Enough!

Too many Internal Auditors have been trained using the wrong audit model! Too many Internal Audit programs are failing because auditors were taught to emulate CB audits. Too few Organizations see any reason to do audits except to pass CB audits. Too many CB auditors (who got the same training) accept lack luster Internal Audits because they don't know any better. Time to change the focus of Internal Auditor training courses and the delivery of same! As they say, "when you only have a hammer..."

 

I so agree with you. I know the standard says to audit for compliance but this is redundant to external audits and pretty lame. It drives trivial annoyance NCs and we then completely ignore ‘auditing’ for real improvement: lessons learned, monitoring data for effectiveness of processes, et. The current method enables quality leadership to avoid leadership.

 

Change it then. You started a blog on here...why not use that as a platform to start not just advocating for change but also offering a solution or two (including not just what to do, but also how to do it)?

One of those leadership mantras is "Don't come to me with problems...bring me solutions, too." I'm sure with your experience and knowledge, you could develop a solid framework and even a prototype for delivering the necessary skills.

 

I whole-heartly agree, @John C. Abnet (odd, that).

I see the challenge being that, faced by leadership in this respect, the ISO 9001 requirements are both arcane and not an easy read to help management "connect the dots" across the requirements. Why is internal audit useful to them beyond being a) a requirement in 9.2 and b) being part of the Management Review agenda? If it's not clear to them what value the activity is (if ISO 9001 is a value, beyond getting certified), why would they take care to select the most appropriate people and ensure they got the most worthwhile training?

My belief is based in human psychology: Management won't understand the value of audits as long as audits/auditors don't do anything to bring value to management. Since when did an internal audit program ever address the key areas of performance/risk/customer perception as a PRIORITY? Slim to none! When did auditors ever sit down with management to ask "Why do you lose sleep at night?" And then audit the process(es) to reveal the reasons? Never.

Instead, internal auditors are trained to nit-pick ISO interpretations, to write corrective actions for "not following procedures" or something equally banal. This is, for the most part due to the wrong model of auditing being used.

To Roxane's point: I do know how to fix it, I have been teaching a more effective model for years, however, part of the industry awareness is recognizing there's a problem. The bar is low - "What Have I Got To Do To Be Certified". Certified organizations don't want to change. CBs don't want to change (it costs too much, it's a commodity and hey, look how many happy customers we certified). So, I figure, the way to stimulate change is to address those who oversee/govern both the auditor qualification process and also hold the auditor training and course provider accreditation requirements to help them see the need for change after 25+ years of ineffectively addressing the needs of the market...

 

Who wants to be told that their process isn't going as intended? No-one I've ever met. I cannot agree that is the purpose of Internal Audit. My understanding (after giving it too much thinking) is it should be VALIDATION (y'know, the "independent" thing) that the process ARE being implemented as planned. My analogy is like the time you (or your kid) stays at their BFF's house and the other parents say how well you (or your kid) behaves. Your parents (or you) weren't there to control the behaviors, the process was followed which was how it was always intended... (if you get my drift)

 

Advocating for Internal auditors to find things is a return to the bad old days of QC inspecting quality into the product! No wonder your internal auditors were hated! What a great story when recruiting people to participate. "You're gonna be hated for doing your job"...

 

I am a firm believer that to get the best out of Internal Audits, the people who do them should have gone through some kind of qualification process (call it training if you will) more along the lines of a Six Sigma "Green Belt". We have come to accept and utilize 6S Green Belts for a very similar outcome as (some) espouse for Internal Auditors, that of Continuous Improvement. Indeed, LEAN/6S has become a common qualification and far closer to the actual skill set required for an Internal Auditor to be effective. Instead, the auditor training industry has plowed/ploughed s furrow which has barely changed in its focus since auditor training was launched - back in the mid-late 1980s. Speaking of blogs - I wrote about the benefits of Internal Auditors receiving LEAN training in my "other" blog, here https://www.the-center.org/Blog/September-2019/How-LEAN-Are-Your-Internal-Quality-Auditors

From just the past four years working with many, many companies who implement ISO 9001, AS9100D and IATF 16949, both guiding them and training their auditors, it's clear (to me) that there's a lot of room for improvement in just the basics. CB auditors certainly don't understand or at least perpetuate ineffective internal audits. Many, many trainers never get beyond emulating those CB audits. And to get any change, there has to be an understanding of the existence of a problem...

