Internal auditing at full power

Neil Marshall provides tips on how to get the most out of internal audits of environment management systems

Organisations that adopt and implement a robust environment management system (EMS) and policy not only reduce their impact on the environment, but in many cases save money and improve resource efficiency.

However, without an effective internal auditing regime organisations cannot hope to get the most out of their EMS. Key to the success of management system audits is clarity of purpose and skilled auditors.

First, and most important, an organisation must be clear about the intended outcome of an internal audit. This requires careful planning and attention to detail, as well as setting a theme for the audit. An assessment may be planned for a number of reasons, including:

• to ensure that a standard has been implemented;
• to check procedures are being adhered to;
• to make sure employees fully understand their responsibilities and the potential consequences of not adhering to systems and procedures; and
• to determine the level of compliance with legal and other requirements.

If a clear objective is not set out ahead of the audit, then the outcome is likely to lack coherence.

Once a theme has been chosen, a programme of audits must be planned that assesses operations under normal, abnormal and emergency conditions to ensure that the risk of pollution, prosecution and financial penalties is minimised.

Auditing emergency preparedness will test understanding of procedural requirements, the availability of emergency equipment and ensure necessary corrective actions are being recorded and implemented. Observing staff behaviours and practices in such situations is critical to establishing the level of risk posed to the organisation and to minimise potential impacts on the environment.

Competent auditors

Good communication skills and the ability to work across all levels of a business are essentials in the internal auditor's skills set. Assessors also need a comprehensive understanding of the industry in which the organisation works, attention to detail and knowledge of appropriate legislation.

ISO 19011 provides a framework for best-practice auditing and offers guidance on fundamental principles, such as: how to manage an audit programme; how to conduct audits; and how to evaluate the competence of individuals involved in the audit process.

Having assessors trained in line with 19011 can help to ensure their effectiveness. Meanwhile, qualified lead assessors, with graduate or postgraduate qualifications in environment management, earth sciences and chemistry, are often able to determine regulatory compliance in a more analytical fashion.

To build an internal assessor skills base in your organisation, it is best to team new assessors with experienced ones to develop skills and improve internal practice.

Placing inexperienced assessors with facilities management employees, for example, tends to broaden the new assessor's knowledge and understanding of the "source-pathway-receptor" concept, an approach that helps to protect human health and the wider environment.

Facilities management employees often have a good understanding of the inputs and outputs of processes, along with their associated controls. They also tend to have an appreciation of the main impact areas, such as waste management, effluent discharge and air emission abatement processes.

One of most important skills needed by internal auditors is the ability to interview colleagues.

The key to success with interviews is preparation. If the interviewee does not understand what the audit process involves or what the aim of the interview is, for example, then this can lead to conflict.

Putting people at ease is the first essential requirement. An informal chat is a good place to start, and providing positive feedback on successes and observations of best practice is recommended.

When asking people to show examples of forms or reports, auditors should be aware of those who try to change the subject or produce alternative documentation to divert attention. This often happens because the interviewee cannot find the paperwork the assessor has asked for. Internal auditors should also watch out for open files that are suddenly shut.

Often this means that the interviewee has found an error or nonconformity. The best way for assessors to get the information they require is to develop a positive relationship with the teams they are auditing.

The auditor's aim should be to create a good rapport with a group, so that it is happy to give impartial "all areas access" for the benefit of the business.

Ensuring compliance

Environmental legislation often requires records to be held or specific practices to be adhered to. An audit evaluating compliance with the Waste (England and Wales) Regulations 2011, for example, should ensure that the required documents are completed correctly, are retained on file for a defined period and stipulated practices are witnessed.

The internal auditor must know exactly what needs to be recorded on the waste notes. Failing to spot an error could result in the regulator issuing a civil sanctions order or notice, both of which could harm the organisation's reputation.

When evaluating compliance with legal requirements, a detailed audit report should be developed to a level where the audit trail information could be used to defend the organisation should it be challenged by a regulator. This, in turn, reduces the risk of prosecution and damage to corporate reputation.

When assessing compliance with complex areas of legislation, such as verifying greenhouse-gas emissions, some organisations supplement their internal auditing skills base with external experts.

Employing outside professionals with specialist regulatory knowledge can help to address potential high-risk areas where a breach could potentially result in prosecution and fines. Analysing air emission reports is one such area as this can be very confusing to the less experienced assessor. Specialists, by contrast, will be more aware of the common pitfalls in establishing whether emissions outputs meet permit requirements.

Report and review

The audit report should record all findings, whether these are nonconformities that require corrective action, observations where systems could potentially break down in future or opportunities for improvement, such as simplifying the system and removing unnecessary duplication.

Responsibility and deadlines for corrective actions should be clearly defined, and then monitored to ensure the required actions are implemented and effective.

The report should be designed to deliver the maximum impact. It is a good idea to present the highest-risk findings at the start of the report as part of the summary. Top management teams need to know the level of risk being taken by the organisation to avoid damage to corporate reputation.

Reports generally start with major nonconformities, before outlining minor ones and opportunities for improvement. It is also very important to disclose the positive findings of the assessment because other areas of the business may be able to implement similar processes.

Once the report is completed, the internal audit schedule should be amended based on the perceived risk of not adhering to the standard, procedures or regulations.

High-risk areas of the system - those where nonconformities are more common or prosecution would severely impact the organisation - should be audited more frequently than low-risk areas.

One of the most common difficulties faced by internal auditors is in ensuring the audit programme addresses the whole management system. Most organisations start off with good intentions, assigning personnel to complete audits and making sure colleagues are going to be available. However, keeping to the programme is often extremely difficult: business priorities can take over and the schedule start to slip.

Some organisations also struggle to reach agreement on the actions that need to be taken to address nonconformities. Setting and monitoring deadlines for the implementation of actions can feel like a thankless task, so it should be assigned to someone with tenacity.

One way to overcome such issues is to ensure that the EMS is adopted throughout the organisation, from the boardroom to the shopfloor, that way its true value is understood and buy-in to the audit process is easier.

To summarise, internal audits should be planned, themed, delivered effectively and the findings communicated widely. Audits must be conducted in an impartial and objective manner following a documented procedure.

The purpose of an internal audit is to gather facts and determine the degree to which requirements of a standard, such as ISO 14001, or regulations and contractual requirements are being met.

Putting a spotlight on the business in this way is not only an opportunity to highlight areas for further improvement and enhance business performance, but also a chance to reward best practice and celebrate success.