Como você projeta e implementa um programa de auditoria de qualidade que abrange todo o ciclo de auditoria?

The first step in designing a audit programme is to determine your audit universe - what entities, processes, systems or themes should be covered. The next step is to decide on frequency - this should be risk-based, dependent on the risk to the business, customer, other stakeholders, etc. It should also consider the regulatory framework and external environment. The audit universe and schedule should then be shared with key internal stakeholders - senior management, compliance, legal, etc - for their review and comments.

In my opinion, Audit program must be designed in a manner to include atleast following o Review the information systems. o Review record-keeping policies. o Review the accounting system. o Review internal controls policies. o Comparing the internal records. o Review the Statutory Compliances. And The audit program should be updated throughout the fieldwork stage for any new information and identified issues.

The audit criteria should also include regulatory standards where appropriate. Where sampling is used, it should be based on robust statistical criteria.

In the audit program's design, the following step is to choose the audit criteria and methods for assessing the audit subject. The audit criteria represent the benchmarks or standards against which the audit subject will be assessed, which could include ISO 9001, industry guidelines, or specific customer requirements. Meanwhile, the audit methods encompass the tools and techniques used to gather and analyze audit evidence, including interviews, observations, surveys, or document reviews. It is imperative that the selected audit criteria and methods are pertinent, dependable, and in alignment with the audit's scope and objectives.

Define criteria and QA audit scope to ensure compliance of SOPs, study protocol, regulatory requirements etc. Use authentic Audit methodology considering audit objective. A well designed audit checklist covers all aspects to be used during the audit. Quality Assurance Program may consider the following audits: 1. Facility or system 2. Process 3. Vendor Qualification audit 4. For cause audit 5. Gap analysis audit 6. Study based: - Pre- study audit - During study audit - Post study audit

After you have determined the scope of the engagement and established what could go wrong you then research what should be (standard, regulations, corporate policies, best practices) then you conduct interviews and walk through to verify what if any controls are in place. The walk through looks at design of control. After you determine what controls are in place you determine what will be the test of effectiveness used to validate if the control is working which can be data analytics, attribute test will be used to verify the the control will mitigate the risk.

after defining the audit objectives and scope we need to determine the relevant criteria from regulatory standards, ISO standards, industry best practices and internal policies from here we can start select the most proper audit methods and tools as sampling techniques, using analytical methods, and data gathering and collection methods

The audit plan should be shared with the auditee, to ensure that all relevant personnel are available for interview when required. It should be detailed enough so that the auditee understands what is required, but not so detailed that it restricts the auditors from exploring previously unidentified risks and issues.

Developing an audit plan is the most important step which includes: schedule of audits (dates, times); Audit scope and objectives for each audit; Resources required (personnel, tools); Risk-based prioritization of audits, etc Developing a right audit plan helps to ensure the proper execution and closure of the audit.

The third step is to plan and prepare the audit activities that will be executed during the audit. This includes creating an audit plan that outlines the audit schedule, allocated resources, roles, responsibilities, and expected deliverables. Additionally, audit checklists should be prepared, specifying the precise questions, tasks, and criteria to be used in the audit. Both the audit plan and checklists should be communicated to and agreed upon by the auditee, the entity being audited, and the audit team, which comprises the auditors responsible for conducting the audit.

Planning the audit process is very important. In a simple way make a criteria with High, medium and low categories or Red, Yellow and Green categories. These categories should be assessed with the KPIs performed of each process and based on this Right and competent auditors shall be identified. Based on the actual performance few processes will be in Red few will be in yellow and few will be in the green category. Based on this evaluation you can give more priority and time to the Red and yellow categories of processes so that the audit will become more effective.

I completely agree with Richard below. The audit plan must be shared with the auditee(s) in advance. Not so that they can prepare "the right" answers but to remove stress and assure that the correct personnel are available to provide the needed information. "This is NOT a test. I just want to understand how you do your job." One of the goals of an audit should be that there are no surprises - no surprises about what will be audited, no surprises about what was found.

The finding should not just list the non-compliance with regulations / standards, etc, but also include the "so what" - why is this an issue - what are the risks to the business or customer, etc?

