NCR (minor) - Internal auditor qualification not prescribed

[MADHAVAN]

Recently in our Audit, the auditor raised a NCR(minor) "internal auditor qualification not prescribed".
in our Procedure, we had given "internal auditors are selectedbased on the experience and seniority in service and they are provided training as per ISO10011"

to my knowledge, there is no prescribed qualification except training.
please comment

 

[John C]

Madhavan,
I asked this question of our Registrar (I'm based in Ireland) just a couple of weeks ago. The answer was that there are no specific requirements but that we would be expected to have a formal training program and training records.
From my reading of contributions to these discussions the US, it seems that more and more national/local requirements for training are becoming effectively mandatory so I can't say what your situation is in practise.
rgds, John C

 

[Marc]

ISO9001 does not proscribe specific requirements, training or other, for any position in your company - the requirement is that your company do so.

Typically this is done in job requirements. Internal auditing is often overlooked in the sense that it is not 'typically' seen as a job and thus requirements for auditors is often overlooked. Internal auditing (especially in QS9000) is now being pushed hard.

I have cautioned in a number of my various posts, that Internal Auditing is now generally seen as a job and as such you have to define your requirement(s) for internal auditors.

QS9000 is taking internal auditing to a rediculous extreme - certification (the ASQC and the big3 'gang' see more $$$ IMHO). The role of internal auditing is, I believe, out of hand and out of perspective.

My personal opinion is that companies should outsource internal audits as a specialty service.

 

[Marc]

Subject: internal audit
Date: Thu, 25 Mar 1999 21:33:53 +0530
From: "Dr.MADHAVAN" <[email protected]>
To: [email protected]

what we have already done is to select internal auditors from the employees who have put in long service with the company and also who are fairly at a senior positions (say a minimum of managerial position.) we thought this was adequate .added to this, we have provided the selected people with internal audit training by an external individual Lead auditor. we thought this should take care the requirements.

is it ok?

I should think that will do. You still have to define and document your minimum requirements for that 'job'.

[This message has been edited by Marc Smith (edited 03-25-99).]

 

[Amar Seth]

Madhavan
The basic requirement for the internal auditors is that they must be trained and shall be qualified auditors. In other words it means that the auditors after the training must be evaluated and only those who pass the specified test become qualified. You are required to keep the records of qualified auditors and they may be even given a certificate of qualification.

My personal experience is that auditing is quite a skill which is acquired over a period of time and experience coupled with the aptitude for finding the facts having positive attitude. You may like to combine carrying out of internal audits using exrenal souce auditors alongwith internal resources for developing in future.

However, I am not sure on which requirements the registrar raised the NCR, as long as you have the records of trained auditors and ther being qualified.

I hope it helps.

[email protected]

 

[John C]

Madhavan,
Regards internal auditor qualification, your documented process has a dual function;
1) It must convince an observer that the internal auditor has a ‘high enough’ qualification to carry out the task.
2) It must limit the goal or scope of the audit in order to ensure that the auditor’s qualification is not overstretched.
ISO 10011 goes a long way to covering all situations so, as a blanket statement of training, you are setting a very ambitious goal. You could stand by your intention to meet the requirements of ISO 10011, but you would have to show documented evidence that you have done so. In such a situation, I would bet on your registrar to win round 2.
It would be better to consider the internal auditor resource available to you, decide what they are capable of, and write up the audit qualification and objective accordingly.
My own situation is a good example;
Some auditors are asked to carry out a simple comparison between what they see and what is written down. Others, who are qualified to do so, are also expected to evaluate the effectiveness of the activity and assess how it fits into the overall process.
rgds, John C

 

[chen]

the qualification requirements of internal auditor are defined by your company but need
to meet the minimum requirments of 4.18-training of ISO 9001.
i think the minimum requiremnets are:
1) appropriate education
2) and/or experience

we defined the qualification requirements
as working years,education background and training results(internal or external).

i think all of this are decided by yourself.

for your reference only.

have a nice day. apr.,06/1999.

 

[Marc]

Chen:

Thank you for your contribution!