From: ISO Standards Discussion
Date: Tue, 25 Jan 2000 08:48:18 -0600
Subject: INFO: Internal Auditing Standards /Arter

From: Dennis Arter

The Institute of Internal Auditors (IIA) has revised their definition of internal auditing and is in the process of changing their standards for the practice of internal auditing. (Please note that the IIA is an international professional society and has been doing this stuff since way before we in the quality profession adopted the concept. Their definition may be somewhat different than your definition.)

We can gain much by following in the footsteps of others. The draft (exposure) standards on attributes and performance of an internal audit program are quite applicable to those of us implementing a quality or environmental or safety internal auditing program. If you wish to see the document, and even comment on their content, you can find them on the IIA web site www.theiia.org (http://www.theiia.org) under "What's New" at the top of the page.

Dennis R. Arter

And the definition is:

"Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations.

It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes."

Bold emphasis mine. Now - what do they mean by consulting? Comments?

[This message has been edited by Marc Smith (edited 05 February 2000).]

With respect to http://Elsmar.com/ubb/Forum13/HTML/000052.html - I wonder how they're defining independence...

[This message has been edited by Marc Smith (edited 10 June 2001).]

looks to me as if the IA is given the opportunity to be part of the fix......

How do we determine if an internal audit adds value? What measurement criteria would be used?

[This message has been edited by Sam (edited 10 February 2000).]

Marc,
I have a book here, 'Flawless Consulting' by Peter Block (published by University Associates Inc, San Diego. He defines a consultant as 'a person in a position to have some influence over an individual, a group or an organisation, but who has no direct power to make changes or implement programs. He goes on to say that a manager has direct control and that the moment you take direct control, you are acting as a manager. ie (as I take it); If you were to be asked by one of your clients to tell the people what to do, rather than advise, then according to Peter Block you would no longer be a consultant but a contracted manager.
He goes on to say that most people in staff roles are really consultants. They plan, recommend, assist or advise in such matters as Personnel, Financial analysis, Auditing, Systems analysis, (and another half dozen in the list.)
Maybe the IIA are coming from the same direction. There is a whole section on Internal Consulting.
rgds, John C

John: Haven't read the book but the concept as you present it is valid. The problem is defining who is qualified to be a consultant. Often during internal audits the guy from purchasing is auditing the gal from receiving. The question becomes is the guy from purchasing qualified to advise receiving.

One factor of consulting is that typically a company hires a consultant (internal or external) based upon some expertise in a specific field. You typically want someone with experience in a specific function / arena.

When a company hires an external consultant, I believe they typically do this believing that person or company has much more experience than they do internally (why hire an external consultant who knows less than anyone in your company?). You hire a plumer to fix your pluming - you do not hire one to learn how to plumb and then fix your sink. In fact, this is a big area of contention with consultants who profess experience yet have little or none. Without going into details, there was a somewhat recent post here which disturbed me - a consultant was asking about a subject that the person obviously, and even so stated, had no background in. Needed information in order to 'look good' at a meeting. Really made me wonder.

My position is that quite often (I would say typically) in internal auditing the auditor does not have the qualification(s) to be consulting in the arena being audited. This is not to say they are not qualified through training to perform an internal audit.

In fact, typically this is a source of hostility in companies - internal auditor from purchasing (or whatever) audits receiving (or whatever) and decides receiving's systems need improvement. Receiving gets mad because they do this every day and here comes this person from purchasing telling them how to do their job. Now receiving wants to audit purchasing as they know they can recommend a few things there. And the war is on. In my opinion the auditors, unless specifically qualified, should be restricted to verifying that folks are following their documentation.

Unfortunately, I believe the move is to evolve (increase the 'importance' of) internal audits. Are internal audits important? Yes, I believe they are very important. Should auditors be involved in 'consulting'? Only as a source of information for input to management unless the auditor is specifically qualified in the arena the auditor is auditing which is not typically the case.