You need to eliminate the second sentence because that is not executing the report, that is performing the audit. You also should include that the report should be written in active voice, and minimize the use of jargon, and focus on who is the audience of the report, and what information they need to know.

During the audit Execution or conditions refer to the audit plan and checklist to cover the audit agenda and objectives. I feel the care must be taken while reporting the audit findings which may include but not limited to: 1. Report must be easy to understand with applicable reference or evidence if any 2. Suggestion and recommendations are encouraged to minimise repeated findings in future. 3. Any deviations 4. Nonconformities 5. Report observations in a clear and concise way to reflect what, where, how, who, why etc. It is advisable to discuss the concern or finding during the audit which may avoid any non compliance or deviation.

During audit process, information and supporting documentation that was gathered by auditor is called audit evidence. It takes various forms such as reports, interviews, findings and any other relevant documentation or data. Audit Findings are the results or conclusions drawn by auditors based on the evaluation of audit evidences that was gathered. Findings can be positive, compliance, negative, non-compliance, observation and areas for improvement. Audit Findings provide insights into the current state of the process, controls and systems.

Clear and concise reporting of audit findings and recommendations is crucial for effective communication. For the audit report of the Bank's loan, I used a structured format that included an executive summary, detailed findings, risk ratings, and actionable recommendations. The report was presented to senior management, highlighting critical issues and suggested improvements.

Follow up audits should happen for the specific nonconformities. It should be done with the auditee where the actual nonconformities were observed. The auditor should ensure the sustenance of the actions with the monitored data, required evidence related to the actions and interrelated documents or records. "These actions or NC points should be linked with the audit checklists so that the sustenance can be verified in the future"

Audit report follow up is required if findings are not closed and need long actions, any additional support from others or management support. Revisit the audit program to check effectiveness and any updates required if any. Audit program ensures the compliance of organisation quality system

Continuous monitoring and feedback help maintain the effectiveness of the audit program. In my role, I implemented a system for ongoing monitoring of key controls and risk indicators. Feedback from each audit was used to refine audit procedures and update the audit plan, fostering a culture of continuous improvement.

Continuous improvement by verifying corrective actions, ensuring effectiveness, and updating the audit program based on lessons learned and changes is an ongoing process to maintain audit relevance and efficiency.

in simple words ensure there is a follow-up process to track the implementation of audit finding and recommendations. by this this we implement PDCA for the audit cycle and ensure the continuous improvement achieved with the alignment of organization and audit objectives

The audit group should also have a charter that details their role and responsibilities, and especially their authority. They should be independent of the business being audited, with a reporting line to a responsible senior executive.

Diagram of the audit cycle 1)Design considerations When designing a quality audit program, there are a number of factors to consider, such as: The size and complexity of the organization The organization's risk profile The organization's industry and regulatory requirements The organization's resources The organization's culture. 2)Implementation considerations When implementing a quality audit program, it is important to: Communicate the audit program to all stakeholders Provide training to audit team members Conduct audits on a regular basis Follow up on audit findings and ensure that corrective and preventive actions are implemented

All of the suggestions are straight out of ISO 19011 and they are all conformance based. Come to the ASQ Quality Audit Division conference in Reno next week and discover the new direction for management systems auditing

It involves establishing clear objectives, defining the scope, and developing structured procedures for each phase of the audit cycle. For example, start by setting audit goals aligned with organizational priorities, such as improving operational efficiency or ensuring regulatory compliance. Next, define the scope, including key areas to audit, resources required, and timelines. Develop detailed audit procedures covering planning, fieldwork, testing, reporting, and follow-up. Use tools like audit checklists, risk assessments, and quality benchmarks to ensure consistency. By documenting and standardizing each phase, you create a comprehensive and repeatable audit program that ensures thorough coverage of the entire cycle.

Un ciclo de auditoría es de 3 años para el organismo de certificación según la ISO 17021. En tal sentido, podría ser un criterio a considerar para el programa de auditorías internas a fin de alinearse a su ciclo de certificación. También tomar en cuenta la importancia los procesos, los cambios en el sistema de gestión y los resultados de las auditorías previas (internas y externas); así como, el alcance a cubrir y el número y competencias de los auditores