The Elsmar Cove Business Standards Discussion Forums More Free Files Forum Discussion Thread Post Attachments Listing Elsmar Cove Discussion Forums Main Page
Welcome to what was The Original Cayman Cove Forums!
This thread is carried over and continued in the Current Elsmar Cove Forums

Search the Elsmar Cove!

Wooden Line
This is a "Frozen" Legacy Forum.
Most links on this page do NOT work.
Discussions since 2001 are HERE

Owl Line
The New Elsmar Cove Forums   The New Elsmar Cove Forums
  Auditing
  IIA Defines Internal Auditing

Post New Topic  Post A Reply
profile | register | preferences | faq | search

UBBFriend: Email This Page to Someone! next newest topic | next oldest topic
Author Topic:   IIA Defines Internal Auditing
Marc Smith
Cheech Wizard

Posts: 4119
From:West Chester, OH, USA
Registered:

posted 05 February 2000 06:27 PM     Click Here to See the Profile for Marc Smith   Click Here to Email Marc Smith     Edit/Delete Message   Reply w/Quote
From: ISO Standards Discussion
Date: Tue, 25 Jan 2000 08:48:18 -0600
Subject: INFO: Internal Auditing Standards /Arter

From: Dennis Arter Arter@Quality.Org

The Institute of Internal Auditors (IIA) has revised their definition of internal auditing and is in the process of changing their standards for the practice of internal auditing. (Please note that the IIA is an international professional society and has been doing this stuff since way before we in the quality profession adopted the concept. Their definition may be somewhat different than your definition.)

We can gain much by following in the footsteps of others. The draft (exposure) standards on attributes and performance of an internal audit program are quite applicable to those of us implementing a quality or environmental or safety internal auditing program. If you wish to see the document, and even comment on their content, you can find them on the IIA web site www.theiia.org under "What's New" at the top of the page.

Dennis R. Arter

IP: Logged

Marc Smith
Cheech Wizard

Posts: 4119
From:West Chester, OH, USA
Registered:

posted 05 February 2000 06:30 PM     Click Here to See the Profile for Marc Smith   Click Here to Email Marc Smith     Edit/Delete Message   Reply w/Quote
And the definition is:

"Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations.

It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes."

Bold emphasis mine. Now - what do they mean by consulting? Comments?

[This message has been edited by Marc Smith (edited 05 February 2000).]

IP: Logged

Marc Smith
Cheech Wizard

Posts: 4119
From:West Chester, OH, USA
Registered:

posted 05 February 2000 08:50 PM     Click Here to See the Profile for Marc Smith   Click Here to Email Marc Smith     Edit/Delete Message   Reply w/Quote
With respect to https://elsmar.com/ubb/Forum13/HTML/000052.html - I wonder how they're defining independence...

[This message has been edited by Marc Smith (edited 10 June 2001).]

IP: Logged

barb butrym
Forum Contributor

Posts: 637
From:South Central Massachusetts
Registered:

posted 07 February 2000 10:47 AM     Click Here to See the Profile for barb butrym   Click Here to Email barb butrym     Edit/Delete Message   Reply w/Quote
looks to me as if the IA is given the opportunity to be part of the fix......

IP: Logged

Sam
Forum Contributor

Posts: 244
From:
Registered: Sep 1999

posted 10 February 2000 03:22 PM     Click Here to See the Profile for Sam   Click Here to Email Sam     Edit/Delete Message   Reply w/Quote
How do we determine if an internal audit adds value? What measurement criteria would be used?

[This message has been edited by Sam (edited 10 February 2000).]

