Unleashing the potential of internal audits: a review and research agenda

Abstract

Research on internal audits of quality management systems is scarce, and no clear study exists that could guide practitioners in improving the auditing practice and help researchers advance existing knowledge. Thus, the aim of this paper is to review empirical research on internal audits of ISO 9001 to synthesise advice for increasing the value of internal audits and to establish a research agenda. The research method used in this paper is a systematic literature review. The result from a thematic analysis revealed two main causes for why internal audits should be improved, three main areas of what to improve, and three groups of suggestions for how audits can be improved. In conclusion, this review show that earlier research agrees on that internal audits focus too much on compliance and less on improvements, and that auditors should improve their knowledge, skills, and audit planning. The implications of this paper are consolidated in four propositions for future research, focusing the need for (1) more research contributing to both practice and theory, (2) enhanced focus on organisational needs and improvement opportunities, (3) changes in audit planning and auditor skills to enable process-oriented auditing, and (4) how to implement changes in internal auditing.

Keywords:

• quality management system
• ISO 9001
• internal audit
• literature review

Introduction

Quality management (QM) has strong roots in resolving practical industrial problems and remains an applied field in the interplay between researchers and practitioners (Dahlgaard-Park et al., 2018). Despite this, the field has not been left unquestioned by researchers or practitioners. Scholars have discussed failed Total Quality Management (TQM) initiatives during the 1990s (Boaden, 1996; Zairi, 1994), and QM initiatives with excessive focus on standardisation that potentially quench creativity and innovation (Poksinska et al., 2006; Terziovski & Guerrero, 2014). The perceived over-emphasis on standardisation is sometimes tied to the quality management system (QMS), for example, certified ISO 9001 systems. A QMS is a set of policies, objectives, and processes to support an organisation in achieving its objectives regarding quality (International Organization for Standardization [ISO] 9001, 2015). While the ISO 9001 system has been shown to positively impact quality improvements (Sousa & Voss, 2002) and operational performance (Kaynak, 2003), it has also been accused of offering limited value beyond compliance to requirements (İlkay & Aslan, 2012; Wayhan et al., 2002). If this is true for most of the over one million ISO 9001 certified firms (ISO Survey, 2018), many resources are being spent without achieving significant value. Thus, an important question arises: How can activities related to the QMS be enhanced to ensure that sufficient value is created? Naturally, QMS have also undergone developments in a strive to increase the value added, before further reflecting on needed enhancements of QMS related activities it is thus of interest to outline some key developments of ISO 9001.

The ISO 9001 management system standard was first released in 1987 and has since undergone several revisions. The main focus of the first editions of the ISO 9001 (i.e. ISO 9001:1987 and ISO 9001:1994) was to provide a ‘model for quality assurance in design, development, production, installation and servicing’ (ISO, 1994). During the implementation and certification of these first editions of the ISO 9001 management system standard, organisations efforts were very much geared towards conforming to procedures and creating binders with manuals (Clear Quality, n.d.). In the ISO 9001:2000 edition, the 9001-management system standard requirements were extended to cover the entire organisation (ISO, 2000). In this edition, the process approach was introduced and suggested to be adopted when implementing and improving a QMS (ISO 9001, 2000). The later changes in the 2008 edition were minor and focused on clarifications of existing requirements e.g. process requirements, but also on improving the compatibility with ISO 14001:2004 (ISO, 2008). In September 2015 the current version, ISO 9001:2015, was released. In this edition several enhancements were introduced, such as less prescription of documents, simplified language, risk-based thinking and an adoption to the high-level structure now being implemented in all ISO management system standards (ISO, 2015a). It has been argued that this edition is a move towards TQM (Fonseca, 2015), with reported benefits such as more risk-based thinking, similarity to other management system standards, and alignment with contemporary business (Fonseca et al., 2019; Fonseca & Domingues, 2017a).

