Manufacturing is where internal audit was born (the profession’s founders in 1941 came largely from industrial companies) and it remains the industry where the function’s work is most physical: inventory that can be counted, scrap that can be weighed, machines whose downtime can be measured, raw materials whose yield can be computed, and plants whose managers run small businesses far from head office with their own suppliers, their own payrolls and their own ways of doing things. The risks are correspondingly concrete: a standard cost that no longer reflects the process and hides a margin problem for a year, a supplier whose quality lapses reach the customer, a plant network that an attacker can reach from the office Wi-Fi, a customs classification that has been wrong since the product launched, a safety program whose paperwork is complete and whose practice is not.
This guide explains how the function works at manufacturers from a three-plant food company to a listed multinational: why manufacturing audit is different, the regulatory and standards frame, the plant audit, inventory and standard costs, the supply chain, quality systems, environmental, health and safety, operational technology security, capital projects and maintenance, the shape of the universe, plant-level fraud, what the audit committee sees, careers and pay, the failures that recur, and a worked example from Brightwater Foods, the $180 million food manufacturer used in examples across this site, in its FY27 audit year. The how to audit inventory guide covers the largest single topic in depth and the capital projects guide the plant expansion that every manufacturer eventually builds.
In this guide
- Why manufacturing internal audit is different
- The regulatory and standards frame
- The plant audit
- Inventory and standard costs: where margins hide
- The supply chain
- Quality systems and the ISO internal audit
- Environmental, health and safety
- Operational technology security
- Capital projects and maintenance
- The shape of a manufacturer’s audit universe
- Plant-level fraud
- What goes to the audit committee
- Careers and pay in manufacturing internal audit
- Failures that recur
- A worked example: Brightwater Foods’ FY27 audit year
- Questions about internal audit in manufacturing
- Related guides
Why manufacturing internal audit is different
Five features shape the function. Physical assets and inventory dominate the balance sheet and the risk: raw materials, work in process and finished goods that can be miscounted, misvalued, stolen, spoiled or made obsolete, and plant and equipment whose condition decides output. Cost accounting is the information system that management runs the business on, and it is an estimate: standard costs, overhead absorption and variance analysis translate the plant floor into margins, and when the standards are stale the margins lie. Decentralization: plants are run by managers with local authority over hiring, buying, maintenance and often customers, so that the control environment varies by site and the audit has to travel. Regulation attaches to the product and the process rather than to the company: quality systems certified by third parties, product safety regimes by sector, environmental permits by site, safety law by workplace, customs rules by shipment. Suppliers and customers are concentrated: a few suppliers for critical inputs, a few customers for most of the volume (Brightwater’s two customers at 48 percent of sales), with contractual penalties, audits and certifications flowing in both directions. The function that fits is one that spends much of its time in plants, speaks operations as well as finance, uses analytics on transaction data from the ERP and the shop floor systems, and treats the quality, safety and environmental functions as the second line they are.
The regulatory and standards frame
| Regime | Who it reaches | What it requires | Internal audit’s angle |
|---|---|---|---|
| Quality management systems: ISO 9001:2015; IATF 16949 (automotive); AS9100 (aerospace); ISO 13485 (medical devices) | Manufacturers whose customers require certification | A documented QMS with management review, internal audits, corrective action, supplier control and continual improvement; third-party certification audits | Audit the QMS’s governance and the integrity of its internal audit program; rely on it where tested |
| Product safety regimes by sector: FDA (food under FSMA; drugs under cGMP; devices under the Quality Management System Regulation effective 2 February 2026); CPSC (consumer products); NHTSA (vehicles); EPA and state law (chemicals) | By product | Preventive controls, hazard analysis, traceability, recall capability, registration and reporting | Audit recall readiness, traceability and the food safety or quality plan’s operation |
| Environmental: Clean Air Act, Clean Water Act, RCRA, state permits; ISO 14001 for certified sites | Every plant | Permits by site with monitoring, reporting and recordkeeping; waste handling; spill prevention | Audit permit compliance, monitoring data integrity and the EHS program |
| Health and safety: OSHA (and state plans); ISO 45001 for certified sites | Every workplace | Hazard controls, training, recordkeeping (injury logs), machine guarding, lockout-tagout, process safety management for hazardous chemicals | Audit the safety program’s practice against its paperwork; injury data integrity |
