WORKSHOP 4

Quality Audit and Internal

Audit

24 September 04 Audit and Internal Control days

23 and 24 September 2004
Stated position of the Internal Audit - Quality IFACI
• "The Quality Management System is a component of
internal control"

• "The Quality Management System, the quality department

and the quality processes fall within the scope of internal
auditing in the context of its responsibility for assessment of
the whole internal control system " (cf. 3-layer model of
Michelin's internal control levels: operational-field,
functional, corporate)

• The Internal Audit Department may be involved in the

Quality Management System as a steering process

24 September 04 Audit and Internal Control days

23 and 24 September 2004
 Internal audit standards (IIA) - 2050

"The head of the internal audit must share

information and coordinate the activities with
the other internal and external providers of
assurance and consulting services"

24 September 04 Audit and Internal Control days

23 and 24 September 2004
 Plan

• Scheduling of audit missions

• Planning of the audits
• Work in the field
• Audit reports
• Monitoring of action plans in response to the
recommendations

24 September 04 Audit and Internal Control days

23 and 24 September 2004
 Scheduling of audit missions
• Information about the programmes must be shared
 The divisions and DRs must put the quality audit programmes online
 DACR already publishes an ad hoc abstract of its audit programme
online

• In the event of duplication, coordination: depending on the

circumstances, this may lead to postponement or reformulation
of one of the two missions
• It should be noted that the internal audit requests made at local
level are not backed by risk-mapping tools; we suggest that a tool
of this type should be created at local level, using self-
assessment, for example, thus helping to improve the consistency
of the audit programmes
24 September 04 Audit and Internal Control days
23 and 24 September 2004
 Planning of the audits
The units are covered by regional quality audits (internal and
certification audits), national quality audits, SOX audits and
internal audits
The choice of the sites and audit periods is therefore crucial

The mission directors must contact the quality managers in the

divisions and DRs when they launch a mission, as well as the
Regional Directors and DUOs (current practice)
When organizing the mission launch meetings, the quality
managers in the divisions and DRs must be informed.

necessity of sharing the list of internal auditors (which already

exists) and DR and division quality auditors (to be drawn up)

24 September 04 Audit and Internal Control days

23 and 24 September 2004
 Planning of the audits
(definition of audits)

In the preliminary plan, the auditor can integrate issues highlighted

by Quality
Similarly, the quality auditor must integrate issues highlighted by
the internal audits

24 September 04 Audit and Internal Control days

23 and 24 September 2004
 Work in the field

• Necessity of genuine coordination between internal auditors and

quality auditors for audits in entities.
• This may extend to meeting the auditees together, consolidating
the enquiries for both the internal audit and the quality audit, to
limit the number of interviews

• Necessity of creating, updating and sharing the files from the

audited sites between DACR and Quality (division and DR)

24 September 04 Audit and Internal Control days

23 and 24 September 2004
 Reports
• The internal audit and quality audit results must be
communicated to the quality auditors and internal auditors when
they begin a mission.
• When the missions have been completed, the "local" internal
audit reports should be provided to the quality managers by the
regional director and the unit director involved (standard letter
to be modified by DACR so that it can be proposed to the DRs
and DUOs)
• The regional quality audit reports must be sent to the division
quality managers
• Internal auditing can access these reports and the national
quality audit reports via the quality departments of the divisions

24 September 04 Audit and Internal Control days

23 and 24 September 2004
 Monitoring of the action plans in response to
recommendations
• During quality audits, the progress and effectiveness of the
action plans responding to the recommendations in the internal
audit reports are examined. Internal Audit is notified in the event
of a problem
• Full-scope (entity) audits assess the operation of the Quality
Management System (particularly by monitoring and measuring
the effectiveness of the action plans in response to the quality
audit recommendations)
• The action plans resulting from the DACR audits are included in
the action plans steered by the national process managers, skills
managers and other key supervisors

24 September 04 Audit and Internal Control days

23 and 24 September 2004