IP: Logged

John C
Forum Contributor

Posts: 134
From:Cork City, Ireland
Registered: Nov 98

posted 12 February 2000 07:24 AM     Click Here to See the Profile for John C   Click Here to Email John C     Edit/Delete Message   Reply w/Quote
Marc,
I have a book here, 'Flawless Consulting' by Peter Block (published by University Associates Inc, San Diego. He defines a consultant as 'a person in a position to have some influence over an individual, a group or an organisation, but who has no direct power to make changes or implement programs. He goes on to say that a manager has direct control and that the moment you take direct control, you are acting as a manager. ie (as I take it); If you were to be asked by one of your clients to tell the people what to do, rather than advise, then according to Peter Block you would no longer be a consultant but a contracted manager.
He goes on to say that most people in staff roles are really consultants. They plan, recommend, assist or advise in such matters as Personnel, Financial analysis, Auditing, Systems analysis, (and another half dozen in the list.)
Maybe the IIA are coming from the same direction. There is a whole section on Internal Consulting.
rgds, John C

IP: Logged

Marc Smith
Cheech Wizard

Posts: 4119
From:West Chester, OH, USA
Registered:

posted 12 February 2000 09:04 AM     Click Here to See the Profile for Marc Smith   Click Here to Email Marc Smith     Edit/Delete Message   Reply w/Quote
John: Haven't read the book but the concept as you present it is valid. The problem is defining who is qualified to be a consultant. Often during internal audits the guy from purchasing is auditing the gal from receiving. The question becomes is the guy from purchasing qualified to advise receiving.

One factor of consulting is that typically a company hires a consultant (internal or external) based upon some expertise in a specific field. You typically want someone with experience in a specific function / arena.

When a company hires an external consultant, I believe they typically do this believing that person or company has much more experience than they do internally (why hire an external consultant who knows less than anyone in your company?). You hire a plumer to fix your pluming - you do not hire one to learn how to plumb and then fix your sink. In fact, this is a big area of contention with consultants who profess experience yet have little or none. Without going into details, there was a somewhat recent post here which disturbed me - a consultant was asking about a subject that the person obviously, and even so stated, had no background in. Needed information in order to 'look good' at a meeting. Really made me wonder.

My position is that quite often (I would say typically) in internal auditing the auditor does not have the qualification(s) to be consulting in the arena being audited. This is not to say they are not qualified through training to perform an internal audit.

In fact, typically this is a source of hostility in companies - internal auditor from purchasing (or whatever) audits receiving (or whatever) and decides receiving's systems need improvement. Receiving gets mad because they do this every day and here comes this person from purchasing telling them how to do their job. Now receiving wants to audit purchasing as they know they can recommend a few things there. And the war is on. In my opinion the auditors, unless specifically qualified, should be restricted to verifying that folks are following their documentation.

Unfortunately, I believe the move is to evolve (increase the 'importance' of) internal audits. Are internal audits important? Yes, I believe they are very important. Should auditors be involved in 'consulting'? Only as a source of information for input to management unless the auditor is specifically qualified in the arena the auditor is auditing which is not typically the case.

Do you want an HR employee telling maintenance how to improve their systems? Do you want a fork truck driver 'consulting' in your calibration laboratory? If so why? Based upon what qualification(s)? If not, why not?

IP: Logged

isorin
unregistered
posted 18 May 2000 03:20 PM           Edit/Delete Message   Reply w/Quote
quote:
Originally posted by Marc Smith:

Do you want an HR employee telling maintenance how to improve their systems? Do you want a fork truck driver 'consulting' in your calibration laboratory? If so why? Based upon what qualification(s)? If not, why not?[/B]


An HR employee is auditing the sytem not the job done. Of course they can suggest improvements.
And please do not think that I'm flaming but even if I am a quality ass. manager I think that you are a litlle bit elitist.

I am working in litlle cie (100 employees) and if I don't use staff and floor employees for internal auditing i'll die in a week or two (burn-out).

Only my 2cents.

IP: Logged

AJPaton
Forum Contributor

Posts: 73
From:Fayetteville, NC USA
Registered: Apr 2000

posted 18 May 2000 06:13 PM     Click Here to See the Profile for AJPaton   Click Here to Email AJPaton     Edit/Delete Message   Reply w/Quote
I've done some mentoring/training of new co-workers, and have found that some of the best suggestions come from those who don't know what you're doing. The Internal Audits are supposed to make you question your system, and I don't see why you should oppose a little assistance in the matter.
The problem is what Marc touched on above. Don't take it personally, and don't let conflicts develop. If there was no better way to do your job you'd be trapped in a dead end job. There's always room for improvement, and even your HR guy could provide good input.

