Internal audit for HKZ: how to test your own system

An internal audit for HKZ is a check of your own care system, carried out by someone in your organisation who does not do the work themselves. You go through the requirements of the chosen HKZ scheme and check whether they work in practice. The aim is to find the gaps yourself, before the external certification body does. The step-by-step plan lists the internal audit as the fifth step, just before the external audit. HKZ schemes are built on ISO 9001, where the internal audit is a fixed requirement.

Why do an internal audit for HKZ?

An external auditor has limited time on site. That time is too short to discover everything. With an internal audit, you find in advance where files are missing, where a procedure is not followed and where staff do something different from what is written down.

It is also a practice run. Staff who have been through an audit before know what the external auditor asks. For the surveillance audits that follow, this is just as valuable. See the audit process at HKZ for how those checks run.

Do you work with HKZ Small Organisations (HKZ 143, maximum 10 FTE)? The Kiwa page for that scheme does not mention an internal audit. Ask your certification body whether it is mandatory and read the standard text of your scheme.

What do you examine during an internal audit?

You work through the requirements of the scheme, in two parts. The care part covers the work around the client: intake, delivery of care, records and incidents. The generic part covers your organisation: policy, planning, resources and improvement. For how those two parts are structured, read the requirements of the HKZ standard.

An internal audit asks three questions for each item:

Is it written down? Is there a policy, procedure or work instruction?
Is it done that way? Look at a real file or a real situation, not only at the document.
Can you prove it? Is there a record or report that shows it happens?

Example: home care organisation with 40 staff

A fictional example to make this concrete. A home care organisation wants the HKZ scheme for nursing homes, residential care homes and home care organisations. The quality officer plans the internal audit over two days.

Area	What the auditor does	What they find
Intake	Compares five recent client intakes with the protocol	Two files are missing the date of the first conversation
Records	Checks ten files for mandatory fields	Medication lists were not updated every month in one team
Incidents	Compares the incident register with the reports in the team	Three reports are not in the register
Staff	Compares training records with the job requirements	One member of staff is missing a mandatory refresher

Four findings. Each finding gets an improvement action, an owner and a date. The auditor later checks whether those actions have been completed.

How do you plan the internal audit?

A workable plan has five parts. You can record it in a table.

Element	How to fill it in practice
Scope	Which locations, teams and requirements are checked
Auditor	Someone who does not do the work themselves, preferably with knowledge of the scheme
Schedule	Date, time and which items are covered when
Evidence	Which files, records and conversations you use
Reporting	Who receives the report and when

The auditor does not need to be an external expert. They must, however, be independent of the process they check. A team leader who assesses their own team gives a weak check.

Common mistakes

Reading only the documents. A good-looking procedure that nobody follows is a finding, not evidence.
Looking at too few files. Five files are too few to spot a pattern. Take a sample that covers all teams.
Hiding findings. An internal audit with no findings is suspicious. The external auditor will find them anyway.
No follow-up. An improvement action without an owner and a date is never completed.
Seeing the audit as a punishment. Staff who fear the outcome give less honest answers.

From finding to improvement

Write each finding in one sentence: what did you find, and against which requirement? “File 7 is missing the intake date, requirement from the care part” is usable. “Files are not in order” is not.

Then comes an improvement action. That belongs to the improvement process of the HKZ system, as the standard prescribes. You also use the results of the internal audit in the management review. See management review at HKZ.

Internal audit versus external audit

The internal audit is your own check. The external audit is carried out by an accredited certification body. It looks independently at the whole system and issues the certificate. The difference in how they work:

	Internal audit	External audit
Who	Someone from your organisation	Auditor from the certification body
Purpose	Find gaps and improve	Grant or maintain the certificate
Frequency	According to your own audit programme, see standard text	Certification audit, then annual surveillance
Outcome	Improvement actions	Certificate or nonconformities

Read how the external audit works on the HKZ audit process. If you want to practise with questions, the audit questions checklist can help.

Checklist for your internal audit

Is the scope recorded, including which locations and teams?
Is the auditor independent of the process?
Did you choose a sample of files that covers all teams?
Did you collect evidence, not just read documents?
Are all findings written down with the requirement next to them?
Does every improvement action have an owner and a date?

If one or more answers are no, the internal audit is not finished yet.