This document provides guidelines for conducting internal audits at ABC LTD, including how to select projects and auditors, criteria for auditors and observers, how to write non-conformances, and the escalation process. It outlines obtaining the project list, selecting projects based on criteria like coverage and risk level, and forming audit companies. It also details qualifications for auditors and observers, how to clearly write non-conformances, and a three-level escalation process for resolving issues.

1. ABC LTD Company
Internal Audit Guidelines for
ABC LTDGM-AS
ABC QMS
Prepared by: ABC QMS SEPG

2. ABC QMS Internal Audit Guidelines

HP Global Method for
Application Services
Error! Unknown document property name. Page 2 of 6
Guideline (1.5 /Error! Unknown document
property name.)
Error! Unknown document property name.
© Copyright 2016 Hewlett-Packard Development Company, L.P.
Valid agreement required.
internalauditpolicy-161103144034
Last changed: 03 November 2016 at 14:40
Document Revision History Document Revision History
Ver. No. Ver. Date PreparedBy ReviewedBy Approve
d By
Affected Section& Summaryof Change PIF
No.

3. ABC QMS Internal Audit Guidelines

HP Global Method for
Application Services
Error! Unknown document property name. Page 3 of 6
Guideline (1.5 /Error! Unknown document
property name.)
Error! Unknown document property name.
© Copyright 2016 Hewlett-Packard Development Company, L.P.
Valid agreement required.
internalauditpolicy-161103144034
Last changed: 03 November 2016 at 14:40
Table of Contents
1. Obtaining the Project List ................................................................................................................. 4
2. Projects Selection Criteria ................................................................................................................ 4
3. Waiver Criteria .................................................................................................................................. 4
4. Auditors/Observer Selection............................................................................................................. 4
5. Auditors/Observer Qualifying Criteria............................................................................................... 4
6. Writing NCs....................................................................................................................................... 5
7 Escalation Process ........................................................................................................................... 6

4. ABC QMS Internal Audit Guidelines

HP Global Method for
Application Services
Error! Unknown document property name. Page 4 of 6
Guideline (1.5 /Error! Unknown document
property name.)
Error! Unknown document property name.
© Copyright 2016 Hewlett-Packard Development Company, L.P.
Valid agreement required.
internalauditpolicy-161103144034
Last changed: 03 November 2016 at 14:40
1. Obtaining the ProjectList
 Obtain the project list from DU QM and the ‘DU Head Count’ from the DU Administrator
 DU council members to verify the project details for completeness
2. Projects Selection Criteria
The project selection criteria caters to projects with a combination of below characteristics but is not limited to
it. The list below is only an indicative list and the criteria could be different for each audit cycle.
 At least 50% coverage in each Delivery Unit/Business Unit(DU/BU)
 Good representation of all types of projects executed
 At least 35 - 40% People coverage in each Delivery Unit
 New projects, including projects under transition
 Projects not audited in previous cycle
 Critical projects – based on feedback received from BU/DU/Section Heads, DU Quality Managers,
Quality Reps, PMO
 Projects implementing pilot processes for at least three months
 Previous Audit performance
 Customer facing projects
3. Waiver Criteria
Refer to the Internal Audit Process
Note: Audit Council reserves the authority for Waiver
4. Auditors/ObserverSelection
 List of auditors is maintained by the audit council.
 AC to update the Auditors and Observers list for any new persons joining the Company and moved out
of the Company before every audit cycle.
 Project Leads and above should be included in the audit companies (They should figure either as a
trained 'Auditor' or 'Observer'. If not trained, their nominations need to be sent to the L&D and/or audit
council for internal audit training. The newly trained practitioners need to be an ‘observer’ in at least
one audit cycle)
 Ascertain if existing Auditors & Observers are still in the DU/BU or have moved between DUs/BUs
 Ascertain if any of the individuals on the list are onsite
 Identify if any new Managers have joined the DU/BU – obtain the name, employee number, grade and
Reporting Manager information from the DU/BU Admin/HR.
 Ping the new employee and obtain their Audit training & experience details.
 Delete info for individuals who have left the DU/BU or add the info for new joinee.
 If any Audit Company members have moved between DUs/BUs; is onsite or has left the Organization
then discuss with Audit Council to identify a new member
 Prepare Audit Companies – ideally an Audit company should have the Auditors from the same DU/BU
so that coordination becomes easy.
 Separate audit companies are formed with ‘CMMI’ model conversant auditors and ‘ITSM’ model
conversant auditors
 Inter practice audits are encouraged
 New Auditor/Observer is added based on previous audit experience. Refer to the Table below for the
Auditor Qualifying criteria.