Irrespective of edition, a necessary and resource-consuming part of holding an ISO 9001 certificate is to conduct regular internal (first-party) and external (third-party) audits. The ISO defines auditing as a ‘systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled’ (ISO 9001, 2015, p. 30). Internal audits are conducted by, or on behalf of, the organisation by trained auditors as a means of declaring conformity to a management system standard e.g. ISO 9001, or ISO 14001 (ISO, 2015b). External audits are conducted by auditors from an accredited certification body, providing certification towards a management system standard (ISO, 2015b). A certification of a management system is a means of assuring that a system for managing activities, products and services has been implemented, and that it is in line with an organisatiońs policies and applicable management system standards (ISO, 2015c).

Auditing of QMS also constitutes an area of research that often focuses on suggested changes needed to enhance the value of audits. These suggested changes pertain to the content of auditing, the context in which the audit takes place and the process of auditing. Examples of the suggested changes concerning the content of audits are that auditors should have specific knowledge about the audited organisation and an adaptability (Power & Terziovski, 2005; Ramly et al., 2007), communication skills and the ability to demonstrate empathy (Power & Terziovski, 2007), as well as the ability to ensure that information about the audit is shared in advance (Kondo, 1998). Naturally, auditors also need to have necessary skills in, and experience from, the audited management system standard e.g. ISO 9001:2015 (Domingues et al., 2019; Fonseca & Domingues, 2017b), or in cases of integrated management systems there is a need for skills from multiple areas e.g. both environmental and quality management (Rivera et al., 2017). In relation to the context of auditing, scholars have argued that auditors need to adapt to the maturity of the QMS being audited, e.g. focusing less on compliance to requirements in a more mature QMS (Terziovski et al., 2002). Furthermore, connecting the audit programme and audits to organisational needs and activities (Askey & Dale, 1994; Rippin et al., 1994; Roth, 2003) have been argued to produce positive effects, as auditors then have become better at assisting management teams in achieving organisational objectives (Alic & Rusjan, 2011; Roth, 2003). In terms of the process of auditing, scholars have also suggested educating the auditor on how to evaluate evidence (Roworth & Muir, 1999) and establishing a sponsor role to act as a bridge between auditor and management (Lenning & Gremyr, 2017).

There is general agreement that internal audits need to be changed to better support value creation beyond compliance to standards, and existing research points to changes in for example audit reports (Berlitz & Gaelzer, 2009), planning and procedures (Ramly et al., 2018). Several aspects have been considered, and some suggestions have been made to improve auditing of QMS; however, research specifically on internal audits is scarce. Moreover, there is no overview paper that could guide practitioners in improving the auditing practice and help researchers advance existing knowledge and contribute to improvements of a practice that is central to QM practitioners (Elg et al., 2011; Gremyr et al., 2019). This paper aims to review empirical research on internal audits related to ISO 9001 to synthesise advice for increasing the value of internal audits and to establish a research agenda. To this end, a systematic literature review was conducted, guided by the Prisma steps proposed by Moher et al. (2009). The conceptual goal of the review is to summarise (MacInnis, 2011, p. 144), that is ‘to take stock of, digesting, recapping, and reducing what is known to a manageable set of key take-aways’. First, this paper contributes key take-aways for practice in the form of summaries of improvement suggestions for internal auditing, motivations for improvement, the content of internal audits, and the audit process. Second, key take-aways for research are synthesised into a research agenda. In the following, the review approach is elaborated, and the results of the review are provided. The concluding parts of the paper discuss the state of research on internal audits and propose a research agenda.

Method

Review approach

In the first phase of the review, potential papers of interest were identified using a set of inclusion criteria. Following Torraco (2016, p. 418), the inclusion criteria were designed to be broad enough to capture the breadth of relevant literature. Thus, the review was not limited to papers published in peer-reviewed academic journals; it also included ‘grey’ literature (Schöpfel, 2010), such as conference proceedings, magazines and book chapters as it is argued to be increasingly important (Adams et al., 2017), and suggested to be included in meta-analysis to more completely reflect existing evidential bases (Conn et al., 2003). As the topic of interest is rather practical in nature, it was argued that excluding the ‘grey’ literature would lead to losing out on pertinent work. However, we acknowledge that there are other types of resources available for auditors wishing to improve their audit practice e.g. Auditing Practices Group (2020). Moreover, the focus of this paper is on empirical research as a means to capture actual changes done in auditing rather than conceptual views. The main literature search was performed in the Scopus and Web of Science in December 2019. The following search strings were used:

