Why training your ISO Internal Auditors is a ‘Must’

The Competency requirement includes having competent Internal Auditors - training must be part of such competency

Let’s consider internal auditing of the 2 most popular management system standards ISO 9001, the quality system standard (QMS), and ISO 14001, the environmental management system (EMS).

Many people have claimed that 'we've not had a problem with internal auditing until now'. But that has changed!

Table of Contents

• Traditional Internal Auditing Practice
• 5 Reasons Why Internal Auditor Training is a Must
  1. Major Changes to ISO 9001 and ISO 14001
  2. The Requirements of ISO 9001 Clause 9.2 Internal Audits
  3. The Requirements of ISO 9001 Clause 7.2 Competence
  4. To Secure the Benefits of good Auditing Techniques
  5. To Harvest Improvement Suggestions
     1. Five Steps to Identify Improvement Opportunities from Internal Audits
        1. Begin with Open Questions
        2. Ask Specific Questions
        3. Ask ‘What-if’ Questions
        4. Ask to see records
        5. Listen

• How to Ensure Your Internal Auditors Get the Training They Need

Traditional Internal Auditing Practice

Historically, internal auditors have not been formally trained and certification bodies (CBs) have accepted this practice.

Furthermore, CBs have accepted internal audit programs based solely on the auditing of procedures, work instructions and other lower-level documents.  

When many organisations migrated to the 2015 standards, the question arose as to whether the traditional approach would continue to be acceptable. Examination of ISO 9001:2015 and/or ISO 14001:2015 clearly indicates that formal internal auditor training will be necessary.

In this article,  we list down 5 reasons that highlight the importance of audit training. The first 3 arise directly from the standards themselves and the final 2  being concerned with maximising the benefits that can be achieved with best internal auditing practices.

5 Reasons Why Internal Auditor Training is a Must

Reason 1: Major Changes to ISO 9001 and ISO 14001

Major changes have been made to both standards, including many for which documented procedures are unlikely to exist. Consider just four such examples:

1. Context of the organisation, where the monitoring and review of information regarding external and internal issues affecting the organisation is an entirely new concept
2. Leadership, where the involvement of management is greatly expanded and the need to involve top management in internal audits is a requirement,
3. Planning, where the auditing of actions to address risks and opportunities is now a requirement and, consequently, an understanding of the application of these terms is needed, and
4. Organisational knowledge, where both the consideration of tangible and intangible assets is needed.

Internal Auditors will need to understand these terms as well as their interpretation and application.

Reason 2: The Requirements of ISO 9001 Clause 9.2 Internal Audits

Could someone auditing the effectiveness of the implementation of procedures alone fulfil the requirements here?  Sub-clause 9.2.1 a) 2) requires audit evidence on whether the QMS/EMA conforms to ‘the requirements of this International Standard’.

Without training, it is unlikely that an internal auditor will understand the requirements relating to policy, processes, procedures and other documentation (including records).

Reason 3: The Requirements of ISO 9001 Clause 7.2 Competence

Sub-clause b) here describes competence as an appropriate combination of ‘education, training or experience’. Note that here the word ‘or’ is inclusive and should be interpreted as ‘and/or’.

Sub-clause c) requires the organisation to ‘take actions to acquire the necessary competence’.

Education and experience alone cannot make someone a competent internal auditor. And ‘sit by Nellie’ is hardly an effective or credible training method.

Any reasonable interpretation of clause 7.2 requires internal auditors to be formally trained.

We next turn to two reasons concerned with turning internal auditing into an opportunity…

Reason 4: To Secure the Benefits of good Auditing Techniques

To thoroughly audit a QMS/EMS, it is necessary that internal auditors mimic the behaviour of CB auditors.  External auditors use many sources of information, which will vary depending on the scope and complexity of the audit, and may include the following…

1. interviews with employees and other persons;
2. observations of activities and the surrounding work environment and conditions;
3. documents, such as policy, objectives, plans, procedures, standards, instructions, licences and permits, specifications, drawings, contracts and orders;
4. records, such as inspection records, minutes of meetings, audit reports, records of monitoring programmes and the results of measurements;
5. data summaries, analyses and performance indicators;
6. information on the auditee’s sampling programmes and on procedures for the control of sampling and measurement processes;
7. reports from other sources, for example, customer feedback, other relevant information from external parties and supplier ratings;
8. computerized databases and websites.

Without training in these techniques, it is likely that weaknesses and noncompliances will be left undetected, and be found subsequently by external auditors.

Reason 5: To harvest Improvement Suggestions

Internal audits offer convenient and relaxed opportunities for personnel at all levels and functions within the organisation to point out defects in systems and procedures, and to suggest many small improvements (and occasionally a major improvement) to management systems.

By capturing, reviewing and implementing these suggestions, you help ensure the robustness of the QMS/EMS.  And every nonconformance avoided represents a real saving of time, money and other resources.

Consider for a moment how much better your internal audits would be in gathering interview evidence, and in identifying improvement opportunities if they followed the following 5-step guide:

Five Steps to Identify Improvement Opportunities from Internal Audits

1. 1. Begin with Open Questions (as in ‘open-ended’ - What is the role of your function? How do you do that?)
   2. Ask Specific Questions to get specific information (Which were the lot numbers involved?)
   3. Ask ‘What-if’ Questions to get more information on a topic.
   4. Ask to see the records, documents & other evidence
   5. Listen; don’t talk except to ask questions or paraphrase answers.

It is only with trained internal auditors familiar with these methods that your organization can benefit.

How to Ensure Your Internal Auditors Get the Training They Need

We would suggest that formal ISO 9001 internal auditor training and/or formal ISO 14001 internal auditor training (with certification examinations) is the best approach to ensure the competency of internal auditors and maximise the potential benefit arising from the internal auditing process, which process you cannot be avoided.

Of course, we have a vested interest; we are an online ISO Auditor Training Company, after all.  However, that doesn’t mean that everything stated above isn’t absolutely true!

Related Articles

• ISO Auditor Training: A modest investment for a Big Payday!
• Certified ISO Auditors Need Further Training - It's About Competency
• Internal Auditor Courses - Overview

deGRANDSON Global is an ISO Certified Educational Organization

We have chosen ISO 21001 certification because, unlike IRCA and Exemplar badges (which in our opinion are commercially compromised), it is based on independent third-party assessment.  It is a ‘university grade’ standard in use globally by schools, colleges, and universities to demonstrate their competence.