Do you want an HR employee telling maintenance how to improve their systems? Do you want a fork truck driver 'consulting' in your calibration laboratory? If so why? Based upon what qualification(s)? If not, why not?

Originally posted by Marc Smith:

Do you want an HR employee telling maintenance how to improve their systems? Do you want a fork truck driver 'consulting' in your calibration laboratory? If so why? Based upon what qualification(s)? If not, why not?

An HR employee is auditing the sytem not the job done. Of course they can suggest improvements.
And please do not think that I'm flaming but even if I am a quality ***. manager I think that you are a litlle bit elitist.

I am working in litlle cie (100 employees) and if I don't use staff and floor employees for internal auditing i'll die in a week or two (burn-out).
http://www.qs9000.com/ubb/biggrin.gif
Only my 2cents.

I've done some mentoring/training of new co-workers, and have found that some of the best suggestions come from those who don't know what you're doing. The Internal Audits are supposed to make you question your system, and I don't see why you should oppose a little assistance in the matter.
The problem is what Marc touched on above. Don't take it personally, and don't let conflicts develop. If there was no better way to do your job you'd be trapped in a dead end job. There's always room for improvement, and even your HR guy could provide good input.

AJP

Much of this is philosophical as much as realistic. You're in a small company so some people wear many hats. None the less, if you hire a person to clean the factory floor, you might want to think twice about having that person suggest 'improvements' to the design engineering folks. They may really believe that person is not qualified to make suggestions about their systems.

"...HR employee is auditing the sytem not the job done..." So - they only audit the system and not what people are doing? Please explain. I maintain internal audits are about verifying people are following the systems (procedures) applicable to their job. When you say one is not auditing "...the job done..." are you saying that in the sense of the 'quality' of how the job was done? If so, well - that's open for discussion.

"...Of course they can suggest improvements...." No problem. Let me know when you go into the hospital for surgery. I'll offer your doctor some 'suggestions for improvements' on operating procedures (systems) s/he uses on you. OK with you?

These things are done and I admit sometimes a suggestion is appropriate. However, I have seen this go to extremes where an auditor is making suggestions about a system that they have no qualifications in. The auditor calls them suggestions and the auditee calls them opinions. And the fight is on!

They can audit the systems (Are you doing what you say you are doing? Show me.) but are they qualified to comment on the system design (suggestions)?

OK - let's take an example of an engineer auditing HR. Typically an engineer has some background with HR folks. How? They may provide HR with requirements for a hire. What I am getting at here is the engineer probably has interfaced with HR from time to time which gives them an understanding of some aspects of some of HR's systems. If I was in HR, however, I might not agree with an engineer who wanted to tell me how to improve how I select suppliers. On the other hand the engineer may have some 'experience' having had to spec equipment from multiple suppliers.

A college degree can sometimes help one understand another's systems. My degree is in biology, however I had some qualifications in metology upon graduation by virtue of all the measurement and test equipment I used during chemistry class and many other classes. I may not be a metrologist, and I wouldn't want to tell a metrologist how to run his/her business, but I sure would feel qualified to audit a lab and I may also have some valid suggestions for improvement.

All this said, if your system works for you that's fine. I will never (um, well, maybe not NEVER, but you know what I mean) tell someone their system is garbage when it works for them. That does not mean it will work for every company. You obviously have not experienced Internal Auditor Hell! Be happy!!! http://www.qs9000.com/ubb/smile.gif You don't want to go there, I promise you. 'Observations' (now most often called Opportunities for Improvement) can lead to real problems. No - they don't always as your case evidences. Again I say, be happy for you are blessed! I'm pretty radical about this because I've seen Internal Auditor Hell.

I've seen many systems like yours where no problems come up. I do not hesitate to say that the majority of internal audit systems do run smoothly as yours does. But when they go bad, they seriously affect a whole company negatively. I preach methodologies I believe reduce or eliminate problems.