| Trade and customs: tariff classification, valuation, country of origin, free trade agreement claims, duty drawback, foreign trade zones; export controls (EAR, ITAR); sanctions | Importers and exporters | Correct classification and valuation on entries; recordkeeping for five years; reasonable care; licensing for controlled exports | Audit classification and origin determinations, broker oversight and the trade compliance program, with tariff changes raising the stakes |
| Forced labor and conflict minerals: Uyghur Forced Labor Prevention Act (import presumption); Dodd-Frank section 1502 conflict minerals disclosure (SEC registrants); EU forced labour regulation (applying from 2027) | Importers; SEC registrants; EU market participants | Supply chain tracing and due diligence; disclosure | Audit supplier due diligence and the traceability evidence behind disclosures |
| Defense cybersecurity: CMMC 2.0 (DFARS clauses effective 10 November 2025; phased to 2028) | Defense contractors and their suppliers handling federal contract information or controlled unclassified information | Level 1 self-assessment, Level 2 self or third-party certification, Level 3 government assessment; annual affirmations | Audit the CUI inventory, the assessment’s basis and the affirmation process |
| Sustainability reporting: EU CSRD (first wave reporting from 2025; later waves delayed by the 2025 omnibus); California climate disclosure laws; customer scorecards | Large EU and in-scope companies; California-doing-business thresholds | Emissions, energy, water, waste and social metrics with assurance | Audit the data behind the metrics (the ESG auditing guide) |
| Financial reporting: SOX for US listed; UK Corporate Governance Code Provision 29 for UK companies listed in the commercial companies category (financial years from 1 January 2026) | Listed companies | Internal control over financial reporting; board declaration on material controls | Inventory and cost controls are the manufacturing-specific core of ICFR |
The plant audit
The plant audit is manufacturing internal audit’s signature engagement: a site visit of one to three weeks that tests the plant’s financial, operational and compliance controls as a unit, rotating across sites on a cycle set by risk (size, change, prior results, management turnover). A good plant audit program is standardized so results compare across sites and flexible enough to follow the plant’s particular risks, and it covers: inventory (observation of the cycle count or physical count, test counts both ways, reconciliation to the perpetual record, slow-moving and obsolete stock, scrap and rework handling), production reporting (yield, downtime and output data from the shop floor to the ERP, with recomputation of key metrics), cost accounting at the plant (standards versus actuals, variance investigation, overhead absorption), procurement and receiving (local buying, three-way match, receiving controls, vendor master changes made locally), payroll and time (shift premiums, overtime, temporary labor agencies, time clock controls), maintenance and spares (work orders, preventive maintenance completion, spare parts inventory), quality and food or product safety (the plant’s QMS records against practice, holds and releases, customer complaints), environmental and safety (permits, monitoring, training, incidents, housekeeping observed), physical security and access, IT and OT at the site (local administrators, network segmentation, backups), and the plant manager’s control environment (budget discipline, approvals, tone). Analytics prepared before the visit (purchase orders by vendor and approver, inventory adjustments by user, overtime by employee, scrap by line and shift) focus the fieldwork, and the report rates the plant on a scale the company’s operations leadership understands. The fieldwork and inventory guides cover the testing in depth.
Inventory and standard costs: where margins hide
Inventory is the manufacturer’s largest estimate. Its existence is tested by counts; its valuation by the cost system; its recoverability by reserves for excess, obsolete and slow-moving stock and by the lower of cost and net realizable value test. Most manufacturers use standard costing: each product carries a standard cost built from a bill of materials (quantities and standard prices of inputs), a routing (labor and machine hours at standard rates) and overhead absorbed at a rate per hour or per unit from a budgeted overhead pool and volume. Actual costs differ, and the differences are captured as variances (purchase price, material usage, labor rate and efficiency, overhead spending and volume) that are investigated and ultimately allocated between inventory and cost of sales. The system is only as good as its standards and its data: a bill of materials that omits a component understates cost and creates a favorable usage variance that hides the error; a standard set when volume was higher absorbs too little overhead and makes every product look more profitable than it is; a routing not updated for a process change misstates labor; and a plant that leaves variances in cost of sales rather than allocating them to inventory misstates the balance sheet. The audit tests the standard-setting process (who sets standards, from what data, how often; the annual roll and its approval), the bill of materials and routing accuracy for a sample of products against the floor, the variance analysis and its investigation thresholds, the capitalization of variances, the overhead rate derivation, cycle count accuracy by location and item class, the reserve methodology against aging and demand data, and the controls over inventory adjustments, which are the manufacturing equivalent of manual journal entries. The inventory audit guide gives the program and the financial close guide the close the cost system feeds.