AJP

IP: Logged

Marc Smith
Cheech Wizard

Posts: 4119
From:West Chester, OH, USA
Registered:

posted 18 May 2000 06:15 PM     Click Here to See the Profile for Marc Smith   Click Here to Email Marc Smith     Edit/Delete Message   Reply w/Quote
Much of this is philosophical as much as realistic. You're in a small company so some people wear many hats. None the less, if you hire a person to clean the factory floor, you might want to think twice about having that person suggest 'improvements' to the design engineering folks. They may really believe that person is not qualified to make suggestions about their systems.

"...HR employee is auditing the sytem not the job done..." So - they only audit the system and not what people are doing? Please explain. I maintain internal audits are about verifying people are following the systems (procedures) applicable to their job. When you say one is not auditing "...the job done..." are you saying that in the sense of the 'quality' of how the job was done? If so, well - that's open for discussion.

"...Of course they can suggest improvements...." No problem. Let me know when you go into the hospital for surgery. I'll offer your doctor some 'suggestions for improvements' on operating procedures (systems) s/he uses on you. OK with you?

These things are done and I admit sometimes a suggestion is appropriate. However, I have seen this go to extremes where an auditor is making suggestions about a system that they have no qualifications in. The auditor calls them suggestions and the auditee calls them opinions. And the fight is on!

They can audit the systems (Are you doing what you say you are doing? Show me.) but are they qualified to comment on the system design (suggestions)?

OK - let's take an example of an engineer auditing HR. Typically an engineer has some background with HR folks. How? They may provide HR with requirements for a hire. What I am getting at here is the engineer probably has interfaced with HR from time to time which gives them an understanding of some aspects of some of HR's systems. If I was in HR, however, I might not agree with an engineer who wanted to tell me how to improve how I select suppliers. On the other hand the engineer may have some 'experience' having had to spec equipment from multiple suppliers.

A college degree can sometimes help one understand another's systems. My degree is in biology, however I had some qualifications in metology upon graduation by virtue of all the measurement and test equipment I used during chemistry class and many other classes. I may not be a metrologist, and I wouldn't want to tell a metrologist how to run his/her business, but I sure would feel qualified to audit a lab and I may also have some valid suggestions for improvement.

All this said, if your system works for you that's fine. I will never (um, well, maybe not NEVER, but you know what I mean) tell someone their system is garbage when it works for them. That does not mean it will work for every company. You obviously have not experienced Internal Auditor Hell! Be happy!!! You don't want to go there, I promise you. 'Observations' (now most often called Opportunities for Improvement) can lead to real problems. No - they don't always as your case evidences. Again I say, be happy for you are blessed! I'm pretty radical about this because I've seen Internal Auditor Hell.

I've seen many systems like yours where no problems come up. I do not hesitate to say that the majority of internal audit systems do run smoothly as yours does. But when they go bad, they seriously affect a whole company negatively. I preach methodologies I believe reduce or eliminate problems.

"...And please do not think that I'm flaming....". Well, I may be a "...litlle bit elitist..." (or a lot elitist) but your position is welcome and not taken as a 'flame'. I would rather someone speak out (and most do here - that's why I keep the forums up) than to just go away. I learn from alturnate views - we all do. Heck, Alan and I have a standing arguement - on everything. He says something and I tell him he's wrong. I say something - he tells me I'm wrong.

Welcome to the club! Register and stop by daily for 'all the action'! Always open and ready to exchange ideas! We're all personalities here! (Just ask barb...)

IP: Logged

Marc Smith
Cheech Wizard

Posts: 4119
From:West Chester, OH, USA
Registered:

posted 18 May 2000 06:21 PM     Click Here to See the Profile for Marc Smith   Click Here to Email Marc Smith     Edit/Delete Message   Reply w/Quote
quote:
Originally posted by AJPaton:

Don't take it personally, and don't let conflicts develop. If there was no better way to do your job you'd be trapped in a dead end job. There's always room for improvement, and even your HR guy could provide good input.


Bingo on two counts. Yes - don't take it personally. And - Asking questions probes. They make people think. The problematic part is writing up an 'opportunity for improvement'. Worst case is an auditor gets the GOD complex and sees opportunities for improvement everywhere.