Scopus: ((TITLE-ABS-KEY (quality W/2 management W/2 system*)) OR (TITLE-ABS-KEY (iso9001 OR iso9000 OR ‘ISO 9001’ OR ‘ISO 9000’))) AND (TITLE-ABS-KEY ((audit*) W/2 (internal)))

Web of Science: ((TS= (quality NEAR/2 management NEAR/2 system*) OR TS= (iso9001 OR iso9000 OR ‘ISO 9001’ OR ‘ISO 9000’) AND (audit* NEAR/2 internal)).

In total, both databases churned out 258 publications. The search was not limited to a certain time span, although it followed naturally that no publications were identified before 1987, when ISO 9001 was first launched. Moreover, the search was delimited specifically to internal audits of QMS and did not include, for example, auditors’ views of management system standards overall, e.g. ISO 9001. A systematic literature review was conducted, following Prisma (Moher et al., 2009), as shown in Figure 1. The Prisma flowchart was completed by following the procedures suggested by Nolan and Garavan (2016) and Torraco (2016).

Figure 1. PRISMA flowchart (based on Moher et al., 2009).

All papers were initially screened by titles jointly by both authors, followed by individual screenings of the abstracts. The screenings were guided by the following exclusion criteria: papers were not included for full paper review if they were non-empirical, not focussed on ISO 9001 or if they dealt with audits other than internal audits (i.e. external audits, certification audits or financial audits).

Coding framework, review and analysis

The full text of the reviewed papers was coded using a coding framework (Figure 2) that was developed both deductively and inductively. The deductively derived codes were: focus on content, context or process of change (Pettigrew, 1987), auditor position in relation to management (Lenning & Gremyr, 2017), research outcomes (Barratt et al., 2011), formal or actual competence (Ellström, 1998) and research strategies and data collection methods (Elg et al., 2020). Inductive codes were exemplified by coding if the impact of ISO 9001 was evaluated based on financial or non-financial performance indicators or if a code captured whether or not internal auditors worked on their own or conducted audits in a team. The number of papers passing through to final review limited the possibilities to use bibliometric analysis software, which could otherwise have been a way to generate codes inductively e.g. by studying co-occurrence of key concepts.

Figure 2. Excerpt from the coding framework.

To enhance reliability and calibrate the interpretations of the coding framework, the complete full-text review was preceded by calibration, which was done by coding three papers by both authors in parallel, followed by a discussion of the coding process and the use of individual codes. Thus, the process for enhancing intercoder reliability, suggested by Nolan and Garavan (2016), was followed. Both researchers were active in reviewing the remaining papers: neither researcher reviewed both the abstract and the full paper for any of the papers. In unclear cases, especially related to an inclusion/exclusion decision, a joint discussion was taken.

The coding framework also included codes based on Pettigrew’s (1987) suggested dimensions of change, that is, context, content and process. The coding of the papers with respect to these areas was guided by the descriptions from Stetler et al. (2007): context being the ‘why’ (i.e. context in relation to the motivation for change); content being the ‘what’ (i.e. the elements or processes changed to enhance the chances for a successful change); process being the ‘how’ (i.e. the methods, strategies or interventions used to move towards a changed state). Naturally, there were papers that addressed more than one of these dimensions; thus, one paper could be coded for multiple areas (context, content, process).

Towards more value-adding audits

In this section, the research reviewed is first described in terms of, for example, the number of papers published, methods applied, and types of outcomes in focus. This descriptive analysis is followed by a synthesising description based on the dimension of change suggested by Pettigrew (1987).

Descriptive analysis

In the review process, only papers with empirical data were included. Of the 41 papers that contained an identifiable type of organisation, there were 23 private companies in business-to-business markets, 6 private companies in business-to-consumer markets, 9 public organisations and 3 cross-sectional studies. Figure 3 shows that the number of articles on internal auditing and QMS has increased over time.

Figure 3. Year of journal publication and QMS standard version for reviewed papers.