| Cost system element | What goes wrong | Audit test | Effect |
|---|---|---|---|
| Bill of materials | Components omitted or quantities stale after formulation or engineering changes | Compare a sample of BOMs with the floor and the engineering change log; analyze favorable usage variances by product | Understated standard cost; margin overstated per unit |
| Routings | Labor and machine times not updated for process changes or automation | Time studies or observation against routings for high-volume products | Labor cost misstated; efficiency variances misleading |
| Overhead rates | Budgeted volume above actual; pool includes non-manufacturing costs | Recompute rates; compare budgeted and actual volume; review pool composition | Under- or over-absorption; inventory misvalued |
| Standard price | Set from old contracts; ignores freight, duty and tariffs | Compare with recent purchases; landed cost components | Purchase price variances large and unexplained |
| Variance disposition | Variances expensed when they should be allocated to inventory, or the reverse | Recompute the allocation; test against policy | Balance sheet and margin misstated |
| Cycle counts | Counts adjusted to the record; high-value items counted rarely | Observe counts; test adjustments by user; accuracy statistics by class | Existence misstated; theft undetected |
| Reserves | Methodology mechanical; demand forecasts optimistic; engineering changes not reflected | Recompute from aging and demand; test write-off decisions | Overstated inventory |
| Inventory adjustments | Unlimited adjustment rights at the plant; adjustments used to hide shortages | Analytics on adjustments by user, item and timing; approval testing | Shrink and errors concealed |
The supply chain
The supply chain audit follows the material: supplier qualification and onboarding (financial, quality, ethical and security due diligence proportionate to criticality; approved supplier lists), sourcing and contracts (competitive bidding, long-term agreements, price adjustment mechanisms, exclusivity, tooling ownership), purchase-to-pay controls (the procure-to-pay guide), supplier quality (incoming inspection, supplier corrective actions, production part approval in automotive, supplier audits), supplier risk and concentration (single-source components, geographic concentration, financial health monitoring, business continuity), inbound logistics and customs (classification, valuation, origin, broker oversight, free trade agreement claims, recordkeeping), planning (sales and operations planning, demand forecasting, safety stock policy, the bullwhip of forecast error into inventory), warehousing and outbound logistics (carrier selection, freight audit, delivery performance, returns), and the ethical and regulatory layer (forced labor due diligence, conflict minerals, sanctions screening, sustainability data from suppliers). Trade compliance deserves its own engagement at any importer: tariff changes in 2025 and 2026 made classification and origin determinations consequential in a way they had not been for decades, customs penalties for negligence are multiples of the duty, and the recurring finding is a classification set at product launch by a broker and never reviewed. The third-party risk management program guide covers the vendor program, the due diligence by tier guide the proportionality, and the third-party resilience guide the single-source and concentration questions.
Quality systems and the ISO internal audit
Every certified manufacturer runs an internal audit program it does not call internal audit: ISO 9001 and its sector derivatives require internal audits of the quality management system by trained auditors independent of the area audited, with findings, corrective actions and management review, and the certification body checks that the program runs. The relationship between that program and the internal audit function is a design question most companies never make. The quality internal audits test conformance to the QMS’s documented procedures; the internal audit function tests whether the QMS achieves its purpose and whether the company’s broader controls work, and it can rely on the quality audits as second-line work after assessing their reliability (coverage against the QMS, auditor independence and competence, finding quality, corrective action closure). The function’s own quality-related work covers the QMS’s governance (management review’s substance, the quality function’s independence from production pressure), the integrity of quality data (first-pass yield, scrap, customer complaints, nonconformance records, which can be edited by the people they measure), recall and traceability readiness (a mock recall traced from a finished lot to raw material lots and customers within the regulator’s or customer’s time expectation), customer-required certifications and audits, and the cost of poor quality as a management metric. The internal audits within an ISO 9001 QMS guide covers the quality audit program, the ISO 14001 audit guide its environmental counterpart, and the assurance mapping guide the reliance decision.