IP: Logged

barb butrym
Forum Contributor

Posts: 637
From:South Central Massachusetts
Registered:

posted 19 May 2000 07:56 AM     Click Here to See the Profile for barb butrym   Click Here to Email barb butrym     Edit/Delete Message   Reply w/Quote
personality? isn't that what makes the world go round?

hey ...on that floor sweeper internal auditor telling Design Enineers what they are doing wrong, and making suggestions....Maybe.....Its not so much the making suggestions as it is asking a question, with genuine interest and inquisitive form, requiring evidence... that makes the design engineer look at something simple through different eyes and question his actions to initiate his own improvements as a response..instead of not seeing the forest through the trees, he now sees the leaves!!!!!!

IP: Logged

barb butrym
Forum Contributor

Posts: 637
From:South Central Massachusetts
Registered:

posted 19 May 2000 07:59 AM     Click Here to See the Profile for barb butrym   Click Here to Email barb butrym     Edit/Delete Message   Reply w/Quote
opps....once again i only read so much, entered a response and didn't see marc already said that!!!! dah

IP: Logged

Kevin Mader
Forum Wizard

Posts: 575
From:Seymour, CT USA
Registered: Nov 98

posted 19 May 2000 08:38 AM     Click Here to See the Profile for Kevin Mader   Click Here to Email Kevin Mader     Edit/Delete Message   Reply w/Quote
I forgive you Barb! In fact, I am guilty of that probably as often as you are.

Marc said: These things are done and I admit sometimes a suggestion is appropriate. However, I have seen this go to extremes where an auditor is making suggestions about a system that they have no qualifications in. The auditor calls them suggestions and the auditee calls them opinions. And the fight is on!

The auditee is probably right. No fault of either party in general either. The internal auditor (company associate) is just trying to fufill an obligation, one with which they have limited knowledge and experience. Compounding that, they may have limited knowledge about the area they are auditing. Leads to incorrect conclusions and muddled suggestions. Knowledge of auditing and the area being audited is key here. Many organizations do the best they can, given the circumstances, but forget this essential point. Can end up making things worse.

Now who has this knowledge? The outside consultant or the HR associate? I believe each has an advantage and disadvantage over the other. What is the nature of your business or the area being audited? Who would best support an audit in this area? Careful consideration and knowledge of auditor strengths and weaknesses is in order.

Additionally, the auditee may be the authority, but should not be beyond reproach. Only a fool would choose to dismiss comments made on the grounds that they already know it all! Everyone must keep in mind that this is a continuous improvement process.

Regards,

Kevin

IP: Logged

Robin
unregistered
posted 20 July 2000 11:21 AM           Edit/Delete Message   Reply w/Quote
In my company we talk about two levels of internal auditing.

Compliance auditing; Are people following the system. This is where I start new auditors. I reckon this is a fairly easy decision for an auditor, and I'm not too worried about the background of the auditor.

Effectiveness auditing; Is the system effective at helping the company achieve its goals. When I give someone one of these audits, I believe they have to have relevant background experience to judge whether or not the system will help us hit our target over the year(s) ahead. I also expect the auditors to have developed enough experience to realise they are not God. Otherwise you are right "internal auditor hell" arrives at some speed. Rather than tell people how to run their system we concentrate on the effect of the system on targets and performance standards. This usually helps them find their own solution instead of having one imposed by the auditor. The golden rule for all my auditors is let people run their own systems. If they don't want to take our advice, that is their perogative. Mind you we make sure their boss knows whats going on.

In short I think both views expressed are correct, and the emphasis is on the audit manager to pick the right auditor for the job.

IP: Logged

Marc Smith
Cheech Wizard

Posts: 4119
From:West Chester, OH, USA
Registered:

posted 18 October 2000 05:36 PM     Click Here to See the Profile for Marc Smith   Click Here to Email Marc Smith     Edit/Delete Message   Reply w/Quote
quote:
Originally posted by isorin:

An HR employee is auditing the sytem not the job done.


I don't agree that internal auditors should be auditing the system. I believe they should be restricted to auditing the job done (work instructions, procedures, etc.)

