Small Company - Internal audit process - Who does the audit?

#1
Hello,

I work at a small company and we have our internal audit program and we conduct our audits as per the program but I was wondering if the internal audit process needs to be audited and if so who does the audit?
 
Elsmar Forum Sponsor
#2
Hi Basically, Internal audits are conducted to check if all the program/project related documents are in place. I guess your Project manger or Product manager are most eligible to conduct internal audit within the team. Else, your organisation might have an auditor.
 

John Broomfield

Staff member
Super Moderator
#3
Yes.

A deputy could also be selected and trained to audit your organization as a system for its effectiveness.

That way the two competent internal auditors can also audit the effectiveness of the audit process by sampling the other auditor’s work.

And top management may be further assured that the audit program as well as the system is fulfilling their objectives so they know what it does well, less than well and where improvements are needed.

Of course audit is more than just looking to see if all the required documents are in place.
 

malasuerte

Involved In Discussions
#6
It's not "can"; you "shall" have Internal Audit as a process that needs to be audited.

Couple of adds: the auditor needs to be 'qualified' to perform the audit, and they have to be independent of the program. A couple of ideas - do you have a financial or risk and controls auditor that could perform the audit? You could hire a consultant as well.
 

Randy

Super Moderator
#7
It's not "can"; you "shall" have Internal Audit as a process that needs to be audited.

Couple of adds: the auditor needs to be 'qualified' to perform the audit, and they have to be independent of the program. A couple of ideas - do you have a financial or risk and controls auditor that could perform the audit? You could hire a consultant as well.
Nope, the auditor doesn't need to be qualified, the auditor must be Competent. I'm a qualified A&P Mechanic but I'm no longer competent do do so unsupervised..........Qualified and Competent are 2 different animals.
 

malasuerte

Involved In Discussions
#8
Nope, the auditor doesn't need to be qualified, the auditor must be Competent. I'm a qualified A&P Mechanic but I'm no longer competent do do so unsupervised..........Qualified and Competent are 2 different animals.
Ok...twist words! You clearly don't get what I was saying nor the intent of the clause! You can't be competent if you are not trained and qualified! The auditors are required to be trained and qualified!

Competence is then determined after that. And yes, if you lose that competence for some reason, you cannot audit! But you are not competent without being trained and qualified!

The organization shall have a documented process(es) to verify that internal auditors are competent, taking into account any customer-specific requirements. For additional guidance on auditor competencies, refer to ISO 190011. The organization shall maintain a list of qualified internal auditors.

...
Where training is provided to achieve competency, DOCUMENTED INFORMATION shall be retained to demonstrate the trainer's competency with the above requirements. Maintenance of and improvement in internal auditor competence shall be demonstrated through:f) executing a minimum number of audits per year, as defined by the organization; andg) maintaining knowledge of relevant requirements based on internal changes (e.g. process technology, product technology) and external changes (e.g. ISO 9001, IATF 16949, core tools, and customer specific requirements).
 

Randy

Super Moderator
#9
Ok...twist words! You clearly don't get what I was saying nor the intent of the clause! You can't be competent if you are not trained and qualified! The auditors are required to be trained and qualified!

Competence is then determined after that. And yes, if you lose that competence for some reason, you cannot audit! But you are not competent without being trained and qualified!

The organization shall have a documented process(es) to verify that internal auditors are competent, taking into account any customer-specific requirements. For additional guidance on auditor competencies, refer to ISO 190011. The organization shall maintain a list of qualified internal auditors.

...
Where training is provided to achieve competency, DOCUMENTED INFORMATION shall be retained to demonstrate the trainer's competency with the above requirements. Maintenance of and improvement in internal auditor competence shall be demonstrated through:f) executing a minimum number of audits per year, as defined by the organization; andg) maintaining knowledge of relevant requirements based on internal changes (e.g. process technology, product technology) and external changes (e.g. ISO 9001, IATF 16949, core tools, and customer specific requirements).
I've seen very good audits conducted by professionals that had no documented auditing training, well thought out, well planned, well delivered. Competence is nothing more than "demonstrated ability to apply knowledge and skill"

With 19011:2018 you're quoting a "Guidance" document which in not mandatory it's strictly "Guidance" and the piece "Where training is provided to achieve competency," indicates that training isn't required , also competency, the fulfillment of it and performance is solely the property of the organization...It's their business what makes them happy not yours or mine. From the 3rd Party CB perspective (which is all I do 100+ days a year) I can only say the process isn't good if I determine that it's not being effectively performed and not meeting the basic requirements of the MS in question and whatever their audit process/procedure/protocol is....

Oh yeah, don't be putting and "Shall's" in 19011, there are only "4" and they're all in the Forward.
 
Last edited:

malasuerte

Involved In Discussions
#10
I've seen very good audits conducted by professionals that had no documented auditing training, well thought out, well planned, well delivered. Competence is nothing more than "demonstrated ability to apply knowledge and skill"

With 19011:2018 you're quoting a "Guidance" document which in not mandatory it's strictly "Guidance" and the piece "Where training is provided to achieve competency," indicates that training isn't required , also competency, the fulfillment of it and performance is solely the property of the organization...It's their business what makes them happy not yours or mine. From the 3rd Party CB perspective (which is all I do 100+ days a year) I can only say the process isn't good if I determine that it's not being effectively performed and not meeting the basic requirements of the MS in question and whatever their audit process/procedure/protocol is....

