External Auditor Observation: Insufficient internal auditors to ensure objectivity and impartiality

oonagh

Starting to get Involved
Hi All,

Our company has had an observation
"There are insufficient trained internal auditors to ensure objectivity and impartiality of the audit process ( ISO9001:2015 Clause 9.02.2a)"

Does this mean we have to send another member of staff for internal audit training - we only have 10 employees - would it be sufficient for the current internal auditor to train up another employee.
 

geoffairey

Involved In Discussions
In a 10 person company having 2 trained internal auditors seems overkill, technically this is probably correct but seems harsh in such a small company

i assume the trained internal auditor is auditing their own processes.

you could contract with an external company to internally audit your own area (I know this sounds strange but it’s entirely allowed). This would save you training someone else, limiting it to one person’s tasks would minimise costs and satisfy the requirement
 

oonagh

Starting to get Involved
In a 10 person company having 2 trained internal auditors seems overkill, technically this is probably correct but seems harsh in such a small company

i assume the trained internal auditor is auditing their own processes.

you could contract with an external company to internally audit your own area (I know this sounds strange but it’s entirely allowed). This would save you training someone else, limiting it to one person’s tasks would minimise costs and satisfy the requirement
Thank you Geoffairey.
 

Randy

Super Moderator
Alrighty, here's the deal, unless the auditor can show through objective evidence that objectivity/impartiality has been broken....the key is "objective evidence" it matters not one friggin bit how he "feels". Basically he's assuming that what your doing is not a trustworthy process and the persons involved could potentially be dishonest liers, cheats and hucksters...........Ask him to prove his objectivity/impartiality to help stop the egg sucking.

I audit, and it has a valid/accredited certificate, a one man company who audits himself........No question about objectivity/impartiality because he's more than once said "oops, gotta correct that".

There is absolutely, positively and totally no way to 100% guarantee objectivity/impartiality.....Nope, ain't gonna happen!
 

Golfman25

Trusted Information Resource
Watch out for the lazy auditor. As Randy said, does the guy have any evidence that your auditor isn't objective? Or is he just guessing? The lazy auditor wants to see a list of auditors so there is no possible overlap -- easy for him. Only 1 or 2 auditors will require him to look harder and verify objectivity.

We have a small company (25 employee) and we have 3 internal auditors. Auditor 1 audits a few areas, including auditor 2's area. Auditor 2 audits a few areas, including Auditor 1's area. Auditor 3 focuses on dock audits and mfg. audits. The only issue we have is they repeat the areas they audit each year and it becomes rather boring.
 

AllTheThings

Involved In Discussions
I've gone through multiple rounds of ISO-17025 assessor training. 17025 takes 9001 and adds additional requirements for test and cal labs. Like 13485 or AS9100, it is not trivial.

Most experienced assessors have worked with single-person ISO-17025 labs. Yes, a 1-person company+QMS. There is a 17025-specific clause related to resolution of customer complaints that demands a second person for a single review function, to ensure impartiality. Most people will have a friend/lawyer/accountant/spouse/industry peer do that function for the limited cases where required. But that clause does not appear in 9001.

No where in 9001 does it say you have to have two auditors...No where in the more complex 17025 standard does it say you have to have two auditors. You can audit yourself in theory.

The only point that your auditor might have is with respect to risk. Having a single auditor (or single person company) has risk. Most single-person entities mitigate this risk through explicit QMS policies, or sometimes by hiring external auditors. Maybe your auditor just took a clumsy approach to suggesting that you acknowledge the risk in your QMS or regular risk assessments? I will give them the benefit of the doubt. They did write it up as an observation, not a finding...So I would acknowledge it, and maybe make minor adjustments to demonstrate that you are aware of the risk. But bringing up and training a second auditor? Probably not.
 

Kronos147

Trusted Information Resource
No where in 9001 does it say you have to have two auditors...
The standard says "The organization shall select auditors... to ensure... impartiality..."

If there are 10 people in the company, and 2 are in Quality, and they are both the internal auditors, it is a good observation. Who audits Quality?
 
Top Bottom