The 44 papers reviewed were published between 1992 and 2019, and during this period, several different versions of the ISO 9001 QMS standard were used. In most papers, the version observed, audited or reviewed is explicitly stated; however, in some papers, the term ISO 9001 was used without stating the version. In these cases, the authors judged which version of the QMS standard had been under focus based on the date when the papers were received by the journal.

Turning to research methodology (see Figure 4(a)), a qualitative research strategy was used in 25 of the 44 papers reviewed, whereas 9 papers applied a quantitative research strategy. In 3 papers, a mixed-method research strategy was used, and 7 papers did not explicitly state the research strategy but accounted for authors’ personal experiences from internal auditing. The 4 most frequently used data collection methods were observations (14 papers), followed by surveys (12 papers), secondary data (11 papers) and interviews (8 papers).

Figure 4. Numbers of papers and (a) utilised research strategy, (b) research outcome.

To classify the types of outcomes in the reviewed research, the categorisation of research outcomes by Barratt et al. (2011) was applied [see Figure 4(b)]. Naturally, some papers had multiple research outcomes, but in general, this categorisation follows that the most frequent outcome from the analysed papers includes guidelines (24 papers), followed by descriptive insights (11 papers) and ideas (9 papers). It should be noted in the categorisation of outcomes that no papers proposed a research agenda and that only a few (4 papers) proposed theoretical or conceptual frameworks.

Thematic analysis

The description of the content of the reviewed papers is organised into three themes, departing from the dimensions suggested by Pettigrew (1987), that is, context, content and process. Table 1 provides an overview of these themes, describing the key messages from the papers reviewed and providing a list of the references included in each theme.

Table 1. Summary of themes and references.

Theme	Summarising description	References
1. Context	Two main causes for why internal audits should be improved can be identified. First, audits are sometimes perceived as a waste of time, and using ISO requirements checklists with symbolic questions does not contribute to improvements of organisational performance. Second, internal audits are argued to place excessive focus on compliance despite opportunities for using audits to contribute to improving business performance, identification and follow-up of strategic initiatives and enhanced customer satisfaction.	Alic and Rusjan (2011); Chiarini (2019); Esa et al. (2006); Fletcher and Gupta (1999); Hassan et al. (2019); Hernandez (2010); Jarrell and Vanderlinden (1995); Kochan (1993); Marques et al. (2013); Masanganise et al. (2013); Ramly et al. (2018); Roworth and Muir (1999); Sun et al. (2017); Thijeel and Bachay (2019); Tomic and Spasojevic Brkic (2019); Underdown and Yentzen (2012)
2. Content	Three main areas for what to improve in internal auditing can be identified from earlier research. First, auditor personality, skills and knowledge are frequently brought forward as an improvement area in internal auditing. Second, it is suggested that the focus of internal audits should change from auditing specific organisational units to continuous improvements and processes. The latter is argued to be more effective and value-adding. However, this change calls for improvements in internal auditors’ skills and competencies. Third, an integration of different types of audits is suggested, that is, audits of QMS and environmental management systems.	Abuazza et al. (2019); Balague et al. (2014); Berlitz and Gaelzer (2009); Bernardo et al. (2010); Chiarini (2019); Esa et al. (2006); Fletcher and Gupta (1999); Frei (1998); Hassan et al. (2019); Hoy and Foley (2015); Hutchins (2001); Islamova and Volkova (2017); Kaziliunas (2008); Kochan (1993); Lenning (2018); Marques et al. (2013); Merrill (1997); Ni and Karapetrovic (2003); Piskar (2006); Sirk and Popovic (2015); Sun et al. (2017)
3. Process	Three groups of suggestions for how to improve internal auditing can be identified from earlier research. First, developing different metrics to measure the effectiveness of audits. Second, aligning with an organisation’s processes (e.g. strategy processes, developing process), focussing more on weak processes and less on procedures and records. Third, creating activities for more improvement-focussed audits, e.g. training auditors in questioning techniques and handling organisational complexities.	Abuazza et al. (2019); Alic and Rusjan (2011); Berlitz and Gaelzer (2009); Fletcher and Gupta (1999); Merrill (1997); Piskar (2006); Roworth and Muir (1999)

Theme 1 – context: why should internal audits be improved?

