Internal auditing - Company employees or contract second party

[Ursula_D]

Dear all,

we are a medium sized company and had automotive certification first time this year according to IATF 16949. Internal system audit was carried out by an external auditor. We are now considering what the best way is, doing the internal audit by our own ( we have two auditors with the required qualification ) or having the system audited by an external auditor. Kindly please share your experiences with me. Thank you.

 

[JoshuaFroud]

I cannot recommend enough conducting your own internal audits.

My reasoning behind this is, an external contract auditor will not know your processes, they will only look at that procedure or department once a year for no more than a day. Their non-conformances will be limited and any opportunities for improvement captured may not be relevant due to their distance from the process.

Conversely, your own internal staff are likely to be interacting with these processes or departments on a significantly more regular basis. This means they will understand with much more depth what they are auditing and how improvements can truly be made. I have found this has given much more value to the internal audit process rather than it being relegated to a tick box process.

Do be aware however of the time commitment needed by those two internal auditors and the relevant training they will require to audit effectively. I have seen cases where people have been selected to be internal auditors, who have then not been able to do so due to not being given time away from any other roles they fill to do so.

 

[John Broomfield]

Broadening deeper understanding of your company’s management system is never a wasted investment.

 

[AndyN]

There are pros and cons to both ways. The learning curve for internal auditors can be steep. In actual fact it's rarely the actual audits, it's the management of the internal audit process which can be a big(est) challenge. An effective external source can help do both.

The biggest stumbling block is cost. The apparent cost of bringing someone in looks higher than doing them yourselves. If you plan on doing internal audits the way IATF requires them to be done (more than once or twice a year) be prepared to get "sticker shock" if an outside source is used.

Bottom line? It's going to depend how your management view the ROI from internal audits...

 

[AndyN]

an external contract auditor will not know your processes, they will only look at that procedure or department once a year for no more than a day. Their non-conformances will be limited and any opportunities for improvement captured may not be relevant due to their distance from the process.

Not universally true, Joshua. Plus, you're assuming that the person chosen internally has a clue as well. I've seen clerks from Purchasing get the deer in the headlights when auditing Engineering...

 

[Jeff Shaw]

Using external auditors can be very helpful when known issues aren't being addressed due to management's intractability - getting a message of an issue from a credible outside party can help 'move the needle'. As a general rule though, using your own team is the way to go.

 

[northbranch]

We started using an external source to do our internal audits mostly to ensure the audits are robust. I am the only Internal auditor from our local staff so we have had personnel from other states come here in the past to conduct some here. There is the cost of flights, hotels, transportation, food, etc.. Our external source is local so we have the initial cost of the audit and then just mileage. Our company views it as a better ROI to have them performed externally.

 

[Randy]

There's no right or wrong, I've been doing the CB auditing thing for about 18 years now and I've seen some incredibly good audits done both ways and some really krappy ones as well.

The subject has been brought up and that's expense. Can you afford anywhere from $1000 - $1500 a day on average (exclusive of expenses). I've been doing a single client's internal EMS audits (as an external resource) for about 6 years now and getting $1200 a day not including expenses, so counting travel, hotels, car, meals and the such a single site audit might run upwards of $4500+ per year per location @ an average of 6 locations per year (They also use 2 other externals and we rotate among 18-20 locations in the US & Canada)...Can you afford a single location per year?

You need to do the money math as well as worry about how well the audits are done.

 

[AndyN]

Setting aside costs for just one moment...

I've seen internal audits done by some auditors (who also do audits for CBs - NOT Randy, in this case) and they look like a thinly disguised CB audit. The report was 76 pages long, and completely failed to address the 600lb gorilla in the room - which was a broken APQP process (a perennial issue in the automotive industry). The ONLY "upside" is that because the internal auditor was known to the CB's auditor (who did the client's certification audits) nothing was ever mentioned about the ineffectiveness of the internal audit program.

 

[Sidney Vianna]

The ONLY "upside" is that because the internal auditor was known to the CB's auditor (who did the client's certification audits) nothing was ever mentioned about the ineffectiveness of the internal audit program.

There is so much scratch-my-back-and-I-will-scratch-yours "funny" business in the world of contracted auditor-consultants out there. Very hard to police it, but, without a question, it represents a significant threat to the integrity and credibility of the management system certification sector. People pretend they don't see it.