Hi atetsade:
One important item ... who will audit the internal audit program? The outside service may have a vested interest in the audit process and therefore may not be independent. Typically I have seen clients handle this audit themselves, if they have subcontracted the internal audit process. There were comments regarding reviewing training records, include competencies as well. Assure that records are available and that the audit results are documented.
"I don't know. I guess it's a matter of our compliance to the standard and their philosophy. But the concern I'm having is that if I contract this third party to come in and do our first run of internal audits, am I going to be stuck with what they want to see done here?"
I would think that implementation issues would be addressed by your organization and the auditor evaluate whether the planned activities meet the requirements of the standard. A past registrar I worked for observed that auditors coming from 2nd party audit experience will tend to be prescriptive. Being prescriptive could be viewed as consultancy and should be avoided. If you find your auditing firm is not being objective in their auditing and reporting, discuss with the auditor, the management and if unable to resolve ... time for a new supplier.
"What questions should I ask of this potential auditor to get a good feel of what he's going to want to see?"
I would hope again here that we are talking about requirements about the standard and the various methods of implementing and complying with the requirements with compliance and within your budget. Unfortunately I have heard numerous horror stories of over zealous auditors prescribing systems that broke the organization financially and with no value-add.
I heard a quote from a GM employee regarding the value-add an auditor brings to the table ... and that is to effectively communicate where a company is not meeting requirements.
I can also send you a registrar evaluation article I wrote for the local ASQ if you like.
