Outsourced Internal Auditing
Why would a company choose to outsource their internal audit? After all, can’t we just learn how to do it ourselves?
Like most things involved in ISO 9001 related standards, the internal audit needs to be effective. For many companies outsourcing it may be the most effective way. Here are some considerations.
WHAT IS AN INTERNAL AUDIT?
Let’s start by understanding what an internal audit is.
Internal auditing is an impartial and objective activity that adds value and improves a company’s operations. It is included in the requirements to monitor, evaluate, and continually improve your quality management system. Internal audits are required above and beyond any certification body audits. It is largely held that internal audits should be more robust than certification body audits as they can be even more helpful in improving the company.
AUDIT SCHEDULING ISSUES
It is often difficult to maintain an internal audit schedule when employee auditors are busy with their day to day activities. In a really busy company, finding time to do the audits is difficult, especially in smaller companies.
ATTRIBUTES OF AN EFFECTIVE AUDITOR
Objective and impartial auditors need to be chosen. That may be hard to do when selecting auditors from within, a person that has no bios and is not swayed by company politics. Selecting an experienced and qualified outsider is often a better answer.
INTERNAL AUDITORS ARE ALSO CONSULTANTS
One of the definitions of internal auditing includes that it is also a consulting activity. That’s a key element in adding value. Keep in mind that certification body auditors cannot consult. They work for the certification body so it is a conflict of interest. That is not to say they can’t be helpful but they have limits and some are more helpful than others. Internal auditors work for you and have no such restrictions.
Experienced outside auditors bring additional insight and expertise based on how well they know the standard and where else they have been.
They are aware of difficulties other companies have had and pitfalls they have fallen into so they can help you avoid and overcome them. This has helped many auditors to develop effective problem solving skills.
They bring a wealth of knowledge of how other companies apply the standard. They visit many other companies with a wide range of products, services, size, and company cultures. That may bring ideas and insight for improvements to more than just your quality management system.
KNOWLEDGE OF THE STANDARD
They do know the standard in depth beyond what an employee is likely to know. They are well trained in the standard. They work with the standard every day providing them with a deeper understanding of it and how it applies to various applications. They especially bring a depth of knowledge of just what each portion of the standard really means.
Many of them work with multiple standards. Experience with aerospace, automotive, medical devices, and the environmental standards may provide additional insights that can help you.
WHY DO YOU WANT TO BE CERTIFIED?
One of the first things to ask yourselves is why do you want to have a certified quality management system? If you are just doing it to satisfy a customer and don’t intend to put anything more into it than you absolutely have to you will end up working hard and receiving little benefit. Your system will become a festering thorn in your side and teach you many new cuss words.
On the other hand, if you want to see improvement and embrace what your quality management system can do for you, management of the company gets easier, it becomes more effective, productive, and profits tend to improve. It has been said that ISO 9001 and its related standards are a collection of best practices. They certainly include concepts that are taught in business schools.
THE STANDARDS ARE NOT PRESCRIPTIVE
ISO 9001:2015 and its related standards are not particularly prescriptive, that is they lay out the requirements but leave for you to determine how to meet them. Needless to say, there are very many ways for each requirement to be met.
An experienced auditor is more likely to recognize ways to meet a requirement that better fits your operation. His breadth and depth of knowledge and experience is a significant resource to you.
It is common for auditors and others to allow interpretation drift to creep in. Even with good intentions some end up thinking the standard requires something it doesn’t. The more experienced the auditor the less likely this is to happen.
GATHERING AND ANALYZING INFORMATION FROM DOCUMENTS AND RECORDS
The actual practice of auditing requires the ability to gather and analyze information. Gathering information is from reviewing documents and records when they are available. Experience in reading the documents and records of many companies with many different formats them is helpful.
GATHERING AND ANALYZING INFORMATION THROUGH OBSERVING AND INTERVIEWING
Gathering information is also by observing and interviewing. This is particularly important when documents and/or records are not required. These skills are sharpened from experience in many different audit settings. Experienced auditors are comfortable talking with people from all strata of the organization. The most accurate information is gleaned when auditors have the ability to get people to feel at ease when interviewed.
APPROPRIATE AUDIT RECORDS
Auditors need to provide good records of the audit. Experienced auditors tend to provide records with the following attributes:
Clear – use words and terminology that are easy to understand.
Concise – write the statements as briefly as possible.
Complete – providing a thorough audit.
Correct – accurately record the information.
Confirmed – verifying to ensure the correctness of the information.
A well trained and experienced outsourced internal auditor may be what you need to properly maintain and often invigorate your quality management system.
Senior Consultant – Perry Johnson Consulting