Environmental, health and safety
Environmental, health and safety is the area where a manufacturer’s compliance failure injures people or communities, and where the paperwork most often diverges from practice. The EHS function owns the program; internal audit tests whether it operates: permits by site inventoried with their conditions and monitoring requirements, monitoring data (emissions, discharges, waste manifests) complete and consistent with production levels, training delivered to the people who need it (contractors included), machine guarding and lockout-tagout observed on the floor rather than read in the procedure, incident and near-miss reporting rates that look plausible (a plant with no recordable injuries and no near misses is not reporting), injury logs reconciled to medical and workers’ compensation records, process safety management elements where hazardous chemicals are present, contractor safety management, and the EHS audit program’s own coverage and corrective action closure. Serious EHS events (a fatality, a release, a fire) are the manufacturing risks most likely to produce criminal exposure for managers and the company, and the audit committee’s interest in EHS reporting has grown accordingly; the environmental and climate risk audits guide covers the environmental side in depth.
Operational technology security
Plants run on operational technology (programmable logic controllers, human-machine interfaces, supervisory control systems, historians, building and utility controls) that was designed for availability and physical safety rather than security, often runs on unsupported operating systems, and was connected to corporate networks and the internet over the last two decades for remote support and data. Ransomware that reaches the plant network stops production (the manufacturing sector has been the most targeted by ransomware in recent industry reports), and the controls differ from corporate IT: network segmentation between IT and OT with controlled conduits (the IEC 62443 zone and conduit model), an asset inventory of OT devices (which IT’s tools do not see), remote access through controlled jump hosts rather than vendor modems and cellular routers, patching and compensating controls for devices that cannot be patched, backups of controller programs and configurations, monitoring of OT network traffic, and incident response plans that include the plant’s safe shutdown. Brightwater’s first cybersecurity assessment found flat plant networks and no immutable backup; the auditing cybersecurity programs and NIST CSF 2.0 assessment guides tell that story, and the cyber resilience audit guide covers the recovery question that matters most to a plant.
Capital projects and maintenance
Manufacturers spend capital continuously (new lines, plant expansions, automation, replacements) and the capital projects audit guide gives the program, with Brightwater’s second line at plant 2 as its example. Maintenance is the quieter sibling: a computerized maintenance management system holds work orders, preventive maintenance schedules and spare parts, and the audit tests preventive maintenance completion rates against schedule (deferred maintenance is a hidden liability that surfaces as downtime and safety events), work order controls and contractor labor, spare parts inventory (often unrecorded, uncounted and a theft target), the capitalization versus expense decision on maintenance projects, and the maintenance budget’s relationship to asset condition. Asset records (the fixed asset register against the floor, with retirements recorded) complete the picture; the fixed assets guide covers them.
