Your Internal Audit Team: Internal or Hired External? Outsourcing Internal Audits

db said:

I have several clients that have hired me to do their internal audits. The rationale is as varied as the organizations. One is very small (only 5 folks). The main point with them is they are too interdependent with each other. A large company has too much turnover to have a consistent audit process (in the roughly three years I’ve been auditing they have been through four Environmental Management Representatives (the longest lasted about 14 months). A third company uses me as an additional auditor, working with their internal sources, for a “fresh eyes” approach. One of my co-workers does a lot of auditing for 17025 because some organizations don’t feel their internal resources would have the expertise. The same holds true with some TS companies. The feeling is us “experts” (a term that might be arguable in my case) know how to interpret the standard better than internal sources.

Click to expand...

Very well put and very true.

I have used an outside consultant to do internal audits 2 times.
Before our TS conformance audit as fresh eyes, and before the surveillance audit for the same thing.
Also the CB auditor asked me "who audits your audit schedules and reports".
Since I am the Management Rep, this is a help to verify we are auditing correctly. We do not now have any internal auditors quallified to audit my functions. The other qualified auditor went on to a much better opportunity.
Plus...Senior management pays more attention to the outside expert because he doesn't live here, and travels more than a 100 miles to get here.
Thus he qualifies as an expert.

Semi-surrender!

ralphsulser said:

I have used an outside consultant to do internal audits 2 times.
Before our TS conformance audit as fresh eyes, and before the surveillance audit for the same thing.
Also the CB auditor asked me "who audits your audit schedules and reports".
Since I am the Management Rep, this is a help to verify we are auditing correctly. We do not now have any internal auditors quallified to audit my functions. The other qualified auditor went on to a much better opportunity.
Plus...Senior management pays more attention to the outside expert because he doesn't live here, and travels more than a 100 miles to get here.
Thus he qualifies as an expert.

Click to expand...

As Maxzwell Smart might say, "Ah, yes! The old 'expert from afar' strategy!"

As one of those experts from afar, I am willing to modify my stance about what is desirable versus what is practical in internal auditing.

Desirable remains having internal folks do all internal auditing.
Practical means "sometimes you have to fill in gaps with outsiders and other temporary workers." Valid reasons for this might include

• termination of key personnel (illness, death, better opportunities, etc.)
• knowledge pool (outsider also provides on-the-job training to in-house folks who may do the audit in the future)
• political considerations (let an outsider take the heat for auditing the bosses)

I think "fresh eyes" is really code for something to do with the knowledge pool. In such cases, I'd be very comfortable with an outside "audit team coach" who makes a point of helping auditors look at processes without bias. Thus avoiding tunnel vision - there's even a smilie for tunnel vision

Before our company make use of outside auditors, however they did not go as plan that they would as such. So what they did is that they are now sending their personnel to training, and let us do the audits internally, because we know the process is lacking in the system than outsourcing auditors, besides its less cheaper for the company....the only thing i think that we could help is to provide added value on audits, what needs to be improved and not being contented on what noncompliance you've seen in the area.
Hope this helps.
Best regards,
Raffy

How Often?

What I was interested in was how often people are doing auditing.

The systems I see most likely to fail are the monthly schedule ones where the audit is put off to the next month and then the next......

This is the main reason I end up doing ongoing work in maintaining my clients' systems including the auditing.

I prefer 6 monthly audits about a month or so before the external.

As some other covers have said I think the best way to resource the IA is their staff doing it; with me as part of their team. Best of both worlds.

I also believe in making a big deal of the internal audit, doing it like an external.

No sneaking around! We have an entry meeting, do the audit - in a day, and then have an exit meeting with management to give them their CARs

MikeL said:

What I was interested in was how often people are doing auditing.

The systems I see most likely to fail are the monthly schedule ones where the audit is put off to the next month and then the next......

This is the main reason I end up doing ongoing work in maintaining my clients' systems including the auditing.

I prefer 6 monthly audits about a month or so before the external.

As some other covers have said I think the best way to resource the IA is their staff doing it; with me as part of their team. Best of both worlds.

I also believe in making a big deal of the internal audit, doing it like an external.

