Better audits,written down
Practical guides for the people who plan, run and answer ISO audits. Each one works with or without Orisynx. For the vocabulary, see the audit glossary.
How to plan a risk-based audit programmeA practical method for building a year's internal audit programme around process importance, recent changes and earlier results, with a worked example from a metals manufacturer.
How to write an audit finding that gets fixedA finding that names the requirement, shows the evidence and states the gap clearly is hard to dispute and easy to act on. Here is the structure, with weak and strong examples side by side.
Major vs minor nonconformity, and OFIsThe difference between a major and a minor nonconformity decides whether certification is held back. Here is how the grades are usually applied, with examples, and how to set up a consistent scheme for your own audits.
Root cause analysis and corrective actionMost repeat findings come from corrective actions that fixed the symptom. This guide covers correction versus corrective action, a worked 5 whys, a short fishbone method and how to choose actions that remove the cause.
How to check a corrective action workedImplementing an action and proving it worked are two different checks. This guide covers what effectiveness evidence looks like, how long to wait, how to grade the result and what to do when the problem comes back.
Preparing for an ISO certification auditA certification audit tests whether your management system is in place and working. This guide explains the stages and the three-year cycle, the records auditors usually sample, and a week-by-week plan for the final three months.
ISO certification in Nigeria: how it worksCertification bodies, accreditation, SON's two different schemes and the audit cycle explained for Nigerian organisations, with practical advice on choosing a certification body and avoiding the usual nonconformities.
NDPA 2023 and ISO 27001: where they meetISO/IEC 27001 certification is not NDPA compliance, but a working ISMS produces much of the security evidence the Act and the NDPC's compliance audit returns ask about. Here is where the two overlap and how to audit for both.
Getting audit-ready for vendor prequalificationPrequalification questionnaires and supplier audits test the same thing: whether your management system runs and leaves records. Here is what Nigerian buyers can ask for, a readiness checklist, and how to audit yourself first.
How to run an internal audit, step by stepA practical walk-through of one internal audit, from setting the scope and criteria to verifying the corrective actions, based on ISO 19011 and ISO 9001 clause 9.2, with a sample timetable for a one-day process audit.
How to build an internal audit checklistA checklist that asks 'is there a procedure?' gets a yes and teaches you nothing. Here is how to write process-based questions that ask for evidence, tie each one to a criterion and tell the auditor what to sample.
Independence and impartiality for auditorsInternal auditors should not audit their own work, but small organisations rarely have a dedicated audit team. Here is what the standards actually ask, the practical options, and how to check competence and conflicts before each audit.
Opening and closing meetings that workThe opening meeting sets the terms of the audit; the closing meeting decides whether its findings are accepted. Here are agendas for both, who should attend, and how to present findings without starting an argument.
Writing the internal audit reportThe report is the only part of the audit most managers will read. Here is what it should contain, how to keep it short and factual, who should receive it, and how audit results flow into management review.
See it with your own audits
Bring an audit you have already run. We will walk it through Orisynx with you, from the plan to the last closed corrective action.