The shape of a manufacturer’s audit universe
| Domain | Representative entities (Brightwater Foods, 52 in total) | Typical rating and cycle |
|---|---|---|
| Plants and operations (9) | Plant 1, plant 2 and plant 3 as rotating plant audits; production reporting and yield; scheduling and S&OP; warehousing and distribution; co-packers (two); maintenance and spares; energy and utilities | Plants on a two-year rotation (plant 2 annual while the second line commissions); yield and co-packers High |
| Inventory and cost (6) | Cycle counts and physical inventory; standard costing and the annual roll; variance analysis and disposition; excess and obsolete reserves; inventory adjustments; intercompany transfers between plants | Standards and adjustments High (annual); others two years |
| Supply chain and trade (8) | Supplier qualification and approved supplier list; sourcing and contracts; procure-to-pay; supplier quality and corrective actions; customs and trade compliance (imported ingredients and packaging); logistics and freight audit; supplier concentration and continuity (single-source packaging); forced labor and sustainability due diligence | Procure-to-pay, concentration and trade High |
| Quality and food safety (6) | Food safety plan (FSMA preventive controls) and HACCP; QMS governance and the quality internal audit program; traceability and mock recall; customer complaints and quality data integrity; allergen and label control; third-party certification (customer-required scheme) | Food safety plan, recall and label control High (annual) |
| EHS (4) | Environmental permits and monitoring (three sites); safety program and incident data; contractor safety; process safety for ammonia refrigeration | Safety and ammonia High; environmental two years |
| Technology (7) | ERP access and change; OT network segmentation and asset inventory; backup and recovery; cybersecurity program (CSF 2.0 roadmap); managed security service; end-user computing; data and reporting | OT, access and recovery High |
| Finance and corporate (8) | Financial close; revenue and customer deductions (trade promotions, chargebacks from the two large customers); payroll and temporary labor; treasury, covenants and liquidity; capital projects; fixed assets; insurance; tax (sales and use, property) | Customer deductions, covenants and capital projects High |
| Governance (4) | Board and audit committee governance; ERM; business continuity (the single-line risk); the internal audit function (QAIP) | Business continuity High until the second line runs |
Plant-level fraud
Decentralized plants produce a recognizable fraud catalog: ghost vendors and kickbacks in local purchasing (maintenance contractors and MRO suppliers are the usual channel); scrap and by-product sales for cash or to related parties below value; inventory theft of finished goods and high-value materials concealed by adjustments; time and attendance fraud (buddy punching, phantom overtime, temporary labor agencies billing hours not worked); expense and petty cash abuse; and, at the management level, production and yield reporting manipulated to hit bonus targets, with the quality data edited to match. The analytics that find them run on the ERP, the time system and the shop floor systems: vendor master changes by plant users, purchase orders split below approval limits, payments to vendors with employee-matching details, scrap recorded versus scrap sold, inventory adjustments by user and shift, overtime by employee against badge data, and yield by shift against the plant’s physical possibilities. The procurement fraud schemes, procurement fraud analytics and payroll analytics guides give the scripts, and the fraud risk assessment guide the assessment that should name these schemes before the audit finds them.
What goes to the audit committee
Beyond the standard reporting, a manufacturer’s audit committee receives the plant audit results as a comparative picture (ratings by site, trend, recurring themes), inventory and cost findings with their effect on margins and the balance sheet, supply chain concentration and continuity, trade compliance exposure when tariffs move, quality and recall readiness, EHS performance and serious incidents, OT security status, capital project assurance, and, for listed companies, ICFR. The committee of a private company such as Brightwater adds the lender’s covenants and the business continuity risk that the board itself identified; the audit committee annual agenda guide gives the calendar and the board risk reporting guide the risk pack.
Careers and pay in manufacturing internal audit
Manufacturing functions hire accountants with cost accounting backgrounds, operations and supply chain professionals who want a company-wide view, engineers who moved into quality or EHS and then audit, and IT auditors who learn OT; the CIA and CPA remain the core credentials, with the CMA (cost and management accounting), CSCP or CPIM (supply chain), ASQ quality certifications and OT security training as sector additions. Pay sits at the general market’s middle (the salary guide‘s ranges apply, with large multinationals above and regional private companies below), travel is a defining feature of the job (plant rotations put auditors on the road a third of the year at multi-site companies), and the exit paths run into plant finance, operations, supply chain and the controller’s office, which is why manufacturing internal audit has long served as a management training program at industrial companies. The career ladder and exit opportunities guides cover the general paths.
