Can an outside consultant audit all the AS9100 requirements including Internal Audit?

[DannyK]

There was an error in my post. I meant that the internal audit can be audited by the consultant not registrar.

[ssz102]

this is my first heard that inner audit can also conducted by consultant
i think, as long as the method and scope of audit are comply with the standard, it will be ok

[Jeff Frost]

Use of a 2nd party is a growing trend based on information supplied by my contacts in the consulting field. This information is anecdotal but from what I have been hearing many organizations are looking at this as a means to meeting the standards requirements without having to use limited internal resources.

[phxsun2001]

The main issue that I try to bring up is whether a consultant can audit internal audit (IA).

When I was managing the IA activities for a company, I setup the IA program, so I could not audit IA. I had my Internal Auditors audited IA, except for the audit reports that they issued. They cannot audit their own work.
If a company hires a consultant to perform IA, he should be able to audit everything because he is not auditing he own work. He did not set up the frequency of audit, determine audit frequency based on previous findings, review C/A and P/A ...... If he comes back to do the audit the 2nd year, he may not be able to audit the audit report that he issued the previous year. He'll be auditing his own work, but the report had been reviewed by the company already.

I am trying to find out if there is a violation of the standard if the consultant audit internal audit for a company. I don't see a problem.

-Tony

[dsanabria]

In Reply to Parent Post by phxsun2001

The main issue that I try to bring up is whether a consultant can audit internal audit (IA).

When I was managing the IA activities for a company, I setup the IA program, so I could not audit IA. I had my Internal Auditors audited IA, except for the audit reports that they issued. They cannot audit their own work.
If a company hires a consultant to perform IA, he should be able to audit everything because he is not auditing he own work. He did not set up the frequency of audit, determine audit frequency based on previous findings, review C/A and P/A ...... If he comes back to do the audit the 2nd year, he may not be able to audit the audit report that he issued the previous year. He'll be auditing his own work, but the report had been reviewed by the company already.

I am trying to find out if there is a violation of the standard if the consultant audit internal audit for a company. I don't see a problem.

-Tony

You are correct - that is also the interpretation by some registrar (as long as the consultant uses your system / process or the AS9101 checklist OER. then it is not his work and can audit Internal audit. The part that you need to be concern is when they use their own creation / work checklist to audit. (it goes into a gray area).

[Joy]

Hi Phxsun2001,

When you started the thread your question was "Whether you can raise NCR as the consultant was involved".Do you still have that question?I hope by this time the audit is over and you missed the chance of raising NCR.In case still you think that you should have raised one NCR but could not do so as you could not perfectly match the situation with a requirement,I have hint for you for next similar case.Try with clause 4.1 and check if controls are adequately identified for this out-sourced process.You will find that it is not.

Why don't you consider IQA as process in the age of process audit?If,I am in your position (many times I had that) I try to assess the effectiveness of internal audit and this can be understood in many ways.Clause 8.2.2 specify the objectives of internal audit (a and b).Many times we miss to verify if internal audit is effective to verify these two requirements.Also check if internal audit is used as a tool for continual improvement (8.5.1).So,if I find the internal audit is effective,I would not consider raising NCR on this issue.For me the effectiveness is more important than the means (employees or consultant).Number of NCRs raised, is not 3rd party auditor's KPI.There may be organization with 1-2 employees (many AS9120 companies) and there it is not possible to find someone independent.However,if you find that IQA is not effective there are many ways to strip the cat.

[phxsun2001]

Joy,

My registrar told me that I should have issued a NCR during this audit. I did not agree. It was too late to issue one.

I conducted another audit last week. The company hired a consultant to perform internal audit. I issued a NCR. IAW the instructions given to me by the registrar. The Management Rep. did not agree with the finding. I told him to respond in the NCR why he thought they complied with the AS requirement. I told him about the appeal process.

Tony

[AndyN]

In Reply to Parent Post by phxsun2001

Joy,

My registrar told me that I should have issued a NCR during this audit. I did not agree. It was too late to issue one.

I conducted another audit last week. The company hired a consultant to perform internal audit. I issued a NCR. IAW the instructions given to me by the registrar. The Management Rep. did not agree with the finding. I told him to respond in the NCR why he thought they complied with the AS requirement. I told him about the appeal process.

Tony

What requirement are you issuing the NCR against? Where, in AS9100 does it say anything about not being permitted to use an outsider, if they are competent?

I'd be looking to work for a different caliber of CB if I were you - it's not like AS auditors aren't in demand.