No sneaking around! We have an entry meeting, do the audit - in a day, and then have an exit meeting with management to give them their CARs

Click to expand...

We are currently doing our own Internal Auditing. We have them scheduled for two times a year. They are set-up to be somewhat flexible with a thirty day window for completing them. In the past I have used a quarterly audit schedule, which worked well , and a monthly audit schedule, which did not.

use risk assessment to plan your internal audits

JSW05 said:

—it’s a process that should begin with the assumption that everything’s OK.

Click to expand...

I agree that auditing should be "free from bias". However, one of the ISO 9001 requirements most often ignored is the one that requires internal audits to be planned, taking into consideration the status, historical performance and importance of the processes/functions/areas to be audited. Since most organizations struggle with resources for internal audits, it only makes sense that you audit the most problematic and risky processes more often than the ones that are stable and/or well performers. Very few organizations comply and benefit from this requirement.

Sidney Vianna said:

Since most organizations struggle with resources for internal audits, it only makes sense that you audit the most problematic and risky processes more often that the ones that are stable and/or well performers. Very few organizations comply and benefit from this requirement.

Click to expand...

We do indeed benefit from it. See 8.2.2 - Opinions please... Audit schedule based on importance and 'status'

/Claes

MikeL said:

I prefer 6 monthly audits about a month or so before the external.

As some other covers have said I think the best way to resource the IA is their staff doing it; with me as part of their team. Best of both worlds.

Click to expand...

...As long as you're careful not to do internal audits just for the sake of preparing for external ones. The motive should be how the internal audit benefits the company, not for maintaining ISO registration.

Good idea though, having you accompany internal auditors.

Sidney said:

...it only makes sense that you audit the most problematic and risky processes more often that the ones that are stable and/or well performers.

Click to expand...

Another excellent point, and one that favors using internal people. A good composite look at the past CARs, suggestions, and comments "the buzz" from around the shop, usually gives a very good indication of where to concentrate an audit.

On the other hand, there are certain areas that run so consistently flawless over time that auditing (any more than cursorily) adds no value at all.

By the way, we do ours quarterly according to a plan, but the concentration of effort varies according to the areas that need it.

Wes Bucey said:

I can see adding some outsiders (neighbors as part of free swap) or even some paid professionals to give each team a cross-functional character or to help in on-the-job training for the audit team, but I still maintain the team should have mostly in-house personnel.

Those of you who advocate 100% outsiders to perform INTERNAL audit should take this opportunity to help me understand your point of view.

I should warn in advance that I will be very hard to convince if you claim "employees are too busy" since it is management's chore to schedule things so there is sufficient time to do everything, even if it means increasing staffing or granting overtime pay. I will be similarly resistant to claims that employees are "incompetent" since it is management's task to provide training and opportunities to take such training to eliminate "incompetence" as an excuse.

Click to expand...

So far I am the lone outsource and love it vote. Allow me to explain my logic.
I would never claim that my employees are "too busy". However, they do have higher priorities. We operate in a cohesive team environment so our team mates are already aware of the upstream/downstream requirements. Internal auditing doesn't add to their knowledge of these, we're already feeding this knowledge forward and back.

Our external auditor has operated his own, ISO9001 registered, ISO/TS consulting business for 15 years. He is a certified lead auditor for ISO and TS. He assisted us in implementing our ISO/TS registered quality system. He is a contract employee. You will be hard pressed to convince me that it would be appropriate for anyone other than the Quality Manager to attain this level of competence and knowledge of both internal auditing and our entire QMS.

We are a small company with 60 employees so everyone has cross-functional tasks already. We all view qualilty as part of our job (really!) so we don't have the "It's the QA Department's job" culture. As we grow to the point were full-time quality depart staff is justified, we will transition to qualified internal auditors. It's part of the strategic plan.

Finally, I see an openness, frankness, and honesty with our internal auditor that I have rarely observed elsewhere. Whether this is due to his skill with people or that people don't think he has an ulterior motive, I do not know. What I do know is that our registrar's auditors generate attaboys for and not findings against our Internal Audit process.

<ducks behind big rock, anticipating Wes's return fire>