AW-24 — Internal Audit and Corrective and Preventive Action

1. Purpose and scope

Purpose. To give IoL objective evidence that its procedures are followed and effective, by auditing each one on a risk-based cycle against its own controls and measures, by people who do not run it, and to ensure that every non-conformity found by audit or raised by any procedure is corrected at its root cause, verified as effective, and tracked for recurrence in one register.

Scope statement. This procedure manages the internal audit programme from annual planning to reporting, and the CAPA register from the raising of a non-conformity to verified closure.

Applies to. All 25 AW procedures and all 26 WF workflows; non-conformities raised by audit, by any procedure's control (for example AW-03 uncontrolled document in use, AW-05 approval outside delegation, AW-10 purchase splitting, AW-06 control failure, AW-17 incident root cause, AW-20 upheld complaint); observations and opportunities for improvement from any source.

Does not apply to. OBEF corrective action plans, which WF-04 owns in the MoHESR template; MBRU institutional audits, accreditation and ISO certification findings, which are tracked to closure here but graded by the external body; disciplinary matters, which follow AW-09 or WF-11.

Boundary with WF-04. A finding about a KPI value, an OBEF flag, a submission or a performance gap against an OBEF target is referred to WF-04 and closed here as referred. A finding about whether a procedure was followed, including a procedure in the academic pack, stays here. One root cause may generate both a CAP entry and a CAPA entry; each register cross-references the other.

2. Trigger, boundary and interfaces

3. Roles and accountability

Process owner. IoL Quality Lead or equivalent [IoL to confirm], with authority to schedule an audit of any procedure and to refuse closure of a CAPA without effectiveness evidence.

[CONTROL] Segregation. No one audits a procedure they own, operate or line-manage. The CAPA owner does not verify their own action. Procedures owned by the Quality Lead are audited by a trained auditor from another IoL function or by MBRU quality [IoL to confirm].

4. Procedure

1. Build the annual programme. Every AW and WF is scheduled at least once in a cycle of ______ years [IoL to confirm; assumed three], with annual audit of procedures that are high risk (AW-06 score), handle money or personal data (AW-04, AW-05, AW-10, AW-11, AW-16), had a major non-conformity last cycle, or feed OBEF flags at WF-26's request. The Senior Director, IoL, approves the programme through AW-01. [CONTROL] No procedure goes unaudited for longer than the cycle.

2. Assign the auditor. A trained auditor with no ownership, operating or reporting-line relationship to the procedure is assigned and the independence check recorded. Auditor training is held in AW-07 records.

3. Plan the audit. The lead auditor builds the checklist from the procedure itself: each [CONTROL] marker, each key control, each service standard, each performance measure and the RACI segregation statement. The plan states sample size and period, records to be drawn, people to be interviewed and the date, and the auditee is notified 10 working days ahead. [CONTROL] The checklist derives from the controlled version current for the audit period, not from the auditor's understanding of it.

4. Conduct the audit. The auditor samples records from the systems named in the procedure, tests each control against the sample, observes practice and interviews staff. Evidence is recorded against each checklist item with the record reference; a finding cites at least one specific instance.

5. Grade findings. Each finding is one of: major non-conformity (a control absent or systematically not operating, a legal or safety requirement breached, or a repeat minor); minor non-conformity (an isolated lapse against a control that otherwise operates); observation (a risk of future non-conformity); opportunity for improvement. Findings are agreed with the auditee at a closing meeting; disagreement is recorded and the process owner decides.

6. Report. The report states scope, sample, findings with grade and evidence, a conformity statement and positive practice. The Senior Director, IoL, accepts it and each non-conformity enters the CAPA register. Decision point. A major non-conformity is reported to the Senior Director, IoL, on the day it is found.

7. Receive non-conformities from procedures. Any procedure owner raises a non-conformity in the register when a control in their procedure detects a breach, with the evidence. The process owner confirms the grade. [CONTROL] A breach detected by a control and not entered in the register is itself a non-conformity.

8. Correct. The CAPA owner applies the immediate correction (withdraw the document, reverse the approval, restore the record, notify the affected party) and records it with the date.

9. Analyse root cause. For every non-conformity the CAPA owner records the root cause using a stated method (five whys, cause and effect) and identifies whether the cause is the procedure, the training, the system, the resource or the person. [CONTROL] "Human error" is not accepted as a root cause; the register requires the condition that allowed the error.

10. Plan corrective and preventive action. Corrective action removes the root cause so the non-conformity does not recur; preventive action addresses the same cause where it exists in other procedures. Each has an owner, a date and the evidence of completion expected. Actions needing resource go to AW-02; actions changing a procedure go through AW-03; actions creating a risk go to AW-06. The process owner approves the plan.

11. Verify effectiveness. After the actions are complete and after an interval long enough for recurrence to show [IoL to confirm; assumed 3 months for minors, 6 for majors], someone other than the CAPA owner tests whether the non-conformity has recurred and whether the control now operates. [CONTROL] A CAPA closes only on documented effectiveness evidence; completion of the action is not closure.

12. Track recurrence. The register links every new non-conformity to any earlier one with the same root cause or the same procedure. A recurrence within the cycle upgrades the grade to major and escalates to the Senior Director, IoL.

13. Report to management review. Before each AW-25 review the process owner delivers audits completed against programme, findings by grade and procedure, CAPA open, overdue and closed, verification results, recurrences and external findings status.

Exception routes. An audit postponed by the auditee is rescheduled within the quarter; a second postponement is reported to AW-25. A disputed CAPA is decided by the Senior Director, IoL. A finding indicating fraud, a data breach or a safety issue is referred the same day to MBRU's relevant function, AW-16 or AW-17, and the audit trail is preserved under AW-04 legal hold.

5. Service standards

6. Records, retention and controls

Key controls. (1) Every procedure audited within the cycle. (2) Auditor independent of the auditee. (3) Checklist derived from the controlled procedure. (4) Every finding evidenced by a specific instance. (5) Every control-detected breach reaches the register. (6) Root cause recorded, never "human error". (7) Closure only on effectiveness evidence by someone other than the CAPA owner. (8) Recurrence upgrades and escalates.

OBEF touchpoint. None. Referrals to WF-04 are recorded with the date and the WF-04 CAP reference.

7. Performance measures

8. Change control