Oh yeah, don't be putting and "Shall's" in 19011, there are only "4" and they're all in the Forward.

Your argument was auditors do not need to be qualified. (scroll up). The standard states: The organization shall maintain a list of qualified internal auditors.

However, you choose to define that is your business. For my business, it requires extensive training to be deemed qualified and competent.

We can't all be perfect like you! So let's just end this - You are right and everyone else is wrong!!! Is that better for your ego?
 
Thread starter Similar threads Forum Replies Date
P ISO 9001 Internal audit rotation in a small company Internal Auditing 7
O Internal Auditing in small Engineering company ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 6
N Internal Audit Process for small Medical Device company Internal Auditing 9
C Internal Auditor Qualifications? Small Company ISO 13485:2016 - Medical Device Quality Management Systems 1
J A Lone Internal Auditor in a Small Company? Internal Auditing 30
T Internal Use of FMEA in a small company - Valuable or not? FMEA and Control Plans 9
C Internal Audits in a Small Company Internal Auditing 20
D A VERY Small Company - Internal Audit Internal Auditing 62
T ISO 13485 - 5.5.1 Responsibility and authority - Small Company Independence ISO 13485:2016 - Medical Device Quality Management Systems 13
M Customers Request AS9100 certification - Small Company (less than 20 employees) AS9100, IAQG 9100, Nadcap and related Aerospace Standards and Requirements 8
T EQMS for small medical device company ISO 13485:2016 - Medical Device Quality Management Systems 15
E Sharepoint for ISO 13485 QMS for small IVD company ISO 13485:2016 - Medical Device Quality Management Systems 7
E In need of a new TGA sponsor - Small software company Other Medical Device Regulations World-Wide 4
R Inventory management for a small startup device company Other Medical Device Related Standards 1
R ISO 13485 and QMS related concepts Training - Small medical device startup company ISO 13485:2016 - Medical Device Quality Management Systems 9
Ed Panek Small Medical Device company - Bring production in-house ISO 13485:2016 - Medical Device Quality Management Systems 1
M AS9100 - Where to start - Small company (10 employees) and I am the Quality Dept. AS9100, IAQG 9100, Nadcap and related Aerospace Standards and Requirements 45
J Requirements for Work Transfer of Small Company AS9100, IAQG 9100, Nadcap and related Aerospace Standards and Requirements 4
P QMS software recommendations for a small ISO 13485 company Quality Manager and Management Related Issues 5
S Quality Plan at a small Medical Device Company - Is the quality plan a DMR document ISO 13485:2016 - Medical Device Quality Management Systems 3
G Setting Up a Basic Quality Lab for a small manufacturing company General Measurement Device and Calibration Topics 2
E Defined Roles in Small Company ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 12
H How to Establish and Document Competence of Employees in a Small Company ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 13
P Small company of approx 28 Employees - ISO-9001:2008 Guidelines ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 7
D Looking for Calibration Software for small company General Measurement Device and Calibration Topics 20
5 Advice for a new EMS at a small, office-based company ISO 14001:2015 Specific Discussions 3
L Implementing ISO 9001 in small Trading Company ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 8
A FDA 510(k) Payment requirements for a Small Company US Food and Drug Administration (FDA) 3
P Audit Man Day Requirements - Small AS9100 Company hiring New Employees AS9100, IAQG 9100, Nadcap and related Aerospace Standards and Requirements 18
T Quality Department Structure in a Small Medical Device Company Quality Manager and Management Related Issues 4
D QMS Software Recommendations for a Small Company ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 12
S Is 7.3 Design and development needed in a Small Engineering Company? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 2
V ISO 9001 Clause 5.6.2(f) Management Review Input in a Small Company Management Review Meetings and related Processes 7
C Very Small OTC (Over The Counter) Pharmaceutical Company Requirements US Food and Drug Administration (FDA) 6
K Small Company Compliance with TS 16949 Clause 6.2.2.3 - Training on the Job IATF 16949 - Automotive Quality Systems Standard 9
C Implementing ISO 9001:2008 in a small Sales and Service company ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 38
P Typical Number of NCRs for a Small Manufacturing Company ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 4
B ISO 9001 for a small Micro Software Company Software Quality Assurance 18
T How to move from a small company to a large company Career and Occupation Discussions 7
S Implementing ISO 9001 for a small fabrication company ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 4
P Deviating from AQL in a small Retail Apparel Company AQL - Acceptable Quality Level 5
M Cheap/Free CAPA Software for small Pharmaceutical company Quality Assurance and Compliance Software Tools and Solutions 8
T Initiating Cultural Change in a Small Manufacturing Company Quality Manager and Management Related Issues 4
D Small Company wanting to avoid certain 21 CFR 11 Requirements US Food and Drug Administration (FDA) 8
J Small Company with an established Secretary/Admin person with "Personal" procedures Quality Manager and Management Related Issues 8
S Fast growing small O&G Company QMS implementation - My path forward ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 4
D FDA Compliant QMS Software Recommendation for Small Company Quality Assurance and Compliance Software Tools and Solutions 3
A Small Company with ISO 14001 Environmental Targets Questions ISO 14001:2015 Specific Discussions 3
A How Big/How Small - Size limitation on a company being ISO 9001 certified? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 30
M Recommend Registrar for a Small Company - ISO13485 Registrars and Notified Bodies 15
Similar threads


















































Top Bottom