effective, using suitable records, observation or review of subsequent work. If an issue returns, the original analysis may need further examination. The safety consultant can support the response and readiness for an external assessment. Internal closure of an action does not guarantee that an external body will accept the response without its own evaluation of the evidence.
When can an audit be performed remotely?
The method depends on what needs to be observed and the information that can be evaluated remotely. Documents and interviews may be suitable for online review, while equipment, working conditions or practical activities may require a site visit. A combined approach can be agreed, including access arrangements, staff availability and information handling. Auditor competence and objectivity are considered in relation to the activities reviewed. Provide the relevant standard, scope, previous findings and intended timing so the safety consultant can discuss a proportionate audit programme and clearly defined deliverables.
Common questions
Can an external consultant conduct an internal audit?
Yes. It is an audit undertaken on behalf of the organisation. Relevant competence and objectivity remain important.
Can an audit be conducted remotely?
Some evidence can be reviewed remotely. Activities that require observation of equipment, facilities or practical work may need an on site visit.
Does this replace the external assessment?
Internal audits support the organisation's own evaluation. Accreditation or certification assessment remains a separate process conducted by the relevant body.
What is the next step for your organization?
Contact the safety consultant with a description of your activities, the requirement you need to address and any relevant deadline. The initial discussion will help define the consulting scope, expected deliverables and involvement required from your team.