The first theme focuses on why internal audits are thought to be in need of change, including aspects that call for a change in the organisation’s external and internal environments. First, reasons related to perceived shortcomings of internal audits are presented, followed by a second paragraph focusing on the perceived potential in internal audits to drive improvements. First, in a study of why companies cancel their 9001 certification, several respondents perceived the internal audit activity as a waste of time from which little value was gained (Chiarini, 2019), and this is supported by other studies, which reveals perceptions of audits as being a time-consuming activity with limited value added by the audit findings (Ramly et al., 2018). It has also been argued that internal audits should not only be a simple check focusing on compliance with ISO requirements (Chiarini, 2019; Roworth & Muir, 1999). Making symbolic improvement suggestions related to non-conformities by following a checklist of ISO requirements is argued to enhance neither the quality of offerings nor the capability of an organisation (Sun et al., 2017). Furthermore, when analysing a checklist for audits designed by internal auditors, Masanganise et al. (2013) found a lack of objective assessment criteria, that is, criteria from a standard. This could explain the view that the current audit system focuses on fault finding, in that it is not objective, standardised or transparent. Instead of focusing on a checklist related to ISO requirements, it is argued that internal audits should measure the performance of the processes audited (Chiarini, 2019).

Second, focusing on the potential of internal audits as a driver for improvements, Roworth and Muir (1999) and Chiarini (2019) argued that auditors focus on compliance and not on improvement. At the same time, it has been argued that in every non-conformity from an audit, there is a potential for quality improvements (Jarrell & Vanderlinden, 1995) and that audits can contribute to a more positive view of continuous improvements (Meegan & Simpson, 1997) and encourage more improvement work (Kochan, 1993). In essence, the audit process should be viewed as an opportunity for improvement (Esa et al., 2006; Masanganise et al., 2013). Earlier research also points to the idea that internal audits can drive continuous improvements (Underdown & Yentzen, 2012; Verkhovskaya et al., 2016), contribute to improving business performance (Alic & Rusjan, 2011) and enhance customer satisfaction (Tomic & Spasojevic Brkic, 2019). Audits are found to be a way of identifying process improvements (Fletcher & Gupta, 1999) and generate new ideas and opportunities for strategic initiatives, which could challenge existing practices and lead to improvements (Hassan et al., 2019; Tomic & Spasojevic Brkic, 2019). Furthermore, it is claimed that audits can be used to sustain gained improvements in, for example, a Six Sigma project as well as in the evaluation of such projects (Marques et al., 2013). Finally, Hernandez (2010) argued that audits can drive implementation of a QMS, and Thijeel and Bachay (2019) pointed out that auditors, with their in-depth knowledge of quality requirements in the standards, can also support certification applications when QMS are developed.

Theme 2 – content: what to change to improve internal audits

The second theme deals with what to change in order to improve internal audits, such as organisational elements or processes. There are three areas of focus regarding content: auditor skills and knowledge, the focus of an audit and the different types of audit integration. First, the analysis of the articles shows that 11 of the 44 articles view internal auditors’ personality, skills and knowledge as key improvement areas. An auditor’s skills and personality have been shown to influence both the effectiveness of the audit (Kochan, 1993; Piskar, 2006) and the overall value added from the audit (Sun et al., 2017). Pointing to the need for auditors to advance their skills and knowledge, Table 2 summarises various suggestions.

Table 2. Summary of auditor skills and knowledge needed for value-adding audits.

Skills and knowledge	References
Has access to suitable review methods, understands system documentation and standards.	Sun et al. (2017)
Acts impartially, possesses professional knowledge and skills, has rich management experience, posits good personal qualities and a sense of responsibility.	Sun et al. (2017)
Acts as an integral, objectively fair and sympathetic partner.	Frei (1998)
Able to ask the right questions, sometimes even awkward ones.	Kochan (1993)
Remains independent and diplomatic.	Balagué (2009)
Personable and organised.	Fletcher and Gupta (1999)
Has loyalty and dedication to the work, along with a positive attitude.	Sirk and Popovic (2015)
Has knowledge in finance and environmental issues to better understand the overall business operations.	Merrill (1996)
Has the ability to move between and adapt to different types of contexts.	Lenning (2018)

Regarding management experience, Kaziliunas (2008) argued that preparations and training to support interaction with top management is important. However, Kaziliunas (2008) claimed that auditors often lack the ability to interact with top management or shop floor workers. Thus, in addition to basic skills in auditing, there is a need for strong communication skills (Balagué, 2009) to be able to present and discuss audit findings at different organisational levels.