"...And please do not think that I'm flaming....". Well, I may be a "...litlle bit elitist..." (or a lot elitist) but your position is welcome and not taken as a 'flame'. I would rather someone speak out (and most do here - that's why I keep the forums up) than to just go away. I learn from alturnate views - we all do. Heck, Alan and I have a standing arguement - on everything. He says something and I tell him he's wrong. I say something - he tells me I'm wrong.

Welcome to the club! Register and stop by daily for 'all the action'! Always open and ready to exchange ideas! We're all personalities here! (Just ask barb...)

Originally posted by AJPaton:

Don't take it personally, and don't let conflicts develop. If there was no better way to do your job you'd be trapped in a dead end job. There's always room for improvement, and even your HR guy could provide good input.Bingo on two counts. Yes - don't take it personally. And - Asking questions probes. They make people think. The problematic part is writing up an 'opportunity for improvement'. Worst case is an auditor gets the GOD complex and sees opportunities for improvement everywhere.

personality? isn't that what makes the world go round?

hey ...on that floor sweeper internal auditor telling Design Enineers what they are doing wrong, and making suggestions....Maybe.....Its not so much the making suggestions as it is asking a question, with genuine interest and inquisitive form, requiring evidence... that makes the design engineer look at something simple through different eyes and question his actions to initiate his own improvements as a response..instead of not seeing the forest through the trees, he now sees the leaves!!!!!!

opps....once again i only read so much, entered a response and didn't see marc already said that!!!! dah

I forgive you Barb! In fact, I am guilty of that probably as often as you are.

Marc said: These things are done and I admit sometimes a suggestion is appropriate. However, I have seen this go to extremes where an auditor is making suggestions about a system that they have no qualifications in. The auditor calls them suggestions and the auditee calls them opinions. And the fight is on!

The auditee is probably right. No fault of either party in general either. The internal auditor (company associate) is just trying to fufill an obligation, one with which they have limited knowledge and experience. Compounding that, they may have limited knowledge about the area they are auditing. Leads to incorrect conclusions and muddled suggestions. Knowledge of auditing and the area being audited is key here. Many organizations do the best they can, given the circumstances, but forget this essential point. Can end up making things worse.

Now who has this knowledge? The outside consultant or the HR associate? I believe each has an advantage and disadvantage over the other. What is the nature of your business or the area being audited? Who would best support an audit in this area? Careful consideration and knowledge of auditor strengths and weaknesses is in order.

Additionally, the auditee may be the authority, but should not be beyond reproach. Only a fool would choose to dismiss comments made on the grounds that they already know it all! Everyone must keep in mind that this is a continuous improvement process.

Regards,

Kevin

In my company we talk about two levels of internal auditing.

Compliance auditing; Are people following the system. This is where I start new auditors. I reckon this is a fairly easy decision for an auditor, and I'm not too worried about the background of the auditor.

Effectiveness auditing; Is the system effective at helping the company achieve its goals. When I give someone one of these audits, I believe they have to have relevant background experience to judge whether or not the system will help us hit our target over the year(s) ahead. I also expect the auditors to have developed enough experience to realise they are not God. Otherwise you are right "internal auditor hell" arrives at some speed. Rather than tell people how to run their system we concentrate on the effect of the system on targets and performance standards. This usually helps them find their own solution instead of having one imposed by the auditor. The golden rule for all my auditors is let people run their own systems. If they don't want to take our advice, that is their perogative. Mind you we make sure their boss knows whats going on.

In short I think both views expressed are correct, and the emphasis is on the audit manager to pick the right auditor for the job.

Originally posted by isorin:

An HR employee is auditing the sytem not the job done.I don't agree that internal auditors should be auditing the system. I believe they should be restricted to auditing the job done (work instructions, procedures, etc.)

I have found it useful to divide auditing into three catagories and responsibilities.

1- Quality System Audits, A random sampling of the quality system. This does NOT include auditing compliance to the standard.