Failures that recur
| Failure | How it shows | What the function should do |
|---|---|---|
| Head office function that never visits | Plant controls assessed from documents; plant fraud found by accident | Plant audit rotation with pre-visit analytics |
| Standards taken as truth | Favorable variances celebrated; a product line losing money for a year | Audit the standard-setting process and BOM accuracy annually |
| Quality audits assumed to cover quality | The QMS passes certification; quality data is edited; a recall surprises everyone | Assess the quality audit program; audit data integrity and recall readiness |
| EHS by paperwork | Training records complete; guarding missing on the floor | Observe practice; reconcile incident data to external records |
| OT as IT’s problem | Flat networks; vendor remote access; ransomware stops the plant | OT asset inventory and segmentation in the universe as High |
| Trade compliance by broker | Classifications set at launch; penalties when tariffs change | Trade compliance engagement with classification sampling |
| Supplier concentration unmeasured | Single-source packaging stops the line | Concentration and continuity analysis; third-party resilience |
| Capital projects audited at closeout | Overruns documented after the money is spent | Pre-construction and in-progress audits |
| Customer deductions unchallenged | Large customers’ chargebacks and promotion deductions accepted without validation | Deductions audit with recovery analytics |
A worked example: Brightwater Foods’ FY27 audit year
Brightwater Foods is the $180 million private food manufacturer with three plants and about 600 staff used in examples across this site. Its board formed an audit committee and hired a first chief audit executive who worked alone with a co-source firm in year one (the one-person shop and first 90 days guides), built the assurance map in year two, and by FY27 had a second in-house auditor (a plant controller who moved into the function), a co-source budget of about $165,000 a year and a 52-entity universe. Two retail customers account for 48 percent of sales under contracts with service-level penalties; the highest-volume product ran on a single line at plant 2 until the second line, whose construction the capital projects guide audits, was commissioned during the year; and the company’s first cybersecurity assessment had found flat plant networks and no immutable backup. The FY27 plan covered 14 of the 52 entities in about 3,900 hours, 1,000 of them co-sourced.
| Engagement (hours) | What it found | Outcome |
|---|---|---|
| Plant 3 rotation audit (380) | Cycle count accuracy 94 percent by value but 71 percent by item for packaging; 212 inventory adjustments in the quarter, 61 percent by one supervisor; a maintenance contractor paid $84,000 across 14 purchase orders split below the $7,500 local approval limit; lockout-tagout observed correctly on 9 of 10 machines sampled; ammonia refrigeration process safety documentation current | Rated Needs Improvement; adjustment rights restricted and reviewed weekly; the contractor relationship investigated under the fraud protocol (no kickback found; splitting was convenience); plant 3 moved to an annual rotation |
| Standard costing and the FY27 roll (320, 80 co-sourced cost accounting) | Standards rolled on time; the bill of materials for the highest-volume product omitted a secondary packaging component added in 2025 ($0.9 million a year of cost showing as a favorable usage variance); overhead rates built on a volume 8 percent above FY26 actual, under-absorbing $1.1 million | High; BOM corrected and the change control process linked to the formulation and packaging change logs; overhead volume reset; the product’s margin restated for management reporting |
| Customer deductions and trade promotions (260) | The two large customers deducted $4.6 million in the year for promotions, shortages and compliance chargebacks; 38 percent of deductions were accepted without matching to an agreement or a delivery record; a recovery sample found 12 percent of unmatched deductions invalid | High; deduction validation process with a 30-day dispute clock; $410,000 recovered in the first two quarters |
| Trade compliance (200, 60 co-sourced customs) | Imported ingredients and packaging on 1,400 entries; classification of a sweetener set by the broker in 2019 at a rate that a 2025 tariff action made consequential; the correct classification carried a lower rate, overpaying duty by $210,000 over two years; no classification review process | Medium; refund claim filed through the broker; annual classification review; broker oversight added to the vendor program |
| Mock recall and traceability (160) | Finished lot traced to raw material lots and customers in 3 hours 40 minutes against a four-hour customer requirement; one packaging lot untraceable because the supplier’s lot code was not captured at receiving | Medium; receiving capture fixed; quarterly mock recalls |
| OT network segmentation follow-up (240, 120 co-sourced) | Segmentation between IT and OT implemented at plants 1 and 2 after the FY25 cybersecurity findings; plant 3’s OT network still reachable from the office network; vendor remote access through a cellular router at plant 3 undocumented | High for plant 3; segmentation completed and the router removed within the quarter |
| Second line at plant 2: in-progress and closeout audits (400 across the year) | Pay application overstatement, lien waiver gaps and cost-plus billing errors recovered about $225,000; GMP final accounting $188,000 under the cap | High findings corrected mid-project (the capital projects guide) |
| Supplier concentration and continuity (180) | Single-source packaging for the two largest customers’ products from one supplier with no qualified alternative; the supplier’s financial statements showed covenant stress | Medium; second supplier qualification started; safety stock raised for the transition |
| Temporary labor and time (220) | Three agencies billed 61,000 hours; agency hours reconciled to badge records with 2.1 percent unexplained ($38,000); one plant’s overtime approvals performed by the shift lead who earned it | Medium; agency billing reconciled monthly; approval control fixed |
| Covenant and liquidity follow-up (120) | Covenant definitions built into the close as agreed; borrowing base reported weekly against the springing trigger; headroom 11 percent on the leverage covenant | Prior findings closed (the corporate liquidity guide) |
The chief audit executive’s annual report put the year’s findings in margin terms the board understood: the standard cost error, the deductions and the duty overpayment together had misstated or lost about $2.4 million a year at a company earning $12 million before interest and tax, and the OT finding at plant 3 was the one that could have stopped production. The committee’s response was to approve a third auditor for FY28 and to ask that the plant audit rotation run annually at all three sites until two consecutive ratings of Satisfactory. The inventory, procure-to-pay and third-party risk guides carry the methods the engagements used, and the assurance mapping guide the map that showed the committee where quality and EHS covered what internal audit did not.
