Who audits the internal audit system?

[Craig B]

Hi everyone,
Please forgive me if this question is "old", but I have searched and searched and can't find an answer.
We are certified to the ISO9001:2000 standard. During the past few years, I was part of the internal audit team although not auditing areas specific to my duties as Quality Manager. Our Management Rep., who did not participate in our regular process audits, did audit our Internal Audit program only and at the end of our audit cycle. Now he is no longer employed here and I am the new Management Rep. I still perform a few audits, again not directly related to my specific duties. My question...will I be able to audit our Internal Audit program since I do participate in internal audits? If not, what are my options, as we don't want an outside auditor for this missing piece.
Thanks for any advice.
Craig

 

[RoxaneB]

How many other auditors do you have there, Craig? I'm responsible for maintaining the Business Management System (this includes the Internal Auditing portion) and am also the Management Rep. Thankfully, I have a other auditors who can audit those functions for which I am responsible.

 

[Craig B]

We have 10 internal auditors, but since they all perform internal audits (including me) who can audit our internal audit program?
Thanks

 

[db]

We have 10 internal auditors, but since they all perform internal audits (including me) who can audit our internal audit program?
Thanks

This is one of those "deep" questions auditors like to ask themselves. The standard gives us a couple of clues:

1) ...selection of auditors and conduct of audits shall ensure objectivity and impartiality...
2) Auditors shall not audit their own work

So, in your situation, can you audit without bias? If you cannot audit your own work, can someone else audit your stuff?

Also, internal audits are monitored by external auditors.

 

[RoxaneB]

This is one of those "deep" questions auditors like to ask themselves. The standard gives us a couple of clues:

1) ...selection of auditors and conduct of audits shall ensure objectivity and impartiality...
2) Auditors shall not audit their own work

So, in your situation, can you audit without bias? If you cannot audit your own work, can someone else audit your stuff?

Also, internal audits are monitored by external auditors.

This is how I look at it...

Who developed the Internal Audit Programme? Me.

Who developed the Internal Audit documentation? Me.

Who develops the Internal Audit Schedule? Me.

Who controls the Internal Audit Pool? Me.

So, any one of my Internal Auditors can audit me...the one rule is that for their sample, they can not review of their previous audits.

 

[Craig B]

Thanks for the input.
I do realize that external auditors audit our internal audits, but I know we need to do so internally as well. My take is that during the Internal Audit program review, I will review all audits outside my specific scope and have another internal auditor review any audits I have personally performed.
I hope this will fly.
Thanks again

 

[db]

This is how I look at it...

Who developed the Internal Audit Programme? Me.

Who developed the Internal Audit documentation? Me.

Who develops the Internal Audit Schedule? Me.

Who controls the Internal Audit Pool? Me.

So, any one of my Internal Auditors can audit me...the one rule is that for their sample, they can not review of their previous audits.

Who controls the internal auditors? You

Who will be able to audit you without bias? insert sound of crickets chirping

The same goes for top management. You can bet I'm willing to write a major nonconformance to the boss.

 

[Rachel]

This is what I did (and maybe I have the luxury of an exorbitant amount of internal auditors, but...)

Each area was assigned an impartial auditor(s). Some auditors did multiple audits, some didn't - we did them in teams for our first go at the 9K:2K process audit.

One internal auditor (plant manager) was purposely left out of the group. He then audited the audits upon their completion. This made sense for us, because if anyone that has to read the audit report and carefully assess the process, it's him...he's the go-to guy for manufacturing.

Hope this helps.
Cheers,
-R.

 

[RoxaneB]

Who controls the internal auditors? You

Who will be able to audit you without bias? insert sound of crickets chirping

The same goes for top management. You can bet I'm willing to write a major nonconformance to the boss.

There is always bias...but this limits it as much as possible. When I schedule my process to be audited, I select auditors with whom I don't necessarily have a "friendship" with and they aren't auditing their own work and they're deemed competent by the guidelines set out in our process...so they're able to audit me.

 

[db]

I think Roxane's and Rachel's approach is good, and fairly common. The bottom line is you want to have effective audits. If we get too wrapped up on absolute objectivity, it will not happen. Even using an outside agency, will not ensure objective audits, after all they won't want to say anything that might get them fired either.