 

I agree. Having been an internal auditor for several years in Semiconductor (9k 14k, 18k and Process Safety), a 3rd party auditor for several years for the same standards, and now a 2nd party auditor in a medical device manufacturer, I can certainly appreciate the concerns involving competencies and performance of internal auditors and the programs in which they are performing.

However, I also see management whose goals and targets include "Maintain ISO X001 certification" so what else should an audit group be expected to do in that case? This of course does not recognize whether or not the many Andy clients have a similar objective.

Having been on both sides of the line, I can appreciate it is not easy for internal auditors to perform on both sides. While employed in Semiconductor, I can vouch that Quality Management wished I would do more technically oriented process audits. And that concern was valid, but that was not the objective I had been hired for and I was not an expert in Semiconductor process engineering. Nothing stops an organization from having different internal auditors support these different needs. What stops them is shortcomings in managing and resourcing these disciplines.

What I am trying to say is: there is a place for both. An organization could have a cadre of 6S gurus and yet get their ISO certificates pulled. I have yet to see anyone deploy an internal auditor team with the extent and depth of skills described. I see internal auditors assigned as a collateral duty, or paid an Administrator's wage. Both are nearly guaranteed to return less than ideal results.

If I had another 20 or so years, I would enjoy working in a job that values expertise in both management systems and process performance. I would really enjoy being fairly compensated for that. As it is now, I would like to see it even once. Management gets what they ask for and are willing to pay for.
Just my 2 cents

 

Oh, and it occurs to me that while CBs and their auditors are allowed to provide training, that compounds the issue of all audits looking like CB audits...

 

How do you know it's a more effective model? What measures are used to demonstrate its effectiveness...and increased value to an organization?

Going to be blunt here - your "other" blog was an article posted in September 2019, correct? That's a lot of passed time between then and now. Same for your blog on here. If you want to nudge change, it can't be a "one and done" type of communication. It needs to be constant and visual and loud and engaging and tell one helluva story.

So, let's say you have some pretty impressive results in whatever measure(s) you have to show that your teaching model is more effective. Showcase them. Showcase how Company A was performing at a lower level prior to your teaching and then the results post-training (immediate change) and then the results in an ongoing manner (sustainable change). And repeat with Company B. And C. And D. And you get the idea.

People go to CBs for training because that's what they know is offered. Alternate solutions are not too often shown to them and the ROI not effectively shared. To say the bar is low is an excuse, in my opinion. It puts the blame solely with the organizations. As we've said in other posts, you don't necessarily blame top management if they don't "get" the message...you change your message (e.g., how you say it, what you say, why you say it).

 

I hear this a lot, but let's remember that CBs don't get to tell organizations how they should be qualifying their internal auditors. The standards leave the methods up to the organization, and rightly so. The CB identifies how the organization qualifies its internal auditors, and verifies that they have done so. We really are not allowed to do more. As effectiveness goes, it's a judgment call unless I find numerous major things that internal auditors ignored. What are the Internal Audit process goals and targets? Management sets them and the tone with their type and extent of support; that is the beginning of function or dysfunction.

As always, I look to the Internal Audit process owner and recall that I have 100% seen this as a collateral duty which naturally adds pressure to limit the time spent to focus on applying 6S principles and even continual improvement. I never see them use tools that would effectively help manage such an effort, and I very seldom see top management show more than a passing interest in the whole thing past maintaining the certificate.

 

If only that were true. Check out how many of them offer auditor training...

 

I think I didn't make myself clear. CB auditors don't get to tell organizations what kind of training and qualification their internal auditors should get while auditing for certification/continued certification. I actually have very few clients whose internal auditors had commercial training. Most often they got some kind of internal training. Between that and the process manager's oversight, I can say the results have too often been mediocre. I should note that as an RC auditor, many of my clients are heavily regulated chemical plants so they place a greater emphasis on their internal auditor preparation than the others. As a Supplier Quality Engineer I can offer that I have not seen any improvement over what I observed in over 250 3rd party audits over a 7-year period.

We should keep in mind that the CB internal auditor training offerings are clearly advertised to focus on helping the students support continuing certification to whatever standard. Managers and individuals pay for these courses with the clear understanding of this intent; nothing more is promised. If they also want 6S Green Belt-type training that's fine, but we should expect it to last more than a week because that's content added on to content and CBs might not reasonably be expected to offer it, however desirable it may be.

In short, I do question whether the effectiveness problem is accredited internal audit courses offered by CBs. As usual, look to management for effective process designs and outcomes.