For many organizations in the process of implementing an ISO 9000 or ISO 14000 management system, a significant part of the effort includes documenting systems, as well as developing or expanding upon existing systems and programs. The standards' internal audit requirements often require both development and implementation. Many organizations don't have internal audit programs before embarking on the ISO 9000 or ISO 14000 process, and others have partial programs focused on specific manufacturing or service processes.

This article explores opportunities resulting from implementing and managing an internal audit program. These opportunities relate to companies in the process of implementing systems as well as those with mature management systems and internal audit programs.

Selecting an internal audit team

Developing an appropriate strategy for internal audits is one of the most important initial exercises. Identifying who will conduct the audits, how they will be trained, and determining audit frequency are important issues that companies should consider before developing an audit strategy. The level of intensity and frequency of internal audits will help determine the audit team's size and training needs.

Highly dynamic organizations typically benefit from more frequent audits; static organizations will maintain more relaxed schedules. A company that needs more frequent audits may benefit from keeping a larger pool of trained auditors. This would minimize the total time each auditor spends on an audit and lessen the distraction to that auditor's day-to-day responsibilities.

Regardless of the auditor pool's size, having a strategy for selecting auditors will go a long way toward guaranteeing the audits' overall effectiveness and, more importantly, the management system's effectiveness and improvement. The auditors must not have responsibility within areas they are auditing. However, there is a strategic advantage to selecting auditors whose departments' processes relate to the areas they are auditing. For instance, a purchasing person could audit shipping and receiving, engineering could audit manufacturing, and manufacturing could audit quality or contract review. Auditing a closely allied department enables auditors to gain in-depth knowledge of these departments' processes, which may later contribute to refining and improving the management system.

Internal auditor training

To develop an effective audit program and to satisfy the standards' requirements, internal auditors must be trained in conducting audits. Effective auditor training is probably one of the single greatest value-added opportunities companies have with regard to their management systems. The training should be appropriate for the complexity of the areas to be audited and include training on the company's internal audit process and systems. Auditors and all employees should understand that internal audits are system audits, not people audits.

Internal audit system elements that may be included in training are specific checklists, ways to complete audit records and basic procedures that control the internal audit function. The remainder of the training should focus on audit methodologies. Several different training strategies have worked well for companies. A combination of those strategies would work for most companies.

Some companies send employees to outside internal auditor training. The benefit of this is that the training typically covers important audit methods as well as provides exercises that help hone auditor skills. The disadvantage is that the training usually is generic and may not relate well to a specific industry or company. To overcome this, some companies ask the outside trainers to tailor the program to their company and conduct it internally. The trainers can also integrate the company's audit system and specific procedures into the course.

When training larger groups, it may be more cost-effective to develop proprietary internal auditor training. To accomplish this, the company identifies a "champion" who attends formal training, using that training as a platform to develop customized training for the company, integrating systems and procedures into the course. Once a company develops its own training course, it can train as many auditors as necessary, as well as conduct the training as often as needed.

A further benefit to conducting internal auditor training within the company is the practical element. Classroom exercises can be quite beneficial but are also very academic. Newly trained auditors often stumble when it comes to conducting internal audits on their own after classroom training. When the training is performed in-house, trainees can witness the trainer conducting an actual audit, observing interviewing techniques in practice and the audit trails that are followed.

The trainer then can observe the trainees performing their first audits and review their performance. A company can even add a degree of difficulty to those training audits by coordinating with audited departments to "plant" nonconformances. This also helps take some of the fear of audits away from those departments, once again instilling the concept that systems, not people, are being audited.

Being able to train and rotate internal auditors holds additional benefits. In many companies, operators spend their careers in one type of position. Becoming an internal auditor allows an employee to play an important role in maintaining the company's management system, thus creating workplace variety and potentially increasing job satisfaction. With this in mind, some companies use their training to continually rotate internal auditors.

A tool for implementation

While internal audits provide ongoing verification of the effectiveness of a management system, they also offer an opportunity to speed up the system's initial implementation, as well as the implementation of new systems. Often, companies need to train personnel in new systems and procedures, as well as reinforce current systems that still work well. To that end, they can use the internal audit as an additional training mechanism.

Regardless of whether a company is preparing for an initial registration assessment or a surveillance audit to maintain certification, the internal audit helps ensure that the company is ready. Internal audits should not be performed against an ISO standard, but rather the management system, although mechanisms for evaluating the adequacy of a management system to meet international standards can be integrated into internal audit systems.

Leveraging second- and third-party audits

Companies may undergo both second-party audits from their customers and third-party audits from a registration agency. These audits can actually provide opportunities to improve an internal audit program. Often, the outside auditor can uncover system deficiencies that an internal audit program missed. This can help strengthen future internal audits by discovering how the internal audits missed the finding.

Most registration agencies allow their clients to have observers follow the audit. This gives internal auditors the opportunity to observe a professional auditor working through their system. The outside auditor provides an excellent example of audit performance. In addition, the registration agency's auditing documents may provide excellent examples of how to document findings.

Regardless of the thoroughness of an internal audit program, a registration agency surveillance audit always teaches valuable lessons because the auditor sees the processes objectively, noticing problem areas unseen by employees.

Second-party audits may provide an additional benefit. Registration agencies audit to determine conformance to a standard but may not offer advice on the design of the management system. Second-party audits often determine the appropriateness and effectiveness of a system from the customer's perspective. A second-party auditor may provide valuable information regarding the structure of the systems that could inevitably create improvements.

However, companies should be wary of second-party auditors with their own agenda. Managers should work with such auditors to determine that their recommendations do in fact add value. They will appreciate the attention paid to their recommendations, and working closely with them may result in mutually beneficial improvements.

Conducting internal audits

Once the trained auditors feel ready to review the management system, they should follow an initial audit schedule. It is usually beneficial to develop an intensive schedule at first, strictly to verify the system's implementation. Once the company has gained confidence in the system's implementation, it should develop a strategic schedule that provides more aggressive coverage of areas requiring the most attention. These areas can be weighted based on the results of previous audits as well as relative importance to the management system's objectives.

Many companies use tools such as audit checklists to help guide auditors through audits of specific departments. They even help establish audit trails by prompting the auditor to review related systems. Those checklists are developed with ISO requirements in mind, leaving the auditor to focus on "their system." The checklists, combined with training, help keep audits on track, as well as reinforce training concepts. These checklists often demonstrate to outside auditors exactly what internal auditors examined.

Reviewing the results

Once audits are performed, the results should be reviewed and subordinated. Some findings may require the use of the corrective action system; others may have simpler remedies. The results of the audits and corrective actions should be included in management reviews.

When evaluating internal audit results, many organizations make the mistake of stopping at management reviews. They should take the next step of comparing internal audit results with the findings of second- or third-party auditors. When outside auditors identify deficiencies not uncovered in internal audits, the internal audit process in those areas should be thoroughly investigated. Then the audit checklists should be updated to reflect those items checked by external auditors. This proves particularly valuable in areas of process control where improvements have a strong correlation to cost of quality.

Of all the elements of ISO management systems, the internal audit requires the most time and effort once a system is implemented. Making the most of internal audits will create greater employee involvement, improve job satisfaction and provide more opportunities for continuous improvement.

About the author

Dennis Abarca is a manager for ABS Quality Evaluations, the largest management system registration agency in the Americas. He gained his initial quality and environmental management system experience working for a large European-based management consulting firm.

ABS Quality Evaluations has locations across the United States and can be contacted at (281) 877-6800. E-mail Abarca at dabarca@qualitydigest.com .