Foreword

Section 7.5 of How ASF Develops and Revises Standards commits ASF to external review by ISQua EEA. That is a genuine, valuable check — but it is not the same thing as ASF examining its own operations on its own initiative, on its own schedule, before an external reviewer ever arrives. ISO/IEC 17011, the international standard governing accreditation bodies specifically, treats internal audit as a distinct, mandatory management-system function — not a lesser substitute for external review, but a genuinely different check that catches different things [1].

1. Purpose and Scope

This procedure governs how ASF conducts a planned, systematic internal audit of its own operations, consistent with the internal audit requirement of ISO/IEC 17011's management system clauses [1] and the internal audit discipline of ISO 9001 Clause 9.2 [2].

1.1 What Is Audited

The internal audit program covers every core ASF process, including:

• Standards development and revision (How ASF Develops and Revises Standards)
• Surveyor certification and ongoing currency (ASF Surveyor Training Standard)
• The accreditation process itself (ASF Accreditation Process Guide)
• Sentinel event handling (ASF Sentinel Event Policy)
• Public complaint handling (ASF Public Complaints & Feedback Policy)
• Public registry accuracy (ASF Public Accreditation Registry Policy)

1.2 What This Procedure Is Not

This procedure does not replace external review under Section 7.5 of How ASF Develops and Revises Standards, and does not replace the periodic leadership review governed by the ASF Management Review Procedure. All three exist because they catch different things: internal audit checks whether ASF's own stated processes are genuinely being followed; external review checks whether an independent body agrees ASF's processes are adequate at all; management review checks whether ASF's leadership believes the whole system is working and improving.

2. Why Internal Audit Works: The Real Evidence

This procedure is not built on the assumption that an internal audit function is worth having simply because comparable organizations have one. Real research on internal audit effectiveness offers specific, relevant findings.

A foundational study found that organizations with an internal audit function are meaningfully more likely to detect fraud and irregularity than organizations without one [3]. Critically for how this procedure is structured, the same body of research found something more specific: organizations that rely solely on outsourcing their entire internal audit function are less likely to detect fraud than organizations that retain at least part of that function themselves [3–4]. This is precisely why Section 4 of this procedure treats external engagement as a defined exception — used only where ASF's own available independent auditors are genuinely insufficient — rather than a standard operating model.

A separate, more recent study across banking institutions found that among several factors studied — auditor competence, audit methodology, management support, and organizational independence — independence had the single strongest statistical association with effective fraud detection and prevention [5]. This is the specific evidence behind Section 4's own emphasis on auditor independence as this procedure's central structural requirement, not merely one consideration among several.

3. Audit Program and Coverage Cycle

Every core process listed in Section 1.1 is audited at least once within a rolling three-year cycle, aligned with the same cycle governing ASF's standards revision — so no process goes longer than three years without either a full standards revision, an internal audit, or both. A process handling a genuinely higher-risk function — sentinel event handling and public complaint handling specifically — is audited at least once every eighteen months, reflecting the greater consequence of a failure in either.

The annual audit program — which processes will be audited in the coming year — is set by the Council and published internally before the year begins, and is adjusted where a specific concern (a pattern identified through complaints, sentinel events, or a prior audit finding) warrants bringing a process forward.

4. Auditor Independence

Consistent with the basic principle of internal audit recognized by both ISO/IEC 17011 and ISO 9001 — that a process cannot meaningfully audit itself — no individual audits a process they were substantively involved in operating during the period under audit [1–2]. A Council member who chaired a Revision Panel does not audit that same standard's development process; a person who reviewed sentinel event reports during the audit period does not audit sentinel event handling for that period.

Where ASF's own size genuinely limits available independent auditors for a specific process, ASF may engage an external, qualified individual to conduct that specific audit, consistent with the outsourcing controls described in the ASF Outsourcing Policy — as a defined exception justified by genuine necessity, consistent with the real research findings in Section 2 showing that this arrangement should remain the exception, not become the default.

5. The Audit Process

5.1 Planning

Before an audit begins, the assigned auditor identifies the specific requirements the process is being checked against — the relevant sections of the governing ASF document — and the evidence that will be reviewed: records, decisions, correspondence, and, where relevant, interviews with the people who actually operate the process.

5.2 Conducting the Audit

The auditor reviews actual records and decisions from the audit period against the process's own stated requirements — not against the auditor's personal view of best practice, and not against a standard the process was never actually required to meet. Where the auditor identifies a gap between stated process and actual practice, this is documented as a finding, regardless of whether the gap caused any actual harm during the audit period.

5.3 Classifying Findings

• Major nonconformity — a systemic failure to follow a required process, or a single failure with genuine potential for serious harm
• Minor nonconformity — an isolated departure from a required process without evidence of a systemic pattern
• Observation — not a nonconformity, but a genuine opportunity for improvement worth recording

5.4 Reporting

The auditor's findings are documented in a written audit report, provided to the Council and to the individuals responsible for the audited process, within thirty days of the audit's completion.

6. Follow-Up and Corrective Action

Every major and minor nonconformity identified under this procedure is addressed through the ASF Internal Nonconformity & Corrective Action Procedure, which governs root-cause investigation, corrective action, and verification that the correction actually worked — this procedure identifies the problem; that one governs fixing it, so the two work together rather than duplicating each other's function.

An observation does not require formal corrective action but is tracked and reviewed at the next Management Review, consistent with the ASF Management Review Procedure, so a pattern of repeated observations across several audits does not go unnoticed simply because no single one rose to a nonconformity.

References

1. International Organization for Standardization. ISO/IEC 17011:2017, Conformity Assessment — Requirements for Accreditation Bodies Accrediting Conformity Assessment Bodies. Geneva: ISO; 2017.
2. International Organization for Standardization. ISO 9001:2015, Quality Management Systems — Requirements, Clause 9.2 (Internal Audit). Geneva: ISO; 2015.
3. Coram, P.; Ferguson, C.; Moroney, R. The Importance of Internal Audit in Fraud Detection. 2006.
4. Internal Audit Risk Assessment in the Function of Fraud Detection. 2008.
5. Assessing the Effectiveness of Internal Auditors in Fraud Detection and Prevention: A Study of Somali Deposit Money Banks. International Journal of Disclosure and Governance. 2026.

Annex A — Internal Audit Report Template

Process audited: _____________________________________________

Audit period covered: ______________________________

Auditor name: ________________________________________

☐ Auditor confirms no substantive involvement in operating this process during the audit period (Section 4)

Evidence Reviewed

_______________________________________________________________________

Findings

☐ No nonconformities identified

☐ Minor nonconformity identified (describe below)

☐ Major nonconformity identified (describe below)

☐ Observation recorded (describe below)

_______________________________________________________________________

_______________________________________________________________________

Report date: ______________________________

Provided to Council on: ______________________________

Index

Auditor Independence, 4

Coverage Cycle (3-year), 3

Findings Classification, 5.3

Follow-Up, 6

Fraud Detection (real evidence), 2

Higher-Risk Processes (18-month cycle), 3

Independence as Strongest Predictor, 2

Outsourcing (as exception, not default), 2, 4

An audit that never finds anything is not evidence of a perfect system — it is usually evidence of an audit that wasn't looking hard enough. The real research says an audit that isn't genuinely independent is not much better than no audit at all.