Resp: Internal Auditor

2- Process Audits, An audit of a specific process, i.e., machining operation, welding, plating.

Resp: Internal Auditor

3- Product Audits, A breakdown of the final product. Verify paperwork trail,inspection and test results, for each item of the product. Verify key characteristics meet dimensional requirements.

Resp: Layout Inspection

How about:

Compliance (do we comply with the standard)
Example: Desk audit of high level systems

System (the theory)
Example: Audit of Document Control

Process (the practice)
Example: Audit of an assembly or fabrication ‘station’ (note to service industries: you DO have comparable processes)

Product (the result)
Example: Dock Audit

[This message has been edited by Marc Smith (edited 10 June 2001).]

Another thought:

Internal (First Party, Self)
This type includes audits by your company employees, consultants and contractors.

External
1. Supplier Audit
1a. Second Party
This is where a customer employee audits your company or where your employee audits a company which supplies your company.

Independent Organization
1. Third Party - Registrar
1a. A customer wants an audit of your company but wants your company to pay for it.
1b. This type of audit is described as independent, but with QS-9000 this is not really the case.

I may as well jump in with my two left feet. We recently had internal auditor training conducted by an experienced "instructor" through a grant funded by our State Dept of Labor. He taught our auditors to use the new standard to audit our procedures. I bit my lip during the training, but told him (privately) that I will not allow the new auditors to audit the procedures. The procedures were written and approved to comply with the standard. If that is allowed, we would be sparring over their inexperienced interpretation of the standard and we would never get around to auditing how the procedures are being followed. We are using Human Resource, Accounting, Engineering, Production Control, Designer, System Administrator(MIS),Shop, and Quality personnel(me). The consultant agreed and when we meet again, soon, we will concentrate on the procedures, not the standard. Another consultant(one we are under contract to) is reviewing and commenting on the procedures before our internal auditors see them. These are all bright people, but they lack the experience necessary to dig into the standard. This forum demonstrates differing opinions from experienced "Qualified" individuals. Our internal auditors will be allowed to report all observations and our steering committee will separate the wheat from the chaff. JMHO

energy

I think all internal auditor courses do that - except mine, of course. Audit to the standard is their base.

You all know my feelings on 'typical' internal auditors auditing to the standard.

Is anyone current on the status of the Institute of Internal Auditors (IIA)?

Any members here (assuming it's still in existence - I haven't looked yet - just 'cleaning out the closet...)?

My boss is working on the budget and asked for a wish list. I'm looking at The Institute of Internal Auditors website and thinking of adding some of their seminars and publications to my list. Does anyone have an opinion about the Internal Auditor magazine? or the Institute in general?

Thanks

I looked at obtaining IIA certification once......I got the impression that they are primarily financial oriented folks, even for the internal.

Hershal

I looked at obtaining IIA certification once......I got the impression that they are primarily financial oriented folks, even for the internal.

Hershal

I got that impression too, but it seemed that some of their information can be applied generally. Have you read any articles from the IA magazine?

internal auditing or auditor I feel was not given a full distinct on the bounderies of audit (even not protected to emotional and personnal acceptance to the audit results by the top managment), an accountant auditing Plant operation, i think is ok , as long as the element of audits are within the bounderies of what was documented to what are being done, but again auditors find him or herself deadlock after discovering new process are being in done and not documented. with this I can only say auditors are not to give suggestion (althought its disturbing) even recommendation but limit it self to discussion on what were the findings and pass the responsiblities to top management to decide what needs to be done, top management may or maynot asked the auditor's input to improve or correct such audit findings anyway. and the auditors response should not go beyond the limit of what was documented. the process of auditing with the question of "you documented that this is being done, will you show the evidence that's its being done" sounds very redundant and anoying in my opinion, I rather asked the question "what changes or improvment done and difficulties in preparing records." then byitself evidence will pop-up.

cyrus