5. ABC QMS Internal Audit Guidelines

HP Global Method for
Application Services
Error! Unknown document property name. Page 5 of 6
Guideline (1.5 /Error! Unknown document
property name.)
Error! Unknown document property name.
© Copyright 2016 Hewlett-Packard Development Company, L.P.
Valid agreement required.
internalauditpolicy-161103144034
Last changed: 03 November 2016 at 14:40
5. Auditors/ObserverQualifying Criteria
Lead Auditor: To qualify as lead auditor, the person should have been:
 Trained on ABC LTDGM AS
 Lead and managed projects
 Trained on CMMI/ITSM Framework(recommended)
 Practicing ABC LTDGM AS processes for at least 6 months
 Completed the internal audit training at ABC LTD
 Lead audits at ABC LTD
OR
 Participated in SEI-CMMI assessment as an assessor
OR
 Participated as an auditor in at least in 3 audit cycles at ABC LTD
OR
 Conducted at least 5 cycles of Internal Audit in his/her earlier work experience
OR
 Certified lead auditor
Auditor: To qualify as auditor, the person should have:
 Trained on ABC LTDGM AS
 Lead and managed projects
 Trained on CMMI/ITSM Framework
 Practicing ABC LTDGM AS processes for at least 6 months
 Completed the internal audit training at ABC LTD
 Been an observer on one Occasion + an Auditee on another occasion
OR
 Conducted at least 3 cycles of Internal Audit in his/her earlier work experience
Observer: To qualify as an Observer:
 All Project Leads and above at ABC LTD are qualified as Observers
AND
 Trained on ABC LTDGM AS
 Trained on CMMI/ITSM Framework
 Practicing ABC LTDGM AS processes for at least 6 months
 Should have completed internal audit training at ABC LTD
OR
 Had exposure to Internal Audit concepts in his/her earlier work experience.
6. Writing NCs
6.1.1 Ensure care while writing NCs especially with the following attributes: Clarity, Relevance to the project,
Usability, Verifiability, Ability for analysis
6.1.2 The deviation should be clearly stated so that appropriate corrective action can be identified easily.
6.1.3 It is also important to write non-conformance in a manner that is directly usable by the project by
identifying the corrective actions.
6.1.4 Use the following format to write non-conformance:

6. ABC QMS Internal Audit Guidelines

HP Global Method for
Application Services
Error! Unknown document property name. Page 6 of 6
Guideline (1.5 /Error! Unknown document
property name.)
Error! Unknown document property name.
© Copyright 2016 Hewlett-Packard Development Company, L.P.
Valid agreement required.
internalauditpolicy-161103144034
Last changed: 03 November 2016 at 14:40
 <Requirement> state in clear terms what was expected with the reference to process/ guideline that is
not adhered to
 However <state the deviation from the requirement> Write the deviation in a brief, unambiguous,
helpful and depersonalized manner. It should contain the specific issue.
 <Impact of the deviation> State the impact of non conformance on the project deliverable, along with
reference to Quality Management System.
 <Evidence> specific Document, Issue, Date, ID, Version and Roles/Areas which are observed as a
deviation. Use discretion in mentioning the evidence such that it is impersonal.
6.1.5 Use the following guidelines for classifying the NC as ‘major’ or ‘minor :
 Major Non conformance : Flaw in the process which could affect product/service quality
 Minor Non conformance: Slight deviation in the process which may not affect product/service quality
Refer to the Internal Audit training collateral for more details.
6.1.6 In NC writing avoid making blanket or open-ended statements. Mention the deviation in precise terms
with the extent or measure of deviation.
7 Escalation Process
The escalation process followed during the audit process:
No
No
Yes
Yes
No
Level1
From: Auditor
To: Audit Company lead
Issue/Conflict
resolved?
Level2
From: Audit Company Lead
To: Peer Audit Company Lead
Issue/Conflict
resolved?
Closed**
Level3
From: Peer Audit Company Lead
To: Audit Council / Audit Council Head
** 1.Issue
dropped
2. CA/PA
initiated
3.Close
Audit
Note: Timely resolution of escalations ensures
timely action and closure of audit process.