Your Internal Audit Team: Internal or Hired External? Outsourcing Internal Audits

AndyN said:

For those of you who perform internal audits on behalf of a client, what frequency do you use for the audit program (I don't mean in Khz!)?

Also, what considerations do you give to the 'status and importance' requirement when planning for these audits?

In the past, I had performed audits for a client who was adamant that only one audit/year was all he was going to pay for for each site in his qms!

Click to expand...

For my longest term client (4 yrs), I have used a quarterly schedule which has now been "leaned" to a trimester format. I didn't initially think the 25% cut would work, but I have continued to improve the audit plan / schedule and things seem just fine. Of course I miss the $$$. I will have a new, very small client in the next two weeks who just wants the one-timer prior to the third-party audit. I have let them know that there may be a benefit to an hourly rate arrangement, if there are issues uncovered during the IA.

As far as status and importance, in the past I have set the audit schedule based on past results; prioritizing areas that have shown previous findings by scheduling them earlier in the one year cycle than areas that have no findings. And I will obviously devote more time to the core procedures (Six Diamonds of ISO).

Past performance (in and of itself) is no criterion, really! Just like everything else in life, history is not a predictor of the future and often this is why management see no benefit from audits. We spend too much time looking over our shoulders at the past - when most management are interested in what's over the horizon - the new and changed! That's exciting (worrisome) and would be for auditors too, if they were given half a chance........

How about we stop this facination with historical audit findings and help management prevent some trainwrecks for once?

AndyN said:

Past performance (in and of itself) is no criterion, really! Just like everything else in life, history is not a predictor of the future and often this is why management see no benefit from audits.

Click to expand...

ISO 9001 states that the status of processes and areas shall be taken into consideration, when planning audits. Past performance is a component of a process status. So, to ignore past performance is not correct, IMO.

You just need to make sure that the indicators of past performance are appropriate. Maybe past non-conformities might not be the most reliable indicator to use, but past performance should obviously be used as a component of audit planning.

Not everything in life is like the stock market.

If you had to fly to Lagos, would you fly Air Nigeria or Lufthansa, given the choice? Wouldn't you be interested in both airline's safety record (past performance)?

Sidney Vianna said:

ISO 9001 states that the status of processes and areas shall be taken into consideration, when planning audits. Past performance is a component of a process status. So, to ignore past performance is not correct, IMO.

You just need to make sure that the indicators of past performance are appropriate. Maybe past non-conformities might not be the most reliable indicator to use, but past performance should obviously be used as a component of audit planning.

Not everything in life is like the stock market.

If you had to fly to Lagos, would you fly Air Nigeria or Lufthansa, given the choice? Wouldn't you be interested in both airline's safety record (past performance)?

Click to expand...

You are correct Sidney. I was thinking only 'past audit results', rather than past process performance when I typed that. Thanks for pointing that out. I revise my comment - "Past Audit results in and of themselves are no criterion"

If you read further on in my post I did qualify my statement in terms of "fascination with" past audit results, I believe, but I see it may have been misconstrued as any past performance......

ngohrvinet said:

I think with a company below 100 people the ony way that makes sense is external.

rgs

Click to expand...

Not necessarily, it all depends on how management allocates their resources. Many of my Clients are organizations with approx 100 or fewer employees and have very nice audit programs run by a team of 5-8 auditors.

I also must say that I perform internal audits for organizations. It's business that I do not (cannot) turn away, but deep in my heart I wished that management would take more ownership and have a greater interest in their audit program.

Stijloor.

Crusader said:

Not sure if this would make a good poll or not but here goes:
How many of us use our own internal auditor team? and How many of us actually hire an external source to perform internal audits?
How many of us switched from internal to external and found it to be better / worse?
-jus curious...

Click to expand...

I have internal auditor team. HOwever, this team does not perform audits. Sometimes I perform audits and sometimes I hire someone from external to perform. This specially happens with ISO/ IEC 17025 which requires technical expert.

amanbhai said:

I have internal auditor team. HOwever, this team does not perform audits.

Click to expand...

So what's the purpose of the audit team?

We perform internal audit in-house.
We never try to Out source internal audit.
By

Since the poll was an old one and running into 4 year plus, I have closed it; however the posts will continue to come in.

From the poll, it can be seen that 52 % of the participants opted for "We perform internal audit in-house - love it & wouldn't change"

Good also to see that the total percentage of 'waste of time & resources' (internally done/externally done) was a minority.

Internal audit done well is a valuable activity. And the converse is true.