Questions about internal audit in manufacturing
What does internal audit do in a manufacturing company?
It audits plants on a rotation (inventory, production reporting, local purchasing, payroll, maintenance, quality, EHS, site IT and OT), the cost accounting system and inventory valuation, the supply chain from supplier qualification to customs, quality and recall readiness, environmental, health and safety programs, operational technology security, capital projects and maintenance, and the finance and governance processes every company has.
What is a plant audit?
A site engagement of one to three weeks that tests a plant’s financial, operational and compliance controls as a unit, with pre-visit analytics on purchasing, inventory adjustments, overtime and scrap, observation on the floor, and a rating comparable across sites. Plants rotate on a cycle set by size, change and prior results.
Why does internal audit test standard costs?
Because standard costs are the estimate management runs the business on. A bill of materials missing a component, a routing not updated for a process change or an overhead rate built on the wrong volume misstates product margins and inventory for as long as the error survives, and favorable variances can hide it. The audit tests the standard-setting process, BOM and routing accuracy, overhead rates and variance disposition.
How does internal audit relate to ISO 9001 internal audits?
ISO internal audits test conformance to the quality management system’s procedures and are second-line work owned by the quality function. The internal audit function assesses that program’s reliability (coverage, independence, finding quality, corrective action closure), relies on it where it can, and audits what it does not cover: QMS governance, quality data integrity, recall readiness and the company’s wider controls.
What is operational technology security and why does it matter to the audit?
Operational technology is the control systems that run plants: PLCs, HMIs, supervisory systems and historians, often on unsupported software and connected to corporate networks. Ransomware reaching the OT network stops production. The audit tests segmentation between IT and OT, the OT asset inventory, controlled remote access, compensating controls for unpatchable devices, controller backups and incident response including safe shutdown.
What fraud is most common at manufacturing plants?
Kickbacks and ghost vendors in local purchasing (maintenance and MRO suppliers especially), scrap and by-product sales for cash, inventory theft concealed by adjustments, time and attendance fraud including temporary labor billing, and production or yield reporting manipulated for bonuses. Analytics on vendor changes, split purchase orders, adjustments by user, scrap recorded versus sold and overtime against badge data find most of them.
Related guides
- How to audit inventory — counts, valuation, reserves and adjustments in depth.
- How to audit procure-to-pay — purchasing and payment controls.
- How to audit procurement — sourcing and contracts.
- How to audit fixed assets — plant and equipment records.
- How to audit capital projects and construction — Brightwater’s second line.
- Third-party risk management program — the supplier program.
- Third-party resilience — single-source and concentration.
- Internal audits within an ISO 9001 QMS — the quality audit program.
- How to conduct an ISO 14001 audit — the environmental counterpart.
- Environmental and climate risk audits — EHS and climate in depth.
- ESG auditing — sustainability data and reporting.
- Auditing cybersecurity programs — Brightwater’s first assessment, including the OT findings.
- Auditing cyber resilience — recovery for a plant.
- Procurement fraud schemes — the plant fraud catalog’s largest category.
- Payroll analytics — time and temporary labor tests.
- Corporate liquidity risk — Brightwater’s covenants and cash.
- The one-person audit shop — Brightwater’s function in year one.
- UK SOX and Provision 29 — the UK regime Pennine Foods plc works under.
Leave a Reply