AS9120 9.2.2 Objectivity? Dispute

[NatalieP]

A company I know received a nonconformance on 9.2.2.
The auditor stated you cannot have the same internal auditor perform all your internal audits.
Company has had the same internal auditor for 2019 & 2020.
The company's own internal audit paperwork is used and they create the audit schedule to ensure objectivity and impartiality.
In my opinion the NC is bogus and based on the opinion of the auditor and not the requirement due to the following:

-The internal auditor is outsourced externally.
-The internal audit is conducted using the company's own internal audit paperwork identifying the clauses to be audited.
-The internal auditors position is to make sure the company meets the requirements of a-f of 9.2.2
-The internal auditor does not have the responsibility of any of the requirements in a - f of 9.2.2 therefore they did not audit their own work.
-The internal auditor does not own or manage the internal audit process. She is only executing it as defined by the company she is doing the audit for. She is not auditing her own work. If this NC were in fact true, none could only have a single internal auditor and that means thousands of companies would be nonconforming.
Nowhere in the standard does it say you must have more than one auditor.

The below is what is actually written on the NCR.

Applicable 9100/9110/9120 requirement/clause: 9.2.2
Process/Area/Department Internal Audits
Classification (Ma/Mi): Mi
Statement of Nonconformity: The selection of auditors and conduct of audits to ensure objectivity and impartiality of the audit process is not always effective.
Objective Evidence: The Internal Audit Schedule Rev. F dated 04-01-18 for 2019 only has one auditor assigned to perform all of the internal audits.

The auditor stated that you have to have someone else that audits the internal auditors work. Wouldn't this be the external auditor if this is the case?
All previous external audits have not mentioned any issue with this.

Thank you in advance for your comments.

 

[blackholequasar]

I agree with you - this is bogus. I'd ask them to show examples how the process is not always effective. This person that is brought in to audit is objective as they are not directly involved or responsible for the processes they are auditing. I've never heard of needing more than ONE auditor... I'd like to see where they can prove that's the case because I think that they'll fail to show it in the standard.

 

[Sidney Vianna]

Thank you in advance for your comments.

This issue has been discussed numerous times here at The Cove, in terms of ISO 9001 and other standards. Look, for example @ Auditing Our Outsourced 2nd-3rd Party Internal Audit Company and my post #6.

 

[Jim Wynne]

This is definitely wrong. Push back.

 

[Baker47]

I would accept that as an OFI to avoid affecting the "impartiality" of the audit, which is a valid point. Not a nonconformity.

 

[Mike S.]

As Sydney said, search is your friend -- this issue has been discussed many times here.

This is a nonconformance that is written by many registrar auditors. I'm not saying it is right, but that is many auditors' interpretation.

 

[Jim Wynne]

The thread that Sidney (not Sydney) linked to doesn't seem relevant here. The OP here isn't concerned about their contracted internal auditor auditing himself; the concern is that his CB auditor wrote an NC for their contracted internal auditor not being adequately impartial.

 

[Jim Wynne]

I would accept that as an OFI to avoid affecting the "impartiality" of the audit, which is a valid point. Not a nonconformity.

Where is the impartiality?

 

[Sidney Vianna]

The thread that Sidney (not Sydney) linked to doesn't seem relevant here. The OP here isn't concerned about their contracted internal auditor auditing himself; the concern is that his CB auditor wrote an NC for their contracted internal auditor not being adequately impartial.

The issue of internal auditor impartiality and the "need" for a minimum of 2 internal auditors is simply because some CB auditors think that a second internal auditor is necessary to audit the job of the other auditor. As I mentioned, nobody really "audits" another internal auditor but, and instead, someone checks to see if the internal auditor performed audits, as scheduled, generated records and reported results, as expected. To that end, you don't need to be an "auditor".

 

[Mike S.]

The thread that Sidney (not Sydney) linked to doesn't seem relevant here. The OP here isn't concerned about their contracted internal auditor auditing himself; the concern is that his CB auditor wrote an NC for their contracted internal auditor not being adequately impartial.

My apologies to Sidney for misspelling his name.

Jim, if your comment regarding relevance is directed to me, for the record, I never weighed-in on the relevance or lack thereof of the particular thread Sidney linked.

Moving on, ISO 9002 states: "In some cases, specifically in smaller organizations or areas of the organization where specific job knowledge is required, it can be necessary for a person to audit their own work. In this situation, the organization might have the internal auditor work with a peer, or have the results reviewed by a peer or a manager, to ensure results are impartial. The organization could also consider obtaining resources from an external provider such as a university, external auditor, or another organization."