Internal Auditor Training

This record trains and assesses the person who will audit, not the audit and not the programme. Its most common misuse is being treated as the whole of auditor competence, when ISO 19011 treats the initial course as one input among several.

The management system standards say very little about how to audit and a great deal about who may. They require competent auditors and an impartial process, then point at ISO 19011 for the method, which is why the guidance standard has the practical force of a requirement.

Internal audit is a management system and contractual duty rather than a statutory one in most places. The consequence is that the pressure comes from certification bodies and customers, and the legal exposure comes from what a weak internal audit report says afterwards about what the organisation knew.

A pass on this record is easy to produce and easy to see through. What separates a trained auditor from a certificate holder is decided by four choices made when the course is designed, not when the form is completed.

The findings raised against auditor training are almost never about the course. They are about what the audit programme produced afterwards, which is the only evidence that the training worked.

A mid-sized manufacturer ran a complete internal audit schedule for three years. Every process was covered annually, every report was on file, and the audit summary to management review reported conformance above ninety-five percent throughout, with the few findings raised concerning labelling of storage areas and a fire door propped open. Management review noted the system as effective and moved on.

The certification body's recertification audit raised fourteen nonconformities including two majors: calibration records with no traceability for a critical instrument, and a change to a process that had never been through management of change. Both had been in place for over two years, in areas the internal programme had audited twice. The audit reports for those areas existed, listed the procedures as present and the records as available, and raised nothing.

The pattern was visible once anyone looked at who audited what. The production manager audited production. The quality manager audited the quality system, including the calibration procedure she owned. Every finding in three years came from a corridor, a store or a shared area that belonged to nobody. The auditor training behind it had been a two-hour briefing on the clause structure of the standard and a multiple-choice quiz, with no witnessed audit and nothing on evidence. The rebuilt course was two days on principles, evidence and finding-writing, with a witnessed audit in an unfamiliar area as the pass gate. The next internal cycle raised thirty-one findings, which management review correctly read as the programme starting to work.

The course is two days. What fails is the programme around it: the assignment that put an auditor back in their own department, the auditor who has not audited since, and the finding closed on a tidy-up.

KnowTrain

Holds each auditor's training, witnessed audit result and validity date, and surfaces auditors whose competence is due for revalidation before the programme assigns them.

KnowComply

Runs the audit schedule against the trained auditor pool, blocks an assignment that would put an auditor in their own area, and tracks findings per audit as a programme metric.

KnowQuality

Takes each finding into the nonconformance and corrective action route with the process owner, so cause and action sit with the owner rather than the auditor.

Ella

Watches audit yield, overdue findings and auditors who have not audited in months, and raises the retraining or reassignment instead of waiting for the programme review.

Audit criteria

The set of requirements used as the reference against which evidence is compared: policies, procedures, standard clauses, legal duties, customer specifications.

Audit evidence

Records, statements of fact and other verifiable information relevant to the criteria; an impression that cannot be verified is not evidence.

Finding

The result of evaluating evidence against the criteria, expressed as conformity or nonconformity, and stated with the criterion and the evidence attached.

Nonconformity grading

The split between major and minor, where a major typically indicates a systemic failure or absence of a required control and a minor a lapse within a working system.

Impartiality

The absence of a stake in the outcome, achieved by not auditing your own work; a property of the assignment rather than of the auditor's intentions.

Sampling

The selection of a subset of records or activities to examine, chosen so that the finding drawn from it is defensible and stated with what was sampled.

Witnessed audit

An audit conducted by the trainee while an assessor observes and grades performance; ISO 19011 lists it among the methods for evaluating auditor competence.

Audit trail

The thread followed from a single record outwards through the process that produced it, which is how auditing practice differs from checking documents.