The Value of Outsourcing Internal Audits

Guest post by Larry Vance

As a professional auditor and consultant, I have had the opportunity to visit hundreds of different companies that have a certified Quality Management System and have opted to have their staff and employees perform the required internal audits. I have encountered internal auditors that have the proper training, knowledge, and experience and that want to complete the audits to the best of their ability and for the betterment of the company they work for. Unfortunately, I have also experienced internal auditors that, based upon their audit reports and my interviews, are only going through the motions and do not do any more than provide some evidence that they did an audit. They and their companies are really missing out on the true reason that all of the Quality Management System standards require a certified company to do internal audits.

Prior to becoming a certified auditor, I was one of several internal auditors for my previous employer.

I was sent to a “Certified Lead Auditor” course to gain knowledge of all of the ISO 9001 requirements and what was needed to satisfy the requirements of being an auditor. Once I had completed the training I was also given the responsibility of helping my company become certified to the standard.

Because we were a very large company and the Internal Audit team was made up of only 8 people there were plenty of opportunities for me to do audits. I was allowed to audit at least once per week. Unfortunately, this is not common for most of the companies I have audited since leaving my prior employer.

The vast majority of internal auditors that I have experienced may have been sent to an Internal Auditor training course that focuses on the requirements of a particular standard but are weak on the benefits of what the true purpose of internal audits is for their company. And, unfortunately, most of the auditors are not members of Top Management, which is also needed to understand the benefits of good thorough audits.

I am sure that all of the people who are appointed or volunteer to become internal auditors already have a full-time, 8 hour a day job and now they are being tasked with doing the internal audits. Even though they want to be thorough and do a good job, things begin to pile up throughout the course of the audit. Also, many of the auditors do not have any experience or knowledge of how things are supposed to be done in areas that they are not familiar. This alone prohibits them from doing a good thorough, beneficial audit. The other difficulty for internal auditors is that most of them do not get the opportunity to audit enough for them to remember from one time to the next, what are the requirements of the applicable standard, causing them to spend more time planning for the audit than actually auditing.

I am not saying any of this to be pointing fingers at anyone who is really trying to do a good job of auditing but only to say that internal audits become less effective over time and the company is not benefiting from the value that internal audits are intended to be.

While management may be concerned with the cost of hiring a professional auditor to come in and complete their internal audits, if they really considered all of the cost to the company and the value of having someone who audits all the time and has had the benefit of seeing how multiple other companies have improved their processes, they may want to reconsider.

Management should consider the cost of the initial training for their internal audits, the cost of re-training whenever the standard requirements change, the time it takes for their people to plan for and complete the audits, and what is their return on this investment. Have the audits helped the company improve the effectiveness of their Quality Management System processes?

Once all of the costs have been considered and a look is given to how the current audits have led to process improvements, I truly believe that management will find the true value and price of a professional auditor will be a comparable to the cost they are now paying and will be much more valued added than what they are currently getting.

It has been my experience that the companies that understand the true intent of being certified is to help improve the company, which will eventually have a positive impact on the bottom line. If the internal audits are not producing positive results and being used for this purpose, management is really missing the point.