Internal Auditing To ISO 9001

Internal Auditing to ISO 9001

Internal auditing to ISO 9001 is a high-value skill that current and prospective employers look for in employees. Even those companies that are not certified to ISO 9001 or another quality management system standard recognize the value of the knowledge a person has when they understand the importance of the process approach to managing for superior results.

The guidelines for auditing to ISO 9001 are covered in ISO 19011:2002 or the U.S. version QE 19011s:2004 - Guidelines for quality and/or environmental management systems with supplemental guidance for small business. As you probably noticed this guideline also covers auditing to the environmental standard ISO 14001.

If you are performing conformity assessments and certification audits you must also comply with ISO/IEC 17021:2005. This document is for organizations that used to be called "Registrars" and are now referred to Certification Bodies or CBs for short. CBs are audited to make certain they are following the auditing requirements and their auditors are competent. These type of audits are called "witness audits".

There are two (2) basic categories of audits:

1. External, and
2. Internal.

External audits are divided into two sub-categories:

1. Second (2nd) party, and
2. Third (3rd) party.

Second party audits are where a supplier is audited by their customer.

A third party audit is where an independent organization performs the audit. For example, a certification audit is a third party audit because neither the customer nor supplier are performing the audit.

There are three (3) parties to every audit:

   1. Client - The organization or person that has the authority to
       order the audit to be conducted
   2. Auditee - The organization to be audited
   3. Auditor - The person(s) performing the audit.

In addition, there should be guides/escorts provided for external auditors. The guides or escorts must be knowledgeable of the complete system. They will provide the auditor with the requested documents and records, acquaint the auditor with the company's rules regarding safety requirements and other general rules. They should accompany the auditor during the auditor's movements throughout the company and make the introductions to the employees the auditor wants to interview.

Internal Audits

Our discussion will focus on the most common type of audit the internal audit. The internal audit is conducted by employees of the auditee. The auditee is also the client in first party audits. Some organizations have found it to be beneficial, from a cost, time and results standpoint, to sub-contract their internal auditing to consulting and auditing companies. By sub-contracting the audit function to an outside contractor the company gets to see their operations through a fresh pair of eyes. Sub-contracting the auditing to ISO 9001 is permissible under the guidelines and the audits are still considered to be internal.

Auditor Qualifications

What qualifications are needed for auditing to ISO 9001? That depends on the requirements set by the organization with guidance from their CB, if the organization is certified to ISO 9001. The CB auditor's responsibility is determine if the internal auditors are competent by auditing the results of the internal audit program. They can't demand or require any specific qualifications for internal auditors other than they are able to effectively conduct the audits as described in the organization's audit program.

Although there are training companies that offer a course to "certify" internal auditors for auditing to ISO 9001, there are no ISO requirements or provisions for this certification. It's not necessary and often a waste of money as these classes are generally very expense. It's recommended that one or two people in the company take a Lead Auditor course and pass the associated exam. Although the cost is slightly more for the Lead Auditor course and exam, it is well worth it. Then the company's lead auditors can train and qualify their internal auditors.

Most online internal auditor courses are sufficient to learn the fundamentals of auditing. The online learning needs only to be supplemented with practical experience by working with accomplished auditors in their company.

In the U.S., an organization called RABQSA has issued guidelines for auditor courses. This includes lead and internal auditor courses. Therefore, any auditing to ISO 9001 course needs to conform to these guidelines.

What should an auditing course include?

An auditing to ISO 9001 course should include the following content and structure:

    * An Introduction to Internal Auditing
    * A complete review of ISO 19011:2002 or QE 19011s:2004
    * Auditing for Improvement
    * Purposes for internal audits
    * Benefits of internal audits
    * The audit cycle
    * Keywords and definitions
    * A complete review of ISO 9001
    * Audit planning and preparation (scope, purpose, depth, duration)
    * Audit meetings
    * Audit documents
    * Auditor responsibilities
    * Auditor attributes and skills
    * Communication do's and don'ts
    * Interviewing skills and the type of questions to ask and not to
       ask
    * Documenting the audit findings
    * Reporting the audit results
    * Corrective action and follow-up.
    * Workshops and/or case studies

If the course is to conducted by an external party or training company the instructor(s) should be certified as an ISO 9001 auditor or lead auditor. This is not required if the company uses their own employees to train other auditors. However, it is recommended.
Online Training

I found a company that has, in-plant training and online auditing to ISO 9001 courses. I really like the online course. They call their online classes "E-classes".

You enroll online. You download the course workbook. It's yours to keep. They even let you print it out and that is rare these days. You can take a copy with you while you are auditing or anyplace where you can't get at your computer files.

The exams are also downloaded. You complete the exam, send it back by email. They score it and comment if necessary, and email back to you. Again, it's yours to keep for reference.

When you successfully complete the course you get a "real" parchment certificate by snail mail. You get 3 months to finish the class. You can even retake an exam one time for a small charge.

Here's the kicker to this E-class: You can have up to 1 hour of free personal coaching by phone or email from a certified lead auditor while you're taking the course. So, if you have questions about something in the workbook, exam, or an actual audit situation, they will help you. Who does something like that anymore!!

Click on the link below to get more information on the classes they have available.

Online Training for ISO 9001, 14001 and Six Sigma.