Second, existing research suggests various improvements in the audit process, such as emphasising audit planning (Esa et al., 2006) and focusing less on ISO 9001 elements and more on ISO 9001 QM principles (Abuazza et al., 2019). Several papers in the review identify a need for internal audits to focus more on auditing an organisatiońs processes rather than focusing on auditing a certain function. Fletcher and Gupta (1999) argued that a process focus is the key intent of an audit, but this intent is lost in many organisations, leading to a shift in focus away from actual performance of the processes (Chiarini, 2019). Abandoning the traditional approach (with a focus on functional units) in favour of internal audits focusing on processes is argued to enhance audit effectiveness (Islamova & Volkova, 2017; Kaziliunas, 2008; Ni & Karapetrovic, 2003). In one study, a shift of focus on process in the audits led to a 50% reduction in time and cost for the audit cycle and a similar reduction in the number of auditors needed (Berlitz & Gaelzer, 2009). However, such a shift is challenging and requires not only expertise in quality but also high levels of interpersonal skills (Frei, 1998; Kaziliunas, 2008; Sun et al., 2017).

Third, different integrations involving internal audits are a reoccurring theme in the research reviewed. Hutchins (2001) claimed that internal audits of different management systems in areas such as quality, environment and safety will eventually converge, and a positive effect of this is that auditing will receive more attention and focus from senior management and the board. In addition, it is argued that the integration of audit teams, audit procedures and processes is a way to reduce costs, for example, by reducing the time needed from both auditors and auditees (Hassan et al., 2019; Hoy & Foley, 2015). The integration of different types of internal audits is also argued to decrease the number of disturbances in the organisations, for example, by avoiding duplications of audit results (Hoy & Foley, 2015). Besides suggesting the integration of audits for various types of management systems (often QMS and environmental management systems), Marques et al. (2013) proposed that audits could be integrated and used in Six Sigma initiatives. The suggestion is to use internal audits to identify improvement areas where a Six Sigma project could be needed and/or to use internal audits to sustain the improvements resulting from Six Sigma projects (Marques et al., 2013). Finally, when comparing the integration of different external audits with the integration of internal audits, internal integration is more common and arguably easier, as these auditors focus on one organisation, while external audits focus on both various management system standards and organisations (Bernardo et al., 2010).

Theme 3 – process: how to improve internal audits

The third theme focuses on how to improve internal audits, that is, the actions needed to move from the present to a future state. First, suggestions for improving the audit process are presented, followed by suggestions for how audits can focus on processes; the third part emphasises suggestions to focus audits more on continuous improvements. First, considering the audit process in general, it is suggested that there is a need to change how the effectiveness of audits is evaluated. Piskar (2006) argued that audits should be evaluated through management assessments of the audit’s usefulness in contributing to improvements in business processes. Moreover, the development of qualitative metrics for evaluating the audit process is suggested, for example, audit performance (Abuazza et al., 2019) and progress in auditing and action follow-up (Roworth & Muir, 1999). It is also suggested that audit objectives should be aligned with business objectives, which enables an internal audit to better support managers in achieving such business objectives (Alic & Rusjan, 2011).

Second, Berlitz and Gaelzer (2009) have suggested that internal audits should be aligned with processes and that each auditor should be assigned to and responsible for a defined set of processes. Process-oriented audits should focus less on procedures and records (Piskar, 2006), be planned to target, for example, known weak processes in an organisation (Merrill, 1996) and have a frequency based on the performance and importance of the process (Fletcher & Gupta, 1999).

Third, to perform more improvement-focussed audits, Roworth and Muir (1999) have suggested that auditors should be trained in questioning techniques and handling organisational complexities. Moreover, one method of enhancing the improvement focus, as well as improvements of the audit per se, is to establish regular meetings between auditors to discuss problems and results (Roworth & Muir, 1999).

