The board of a diversified multiproduct, geographically spread group of companies was meeting to review the performance of its new pharmaceutical factory that was set up recently in Uttaranchal. Since this was the first foray of this group in pharmaceuticals, the Audit Committee wanted to take no risk about the quality of products, as the survival of the group would be at stake in case of any mishap. Though the new factory was FDA approved, the Audit Committee decided that the internal auditors should also review the practices of the Quality Control and Assurance Department.

The in-house Chief Internal Auditor immediately agreed to enhance the scope of the internal audit and informed the Audit Committee that his team would table a report at the next Audit Committee meeting.

In addition to the methodology in terms of data gathering and analysis before conducting the internal audit, additional steps taken were :

Based on the above, a checklist was developed which is given in Annexure ‘A’.

Since the factory was new, most of the data was available only for the first six months and no major deviations were observed. It was appreciable that there were no significant deviations in the process for Quality Control department and this fact was mentioned in the internal audit report.

It was recommended that the next review be carried out after one year only.

Audit Committee expressed appreciation on the work carried out by the internal audit, despite there being no significant observations. Since there was no significant observation, the Audit Committee members had a look at the methodology including the extent of checks and the checklist. They were satisfied with the in-depth work carried out by the internal auditors. They concluded that this only showed that the processes in Quality Control were quite robust and this augured well for the organisation. This exercise thus gave the assurance the Audit Committee was looking forward to. The Audit Committee recommended that the ‘checklist’ be used as a self assessment checklist and the Quality Department Head should review the same every quarter.

The function of the internal auditor is both to point out lapses and affirm good functioning. In the instant case, he affirmed what exists was good but he does not relax. On his next visit, he will be as critical as he was on his first visit, because the persons who do a good job after affirmation tend to become ‘lax’. The internal auditor should not indulge in this luxury and always use his tool of professional skepticism.