Why internal audits earn their keep

External assessment days are expensive, stressful and, in the worst case, revealing. Internal auditing is how you find the gaps first, while there is still time to fix them quietly. For UK laboratories working to ISO 15189, ISO 17025, Good Laboratory Practice or the MHRA's expectations for in vitro diagnostic work, internal audit is not an administrative ritual. It is the mechanism that keeps a quality management system honest between assessments.

The trouble is that many laboratory quality managers inherit an audit programme that generates paperwork rather than insight. Audits get scheduled because the calendar says so; findings are vague; corrective actions close on paper and recur six months later. The skills below are the ones that separate a defensive audit from a genuinely useful one.

Planning that targets real risk

A good audit plan is a risk assessment in disguise. Before writing a schedule, ask where the system is most likely to fail and where failure would hurt most. A biochemistry analyser with a validated interface is lower risk than a manual molecular workflow that changed three months ago, or a sample referral pathway to a partner laboratory.

• Define scope, criteria and boundaries precisely. "Vertical audit of the histopathology pathway against ISO 15189 clauses 7.2 to 7.5 and our own SOPs" beats "audit histology".
• Choose the right shape: horizontal audits trace one clause across departments, while vertical audits follow a single sample or patient journey end to end. Vertical audits often expose handover failures that clause-by-clause checks miss.
• Read the evidence beforehand. Previous findings, nonconformity trends, complaint logs, EQA performance, turnaround time data and change control records tell you where to dig.
• Give the auditee at least two weeks' notice, with the questions or process areas you intend to cover. Surprise is not a quality tool.
• Build in time. A rushed audit produces superficial findings and erodes trust with the staff you will need to question again next year.

Questioning that gets past the script

Most audits fail at the questioning stage. Closed questions ("Do you follow this SOP?") invite a yes, and a yes is not evidence. Your goal is to understand how work is actually done, not how it is described in the document control system.

Start broad and narrow down. "Walk me through what happens when a sample arrives out of temperature range" is a good opener. Follow with probe questions: "What happens next?", "How do you know?", "Who decides?", "What if that person is not in?" Then test the edges: "When did that last happen?", "Show me the record for that occasion."

Watch for the three signals that something is worth pursuing: hesitation, hedging language such as "usually" or "normally", and a sudden shift to quoting the SOP rather than describing practice. Stay neutral. Auditors who sound like inspectors get compliant answers; auditors who sound curious get accurate ones. Take notes visibly, and reflect back what you have heard so the auditee can correct you.

Gathering evidence you can defend

A finding is only as strong as the evidence behind it. Objective evidence in a laboratory setting includes records, worksheets, logbooks, audit trails, calibration certificates, training files, EQA reports, and direct observation of practice. It also includes the absence of a record where one is required, which is a legitimate finding in itself.

• Triangulate. If a SOP says one thing, an analyst does another and the record shows a third, you have a genuine nonconformity rather than a misunderstanding.
• Sample deliberately. Pick records that are recent, unusual and routine. Ask for the out-of-hours batch, the rejected sample, the amended report.
• Observe competence, not just compliance. Watching a colleague perform a manual differential or set up a PCR plate tells you more than a signed competency form.
• Record the specifics. Note the sample identifier, date, equipment number and document version at the time. Vague evidence collapses under challenge at the closing meeting.

Writing findings that survive scrutiny

A well-written nonconformity has three parts: the requirement, the evidence and the gap between them. Keep it factual and free of diagnosis. "Three of ten maintenance logs for analyser 4471, reviewed on 14 March, had no entry for the weekly probe check required by SOP EQ-012 issue 4" is defensible. "Staff are not completing maintenance properly" is an opinion that will be argued with.

Quote the clause and the procedure version. Avoid words like "inadequate", "poor" or "failure of attitude". Classify findings consistently — major, minor or observation — using definitions your laboratory has agreed in advance, and apply them the same way across every auditor. If corrective action is not yet known, say so; the auditee owns the root cause analysis, not you.

Closing the loop and sharpening your auditors

The audit is not finished when the report is issued. Agree actions with owners and dates, then verify effectiveness, not just completion. Re-checking that a form has been updated is not the same as confirming the process has changed. Build a small number of follow-up checks into the next audit cycle.

Finally, invest in your audit team. Rotate auditors between departments, pair less experienced staff with seasoned ones, and review a sample of reports together to calibrate how you grade findings. A short annual refresher on questioning technique and evidence standards keeps the programme credible. Done well, internal audit becomes the part of the quality system that colleagues actually value — a chance to solve problems before an assessor finds them.