IP: Logged

Sam
Forum Contributor

Posts: 244
From:
Registered: Sep 1999

posted 19 October 2000 09:34 AM     Click Here to See the Profile for Sam   Click Here to Email Sam     Edit/Delete Message   Reply w/Quote
I have found it useful to divide auditing into three catagories and responsibilities.

1- Quality System Audits, A random sampling of the quality system. This does NOT include auditing compliance to the standard.

Resp: Internal Auditor

2- Process Audits, An audit of a specific process, i.e., machining operation, welding, plating.

Resp: Internal Auditor

3- Product Audits, A breakdown of the final product. Verify paperwork trail,inspection and test results, for each item of the product. Verify key characteristics meet dimensional requirements.

Resp: Layout Inspection

IP: Logged

Marc Smith
Cheech Wizard

Posts: 4119
From:West Chester, OH, USA
Registered:

posted 10 June 2001 07:34 AM     Click Here to See the Profile for Marc Smith   Click Here to Email Marc Smith     Edit/Delete Message   Reply w/Quote
How about:

Compliance (do we comply with the standard)
Example: Desk audit of high level systems

System (the theory)
Example: Audit of Document Control

Process (the practice)
Example: Audit of an assembly or fabrication Īstationā (note to service industries: you DO have comparable processes)

Product (the result)
Example: Dock Audit

[This message has been edited by Marc Smith (edited 10 June 2001).]

IP: Logged

Marc Smith
Cheech Wizard

Posts: 4119
From:West Chester, OH, USA
Registered:

posted 10 June 2001 07:52 AM     Click Here to See the Profile for Marc Smith   Click Here to Email Marc Smith     Edit/Delete Message   Reply w/Quote
Another thought:

Internal (First Party, Self)
This type includes audits by your company employees, consultants and contractors.

External
1. Supplier Audit
1a. Second Party
This is where a customer employee audits your company or where your employee audits a company which supplies your company.

Independent Organization
1. Third Party - Registrar
1a. A customer wants an audit of your company but wants your company to pay for it.
1b. This type of audit is described as independent, but with QS-9000 this is not really the case.

IP: Logged

energy
Forum Contributor

Posts: 228
From:New Britain, CT
Registered: Nov 2000

posted 11 June 2001 12:59 PM     Click Here to See the Profile for energy   Click Here to Email energy     Edit/Delete Message   Reply w/Quote
I may as well jump in with my two left feet. We recently had internal auditor training conducted by an experienced "instructor" through a grant funded by our State Dept of Labor. He taught our auditors to use the new standard to audit our procedures. I bit my lip during the training, but told him (privately) that I will not allow the new auditors to audit the procedures. The procedures were written and approved to comply with the standard. If that is allowed, we would be sparring over their inexperienced interpretation of the standard and we would never get around to auditing how the procedures are being followed. We are using Human Resource, Accounting, Engineering, Production Control, Designer, System Administrator(MIS),Shop, and Quality personnel(me). The consultant agreed and when we meet again, soon, we will concentrate on the procedures, not the standard. Another consultant(one we are under contract to) is reviewing and commenting on the procedures before our internal auditors see them. These are all bright people, but they lack the experience necessary to dig into the standard. This forum demonstrates differing opinions from experienced "Qualified" individuals. Our internal auditors will be allowed to report all observations and our steering committee will separate the wheat from the chaff. JMHO

energy

IP: Logged

Marc Smith
Cheech Wizard

Posts: 4119
From:West Chester, OH, USA
Registered:

posted 12 June 2001 10:03 AM     Click Here to See the Profile for Marc Smith   Click Here to Email Marc Smith     Edit/Delete Message   Reply w/Quote
I think all internal auditor courses do that - except mine, of course. Audit to the standard is their base.

You all know my feelings on 'typical' internal auditors auditing to the standard.

IP: Logged

All times are Eastern Standard Time (USA)

next newest topic | next oldest topic

Administrative Options: Close Topic | Archive/Move | Delete Topic
Post New Topic  Post A Reply Hop to:

Contact Us | The Elsmar Cove Home Page

Your Input Into These Forums Is Appreciated! Thanks!


Main Site Search
Y'All Come Back Now, Ya Hear?
Powered by FreeBSD!Made With A Mac!Powered by Apache!