Where do you define Internal Auditor qualifications?

J

Jim-S

Hello,

We had a discussion at work today regarding where the requirements (education, training, certification, experience) for an internal auditor should be captured. Historically our company captured these requirements in a formal approved job description. Personnel are then hired to meet those requirements. - However, couple of coworkers I was talking with are more accustomed to these requirements being detailed in the company's internal audit procedure. They said this was a stated requirement, but were unable to provide the ISO reference.

Is this accurate? Can anyone provide me with the appropriate reference?

Thanks,
Jim
 

insect warfare

QA=Question Authority
Trusted Information Resource
Re: Where do you define auditor qualifications?

Where an organization chooses to document its education, training, skills and experience is really up to them. Assuming you are talking about ISO 9001, it does not state anywhere that you even have to document them, but ISO 9001 paragraph 6.2.2a does require that the organization "determine the necessary competence of personnel performing work affecting conformity to product requirements" - this is usually achieved through documentation of some form, while recognizing that the competence is based upon an appropriate combination of the 4 factors I mentioned above.

Normally I see some of this information in job descriptions, other times I see them in documented system procedures, and I almost always see them in both. It really is up to the organization to decide this.

Brian :rolleyes:
 

AndyN

Moved On
Re: Where do you define auditor qualifications?

Hello,

We had a discussion at work today regarding where the requirements (education, training, certification, experience) for an internal auditor should be captured. Historically our company captured these requirements in a formal approved job description. Personnel are then hired to meet those requirements. - However, couple of coworkers I was talking with are more accustomed to these requirements being detailed in the company's internal audit procedure. They said this was a stated requirement, but were unable to provide the ISO reference.

Is this accurate? Can anyone provide me with the appropriate reference?

Thanks,
Jim

Jim: I think you may be starting from the wrong place. Define competencies, first. Looking at this from an "HR" perspective is probably why you are having a difference of opinion. I'd suggest that the people who are saying it has to go in a procedure for audits are also barking up the wrong tree. Why not have a database (Excel spread sheet) and define competencies, and keep a record of how well or not your auditor candidates fulfill those requirements, and then what was done about it, including training, to bring them up to speed. Make reference in the IA procedure to the database - job done.
 

John Broomfield

Leader
Super Moderator
Jim,

For any task your management system should inform supervisors of the competencies required and the people who have demonstrated these competencies.

Competent supervisors know that competence goes beyond qualifications and experience. They know that competence is the result of the person demonstrating the required abilities, skills and knowledge to complete the task well; when working as part of an effective system.

Job Specifications usefully specify the required abilities, skills and knowledge.

Users of the management system may be blessed with a spreadsheet or database to help them to select or verify the person is competent for the task. This resource is updated by any process that is meant to result in competence or partial competence such as recruiting, training, outsourcing and purchasing.

In these days of one-page flowcharted procedures, rarely are these competencies specified in any procedure including the procedure that describes the auditing process.

John
 

Big Jim

Admin
At least some certification bodies ask auditors to check to see if internal auditor competencies are defined and if the internal auditors meet their criteria as part of stage 1 audits.

As a result I sometimes see the requirements included in the internal audit procedure. I'm not saying I prefer it there, just that I have seen it there quite a bit.

Since it has been planted in the auditor's mind by his stage 1 workbook, it is likely to be on their mind when auditing the internal audit other times as well. I suspect that is why more auditors seem to be looking here more than they did a few years ago.

I think most companies tend to keep those records with other competency/training records, but I have seen a few cases where they are kept with the internal audit, as they expect the CB auditor to be looking for them. This seems to be more frequent when a contract internal auditor was used and the auditor left the records behind with the rest of the audit.
 
I have been encouraging organizations where I worked to have internal auditors trained to meet the requirements of ISO-19011:2011 (section 7); I believe an internal auditor should be at least as competent as an external auditor to have a strong and effective management system. I believe an auditor with a strong process knowledge and auditing skills will add value to the auditing process.

With kind regards,

Ramakrishnan
 

John Broomfield

Leader
Super Moderator
Jim,

Yes, I was forgetting those sets of documents created especially to show an auditor.

As auditors we should remind our auditees not to make documents especially for us.

John
 
Last edited:

insect warfare

QA=Question Authority
Trusted Information Resource
In these days of one-page flowcharted procedures, rarely are these competencies specified in any procedure including the procedure that describes the auditing process.

In my experience, the function of internal auditor is usually a supplemental role given to someone who already has an established job title (quality manager, operations manager, test engineer, etc.), so I'm not surprised to see qualifications and competencies documented in the audit procedure itself, because it usually fits there better.

A job description document for (say) a quality manager may also specify these qualifications and competencies, but I usually see them referencing the system document (the internal audit procedure), as a system document is relatively easier than updating a job description document because of 1) the specific hiring criteria it contains, and 2) the potential of bureaucracy in updating such a document. On top of that, not all internal auditors begin their employment phase as "internal auditors" - some are also summoned during their tenure to perform the function (with training as required).

Brian :rolleyes:
 
S

SuperGirl

We have it included in our Internal audit procedure. It seemed to fit their best- we usually bring in an external party to conduct our audits and have just started training people internally to audit.
 

John Broomfield

Leader
Super Moderator
In my experience, the function of internal auditor is usually a supplemental role given to someone who already has an established job title (quality manager, operations manager, test engineer, etc.), so I'm not surprised to see qualifications and competencies documented in the audit procedure itself, because it usually fits there better.

A job description document for (say) a quality manager may also specify these qualifications and competencies, but I usually see them referencing the system document (the internal audit procedure), as a system document is relatively easier than updating a job description document because of 1) the specific hiring criteria it contains, and 2) the potential of bureaucracy in updating such a document. On top of that, not all internal auditors begin their employment phase as "internal auditors" - some are also summoned during their tenure to perform the function (with training as required).

Brian :rolleyes:

Brian,

Excellent point.

Auditing is usually a part-time role so HR is unlikely to maintain a Job Spec specifying the required abilities, skills and knowledge of an auditor. HR may usefully watch for candidates who demonstrate the recommended attributes or behaviors (abilities) from ISO 19011, so they can be "volunteered" for training.

The required competencies and verifications for auditor and lead auditor could usefully form part of the internal audit programme alongside the auditing procedure, the audit schedule and top management's objectives for the internal audit programme.

The key is where best to maintain the information for easy access by those who must assign competent people.

John
 
Top Bottom