Discussion

This paper reviewed empirical research on internal audits of ISO 9001 to generate advice for value-adding internal audits and to establish a research agenda. In general, research on internal audits of QMS is not extensive, which is surprising in light of accusations that QMS is limited in terms of value added to organisations (İlkay & Aslan, 2012; Wayhan et al., 2002), and remains a primary concern in QM practice (Elg et al., 2011; Gremyr et al., 2019). Moreover, for internal audits, this is a mandatory activity for organisations with certified QMS and an activity with the potential to contribute to improvements (Kochan, 1993; Lenning & Gremyr, 2017; Meegan & Simpson, 1997). To advance this field and with the intention of contributing to practice and research, this discussion will focus on four overarching themes. First, there is a lack of research on internal audits that moves beyond an and not only to understanding related to a specific study setting. Second, drivers for improving internal audits are related to the context of change (Pettigrew, 1987). Third, the need for the development of auditors’ competencies, related to the content of change (Pettigrew, 1987). Fourth, the process of advancing internal audits to become more value-adding, related to the process of change (Pettigrew, 1987).

First, the review did not include papers that proposed a research agenda, and few theoretical or conceptual frameworks were developed. Common outcomes were guidelines or descriptive insights based on authors’ personal views. Naturally, as QM is an applied field in which developments are often driven by practice (Dahlgaard-Park et al., 2018), practice-oriented research outcomes are expected. However, building further research on guidelines or descriptive insights is challenging, and the field risks being dispersed. One established research strategy, aiming for simultaneous contributions to theory and practice is action research (Elg et al., 2020) and the use of data collection methods such as focus groups, which allows data to be collected in proximity with practitioners. Such a research strategy would contribute to research as well as practice.

PROPOSITION 1. Research should focus on internal audits to support continuous improvements, as a suggestion by action research, with the aim of contributing to practice as well as theory.

Second, even though there are opportunities for audits to contribute to quality improvements (Sousa & Voss, 2002), enhance customer satisfaction (Tomic & Spasojevic Brkic, 2019) and improve operational performance (Kaynak, 2003), there seems to be general agreement that the value of audits needs to be improved. The two main reasons internal audits should be improved are as follows: (1) internal audits are perceived to be a waste of time, and auditors mainly follow checklists based on ISO requirements, which do not help improve organisational performance (Chiarini, 2019; Ramly et al., 2018) and (2) there is excessive focus on seeking compliance with ISO requirements instead of on opportunities for improvement (Sun et al., 2017).

PROPOSITION 2. To enhance the value of internal audits, auditing should focus on organisational needs in addition to ISO requirements and on identifying opportunities for improvements.

Third, auditors are trained to prepare a checklist for an audit that departs from the standard requirements; other types of preparations and input are needed for improvement-focussed auditing. This includes, for example, internal strategies and targets, records from internal follow-up activities and data on customer satisfaction, all of which are needed to identify key areas for auditing and hence enable a needed focus on key processes (Islamova & Volkova, 2017; Kaziliunas, 2008; Ni & Karapetrovic, 2003). Thus, a key area is to identify the skills and competencies auditors need to enhance the value added from internal audits and focus on key processes. The suggested skills and competencies are, for example, management experience (Sun et al., 2017), an overall understanding of business operations (Merrill, 1996) and the ability to move between different contexts in an organisation (Lenning, 2018). In addition to the suggested changes in auditor skills and competencies, changes in the actual content of the audit have been suggested in relation to audit planning (Esa et al., 2006), as well as the integration of different types of audits (Hoy & Foley, 2015; Hutchins, 2001) to gain increased management support.

PROPOSITION 3. Auditors’ skills and competencies as well as the planning of internal audits need to be adapted to process-focussed auditing and an integration of audits.

For both Propositions 2 and 3, these are supported by guidelines for auditing management systems (19011: 2018; the ISO 9001 Auditing Practices Group’s Guidance on internal audits, 2020). Proposition 2 in pointing out that organisational needs and opportunities for improvements should be in focus in audits, and Proposition 3 in pointing to the need for an identification of auditors’ skills and competencies, and changes in audit planning such as integrating audits (e.g. Domingues et al., 2011; Kraus & Grosskopf, 2008).

