External Auditor Observation: Insufficient internal auditors to ensure objectivity and impartiality

[Big Jim]

First of all, this is an observation. Although it is written like a nonconformance (as if it were a fact that you don't have enough internal auditors). As an observation you have no obligation to do anything but consider it. Actually, you don't even need to consider it, you can neglect doing anything with it out of hand without comment or justification.

Having said that, judging from other comments made here, you would benefit from reading ISO 9002:2016 section 9.2 where it provides insight on auditing your own work. ISO 9002:2016 provides guidance on understanding ISO 9001:2015. It is a very valuable tool.

 

[jmech]

Hi All,

Our company has had an observation
"There are insufficient trained internal auditors to ensure objectivity and impartiality of the audit process ( ISO9001:2015 Clause 9.02.2a)"

Does this mean we have to send another member of staff for internal audit training - we only have 10 employees - would it be sufficient for the current internal auditor to train up another employee.

This is not how a finding should be written - the auditor is assuming a root cause and/or fabricating a new requirement in the observation.

There is no requirement in ISO 9001:2015 to have a minimum number of trained internal auditors. The relevant requirement is
"9.2.2 The organization shall:
...
c) select auditors and conduct audits to ensure objectivity and the impartiality of the audit process;"

If the auditor has objective evidence that there is a lack of objectivity or impartiality in the audit process, he/she should provide this evidence and write the lack of objectivity/impartiality as the finding.

The auditor should not try to impose requirements (i.e. minimum number of trained internal auditors) that are not in the standard!

 

[Golfman25]

This is not how a finding should be written - the auditor is assuming a root cause and/or fabricating a new requirement in the observation.

There is no requirement in ISO 9001:2015 to have a minimum number of trained internal auditors. The relevant requirement is
"9.2.2 The organization shall:
...
c) select auditors and conduct audits to ensure objectivity and the impartiality of the audit process;"

If the auditor has objective evidence that there is a lack of objectivity or impartiality in the audit process, he/she should provide this evidence and write the lack of objectivity/impartiality as the finding.

The auditor should not try to impose requirements (i.e. minimum number of trained internal auditors) that are not in the standard!

As stated, it was an "observation" -- I suppose an OFI. I generally toss all "observations" in the trash. In this case, the auditor just seems to be giving a "heads up" that objectivity/impartiality may be an issue. Just something to keep an eye on for a small organization. If the OP decides not to train additional auditors (which he has no obligation to do), he should make sure he has a response if it ever comes up in an audit.

 

[Randy]

In this case, the auditor just seems to be giving a "heads up" that objectivity/impartiality may be an issue.

In reality it's always a potential issue in every stinking audit regardless of who, what, when & where. There is no way that anyone can be 100% that me or any other 3rd party person here can't and won't have a burr up their butt at any given time with any client. NO WAY!

 

[ChrisM]

Basically, what jmech has said above is excellent advice. I don't believe that there is any requirement for a (small) company to have any trained internal auditors, you could use a subcontract auditing service to conduct your internal audits. I have worked for a few companies with few staff where we did just this.... once a year we employed the services of an external auditor to spend a few days conducting the internal audits across the business. There were never any negative remarks about this practice in the certification audits.

 

[oonagh]

Thank you everyone.

The company has decided to train up another auditor. I personally feel it's a good idea for being impartial and it is better practice to not have only one employee knowing everything about ISO 9001 2015.

 

[Randy]

Thank you everyone.

The company has decided to train up another auditor. I personally feel it's a good idea for being impartial and it is better practice to not have only one employee knowing everything about ISO 9001 2015.

How's that going to ensure impartiality? I've been doing this ISO stuff going on nearly 30 years now and I don't know everything. A person can pick up a copy of 9001 never having seen it before and audit the stinking thing.

 

[jmech]

How's that going to ensure impartiality? I've been doing this ISO stuff going on nearly 30 years now and I don't know everything. A person can pick up a copy of 9001 never having seen it before and audit the stinking thing.

I don't think there's any way to absolutely ensure impartiality. However, it can be difficult to be impartial in auditing your own work, so ensuring that people don't audit their own work can reduce the risk of partiality. This might not always be necessary and other people can also have difficulties with impartiality, so this is not a guaranteed solution.

The company has decided to train up another auditor. I personally feel it's a good idea for being impartial and it is better practice to not have only one employee knowing everything about ISO 9001 2015.

This is probably a good decision, as long as the new person is capable and the training costs are not too high. At the very least, it will reduce external auditor doubts about auditor impartiality, and it might actually be helpful to your system to have a second set of eyes looking at it. There is also value in reducing reliance on a single person.

 

[Mike S.]

Personally, I'm more concerned with unintentional partiality than intentional. I like to have auditors from another area audit my area for the same reason I always have someone else proofread an important document (like a resume). Sometimes it's hard to see your own mistakes. I have that luxury. Whenever possible, I think it is a wise thing to do.

 

[Ed Panek]

Absolute impartiality doesn't exist. If I hire an external auditor, there is an exchange of money. A definite influencing factor. Using another internal person? They are paid by the company as well; not impartial. Money is involved everywhere and is a possible source of impartiality.

An idea might be an audit of the audit. You select smaller specific portions of the audit report with another "impartial" employee with expertise in the area being audited. They review the requirements of that part along with the evidence reviewed and are asked to make their conclusion. That is then compared to the auditor's response.

Another path is using complaint data to corroborate the internal audits. If an auditor misses a specific problem it should manifest itself in some form of complaint. Either internal NC or end user complaint.