Articles

Internal Auditor Competencies

In this the fourth of a series of articles, we turn our attention to the actual people who might be selected to perform internal audits of an organization's quality system.

Traditionally, auditor candidates have been selected based on a variety of criteria and sent to training of one kind or another, in the hope that they will be effective auditors. However, without careful planning and a clear set of criteria being drawn up by an Audit Program Manager, are the traditional methods by which auditors are selected and then trained really sufficient to ensure audit program effectiveness and auditor competency?

Who you gonna call?

First, let's take a look at the selection criteria for auditors. It's common practice to seek volunteers to be internal auditors, and from those volunteers people are often chosen because they work in a department different than the one whose processes are to be audited - for the sake of 'independence'. Criteria like this are not in and of themselves 'poor', but they do need to be supplemented with others to ensure the audit program has a fighting chance of being effective and gaining management support.

Indeed, sending an auditor off to evaluate the implementation of a process they are unfamiliar with may appear to be useful, but in most cases the result is a less than effective audit. Simply put, the auditor may spend more time 'learning' the process than they do actually evaluating whether the process is working effectively! Not only will the auditor be at a disadvantage - learning new technologies, terminologies, tools, etc., but the 'auditee'(s) can feel a sense of frustration at having to explain to the auditor what are simple and fundamental concepts and practices.

A parallel can be drawn from what an accredited Certification Body does in selecting its auditors; each Certification Body auditor is qualified by 'EA' and/or 'NACE' coding. That means clients who are seeking registration of their quality management system to ISO 9001, ISO 13485, ISO 22000 etc. can expect their CB auditors to have specific industry-related experience, qualifications and - in some cases - training. Furthermore, those Certification Bodies which subscribe to industry specific registration programs such as ISO/TS 16949 and AS 9100 are required to follow rigorous auditor qualification and re-qualification requirements to maintain the competencies of their auditors. Strangely, this 'model' for qualification of auditors is often missed when internal audit programs are established!

In searching for assistance with these fundamental internal auditor selection and qualification criteria, one of the best places any internal audit manager can turn is to ISO 19011 - the International Standard "Guidelines for Quality and Environmental Systems Auditing". In section 7, "Competence and evaluation of auditors" it states:
"Confidence and reliance in the audit process depends on the competence of those conducting the audit. This competence is based on the demonstration of
a) the personal attributes outlined in 7.2; and
b) the ability to apply the knowledge and skills described in 7.3 gained through the education, work experience, auditor training, and audit experience described in 7.4."

Those key personal attributes from point a) (highlighted) are often overlooked prior to sending an auditor candidate off to a training course. Before embarking on any training intervention, it would be prudent for an Audit Program Manager to consider their auditor candidates against the following expanded criteria from ISO 19011:
"An auditor should be:
a) ethical, i.e. fair, truthful, sincere, honest and discreet;
b) open minded, i.e. willing to consider alternative ideas or points of view;
c) diplomatic, i.e. tactful in dealing with people;
d) observant, i.e. actively aware of physical surroundings and activities;
e) perceptive, i.e. instinctively aware of and able to understand situations;
f) versatile, i.e. adjusts readily to different situations;
g) tenacious, i.e. persistent, focused on achieving objectives;
h) decisive, i.e. reaches timely conclusions based on logical reasoning and analysis; and
i) self-reliant, i.e. acts and functions independently while interacting effectively with others."

Further guidance from ISO 19011 states:
"Auditors should have knowledge and skills in the following areas:
Audit principles, procedures and techniques: to enable the auditor to apply those appropriate to different audits and ensure that audits are conducted in a consistent and systematic manner. An auditor should be able
a) to apply audit principles, procedures and techniques,
b) to plan and organize the work effectively,
c) to conduct the audit within the agreed time schedule,
d) to prioritize and focus on matters of significance,
e) to collect information through effective interviewing, listening, observing and reviewing documents, records and data,
f) to understand the appropriateness and consequences of using sampling techniques for auditing,
g) to verify the accuracy of collected information,
h) to confirm the sufficiency and appropriateness of audit evidence to support audit findings and conclusions,
i) to assess those factors that can affect the reliability of the audit findings and conclusions,
j) to use work documents to record audit activities,
k) to prepare audit reports,
l) to maintain the confidentiality and security of information, and
m) to communicate effectively, either through personal linguistic skills or through an interpreter."

Many of the above listed attributes can be developed and the auditor's abilities evaluated in a recognized training course; however, there are some additional basic competencies often overlooked, which can have an influence, irrespective of whether an auditor candidate attends a training course. These can include:

• Written skills - specifically note taking, report writing, grammar, spelling, etc.
• Interpersonal skills - social skills, 'soft' skills, cooperative, etc.
• Interviewing skills - empathetic, listening, cultural/personal 'awareness', etc.
• Organizational skills - planning, preparation, time management, methodical, and analytical thinking, etc.

Taking a complete inventory of these skills and abilities, an Internal Audit Manager can quickly come to the realization that there's a lot more to ensuring a competent auditor than simply sending them to a training course of two, three or even five days duration.

As with any work assignment, people have varying degrees of abilities and to enjoy an effective, efficient audit program, the internal auditors must be given the support, coaching and mentoring over and above any training to ensure the development of a well rounded set of skills and competencies. Without these it is unlikely that the internal audit program will deliver the type of audit results that management desires.

The next NQA, USA newsletter article will take a look at some aspects of internal audit processes and activities with a view to ensuring effectiveness.