Fourth, most papers in the review provide suggestions on why there is a need for improved internal audits as well as what to improve related to the context and content of change (Pettigrew, 1987). Comparatively less research focuses on the process, that is, how to improve internal audits. Thus, despite the dominance of practice-oriented outcomes (guidelines and descriptive insights), the process leading up to the outcomes is not elaborated. Such research could be carried out as action research and would benefit both theory and practice, especially if examples of both successful and unsuccessful interventions were provided. The research that does exist on the process of changing internal audits emphasises management’s responsibilities and involvement in auditing, for example, in audit assessments (Piskar, 2006) and in supporting alignment with business objectives (Alic & Rusjan, 2011), as well as the auditors’ responsibilities in, for example, learning to handle organisational complexities and sharing experiences in the auditor group (Roworth & Muir, 1999).

PROPOSITION 4. Research needs to address how to implement changes in auditing practices and clarify the responsibilities of management and internal auditors.

The present literature review focuses internal audits of ISO 9001. To further explore and enhance the findings, future literature reviews could be conducted focusing internal audits of other management system standards such as ISO 14001, or ISO 27001. Furthermore, this literature review included research papers published up until, and including 2019. However, the latest version of the ISO 9001 management system standard, encompassing several major changes argued to support an increase of the value gained from a QMS (Fonseca & Domingues, 2017a), was approved by the European committee for standardisation in September 2015. The approval was followed by a three-year grace period for implementation, hence the numbers of reviewed research papers studying internal auditing of ISO 9001:2015 will likely increase (Figure 3). Moreover, the latest version of the guidelines for auditing management systems (ISO 19011) was released in mid-2018 and included, among many changes, an extended focus on management aspects and risk-based auditing. Future literature reviews are therefore suggested to extend this review once more papers on internal audits of ISO 9001:2015 have been published.

Conclusions

This paper presents a review of papers on internal audits of ISO 9001 to generate advice for value-adding internal audits as well as to establish a research agenda. The review was thematised in relation to (I) causes for why internal audits should be improved (context), (II) suggestions for what to improve in internal auditing (content) and (III) suggestions for how to improve internal auditing (process). Most of the reviewed articles belong to the two first themes and agree that internal audits place excessive focus on compliance and less on improvements, and that auditing could be improved by, for example, developing auditors’ knowledge and skills and audit planning. These findings have practical implications for auditors in auditing different management system standards (e.g. 9001, 14001) as input on how to improve internal audits. Furthermore, it addresses the hidden potential in auditing as a driver of continuous improvements. In addition, the findings can also be used in training new auditors. As an example, the auditor training could include fictive cases with incomplete data to train future auditors in identifying the data needed to be able to identify critical areas to audit.

In conclusion, this review puts forth four propositions on the need for; (1) more research contributing to both practice and theory, (2) enhanced focus on organisational needs and improvement opportunities, (3) changes in audit planning and auditor skills to enable process-oriented auditing, and (4) how to implement changes in internal auditing. Figure 5 builds on these propositions and displays various associated research areas based on the review results.

Figure 5. A research agenda to support the use of internal audits to support continuous improvements.

Specifically related to proposition 3, two future research avenues related to auditors’ skills and process-oriented auditing, are remote audits and auditing in the Industry 4.0 era. First, remote auditing was performed already before the Covid-19 pandemic but has now increased dramatically and includes both opportunities (e.g. time savings, reduced costs, and reduced negative environmental impact from travelling), but also challenges (e.g. reduced in-person contact, information security, and risk of missing out evidence). Second, auditing in the era of Industry 4.0 and digitisation also includes opportunities and challenges. On one hand, through big data analytics and artificial intelligence auditors will be equipped with new tools in their preparations. On the other hand, a move towards e.g. automated processes will require new and specialised auditor skills to uncover possible non-compliances.

Acknowledgements

Financial support from the Area of Advance Production at Chalmers is gratefully acknowledged.

Disclosure statement

No potential conflict of interest was reported by the author(s).