Outsourcing Internal Audits - Is this a bad idea?

[apestate]

I don't know about this one.

I asked our auditor how he felt about it over the phone, and he said that he has to be careful not to consult. However, in thinking out loud, he might have said something about not seeing a problem with it as long as we created a supplier file for whoever we choose to do the internal audit, to treat the company or person just like we would a raw material supplier.

Ok, and I think this is something I want to do for at least our first internal audit, and something I definately want to do before our registration audit with the registrar's auditor.

Is this a bad idea?

What are some things I want to be aware of when choosing an outsource for an internal audit??

[db]

I do a lot of internal audits (I'm doing a 14001 tomorrow). Here is what I recommend. First, look at the credentials, they are not the only thing, but you will be graded on them from your registrar. Secondly, meet with the auditor(s). Make a judgement of whether you want your QMS/EMS in their hands. Thirdly, rather than treat them as a supplier, I would treat them as both an employee and a supplier. Maintain a training file on the auditor(s) and a company file on the company that employs them.

As far as the consulting, I disagree. The auditor would be working as an employee internal auditor would work. Should any internal auditor find something that can be improved, I would want the internal auditor to bring it up. Auditors need to be objective and unbiased, but still focused on continual improvement. The internal auditor should use your procedures, forms, etc. It would be okay to adopt their procedures and forms into your QMS, but only if it makes sense. Don't let them "demand" they use their stuff, after all it is your QMS and your organization they are auditing.

[Aaron Lupo]

In Reply to Parent Post by atetsade

I don't know about this one.

I asked our auditor how he felt about it over the phone, and he said that he has to be careful not to consult. However, in thinking out loud, he might have said something about not seeing a problem with it as long as we created a supplier file for whoever we choose to do the internal audit, to treat the company or person just like we would a raw material supplier.

Ok, and I think this is something I want to do for at least our first internal audit, and something I definately want to do before our registration audit with the registrar's auditor.

Is this a bad idea?

What are some things I want to be aware of when choosing an outsource for an internal audit??

Is there anything wrong with it not really except it is a waste of money IMHO. Why hire someone to do what you can already do? With that being said, qualify them as you would any other supplier of critical/major materials.

As far as doing it before your registration audit, umm that might be a good idea since they can't/shouldn't be doing your assessment audit until a full round of internal audits have been completed.

[db]

In Reply to Parent Post by ISO GUY

Is there anything wrong with it not really except it is a waste of money IMHO. Why hire someone to do what you can already do? With that being said, qualify them as you would any other supplier of critical/major materials...

Your question: "Why hire someone to do what you can already do?" is the heart of the matter. Some of the companies I work with use us because they feel they are too small to develop the necessary competence. One customer finds that it is actually cheaper to use us than to take one of their high-dollar designers and divert some of their time. Others like the "independence". They use us as the "bad guys". Or perhaps by paying us the internal adit program becomes more significant. I've had several companies that used us to start their program and provide on-the-job training for their internal auditors. After several audits, they are weaned from us and take over the audits themselves. What I don't like is for a company to use us because it is "easier".

Whether it is a waste of money, or not depends on the company. But without a doubt, just like using consultants to develop your system, you can do it without outside help. And in most cases, the result will be better in the long run.

[howste]

I agree completely with Dave (in case you're wondering, I do contract internal auditing also). This issue has come up before, and there are always two opinions about outsourced internal audits. I believe that blanket statements that it's a good or bad idea can't be made. You have to look at the pros and cons of each and make an informed decision based on the company's circumstances.

As far as the consulting issue, I believe that Atetsade was saying his registrar auditor was being careful not to consult.

[apestate]

yes the registrar auditor was being careful not to consult.

he enjoys thinking out loud though, and from his perspective an outsourced internal audit would be fine.

With the additional perspective of using this outsourced internal audit not only because I lack the resources AND because I lack the internal audit capability myself, I think the outsourced audit is becoming the only way to go.

The company I am going to contract is mainly a training company. Having them come in and internal audit while training myself and the only other person here with the necessary competence/interest... now we're away from a bare necessity and toward an improvement.

The auditor(s) from this company are highly qualified and very professional. I was impressed with the visit they paid us a few months back when we were looking for consultation.

However, I do remember that he tried to hit me with a lot of simple things like I really needed his service. Have we done an MRB? etc, etc. How hard is it to do an MRB? Call the recycle truck and load the small quantity of junk we have laying around.

I don't know. I guess it's a matter of our compliance to the standard and their philosophy. But the concern I'm having is that if I contract this third party to come in and do our first run of internal audits, am I going to be stuck with what they want to see done here?

What questions should I ask of this potential auditor to get a good feel of what he's going to want to see?

[Marc]

Also see: Outsourcing Internal Audits - Hiring a contractor to plan and perform internal audits
and
Internal Auditing - More Overhead?
and
Outsourcing Internal Auditing - 60 Retail Stores - Effectiveness vs. Compliance

[howste]

They definitely need to be objective in their audits. I would hope they won't be looking for problems just so they can hit you up for consulting days. Keep in mind that it's your system. They have no say in how you address issues that are identified in the audit, so you won't be "stuck with what they want."

I think it's a good idea to have this be a learning experience for you. Learning principles is important, but actual practice is invaluable.

As far as questions to ask them, one of the first is to ask for references that you can call to see how they did with other companies. Another would be qualifications of the auditors. If their auditors also do certification audits, it's likely that they will bring that perspective and help you to understand what your certification audit will be like.