How to Improve Internal Auditor Training

What are the problems and what can be done about them?

September/October 2005

Authored by Willibert Fabritius, CQA, CQM, Lead Auditor (USA) 847-562-9888, Ext. 24

Internal auditing is a requirement of modern management system standards. The quality

management system standards ISO 9001 and ISO/TS 16949 require in section 8.2.2 that,
"The organization shall conduct internal audits at planned intervals..." ISO/TS 16949
goes a step beyond that in requiring "8.2.2.5 Internal auditor qualification: The
organization shall have internal auditors who are qualified to audit the requirements of
this Technical Specification." Also, the environmental management system standard ISO
14000 requires internal audits in 4.5.1, and the information security management standard
BS 7799 (ISO 17799) requires at least annual audits of the Information Security
Management System. The list could go on and on.

Current Situation Organizations send only a few - perhaps one or two - of their
employees to external courses. The reasons are manifold, but obviously can include:

 Cost
 Lost time on the job
 Protectionism by the "old guys" (e.g., quality managers/quality directors) of their
turf.

Quality of Training If employees are being sent to external classes, the classes selected
are "internal auditor classes" and are usually of a duration of only one to three days, with
most of the time used to read from the standards. In many cases, the material presented as
well the quality of teachers utilized is mediocre at best. World-class teaching material
and/or world-class teachers are perceived by many organizations as being too expensive
or not available. Instead of learning auditing techniques, the average class reads and
interprets requirements. The overwhelming majority of internal auditing classes are still
very similar to ISO 9001-1994. The fundamental idea of process approach introduced in
ISO 9001:2000 has not yet found its way into the auditor classes - nearly five years after
its release. All course providers need to ask themselves what they really have changed in
training auditors. Let's face it; we all can read. Reading from the standards and charging
money for it is, at least, questionable.

Many community colleges offer internal auditor training in cooperation with local
experts. Although this is perhaps a cheap method, with travel cost being minimal and
accommodations not necessary, it does mean that employees are still close to home and
mentally engaged in their jobs. Homework and self-study activities vital for the success
of the learning experience fall prey to typical everyday activities. In this scenario, the
teachers are very often local experts lacking the required big picture experience. Many of
these teachers can also be so narrowly focused that their students think that what they
hear and learn (from those instructors) is the only possible way of doing things (which is
often not the case).

Selection of Internal Auditors

Selection of internal auditors doesn't always ensure that language is NOT a barrier. In
many U.S. companies, employees with various language and cultural backgrounds work
together. However, the utilized internal auditors do not speak - or at least understand - the
applicable languages spoken within the organization. Another major mistake is to select
auditors from the manufacturing or, even worse, just from the quality department. On top
of all that, it seems that many organizations select their internal auditors based on the
question, "Who is least busy right now?" The problem is that this assumes that these
internal auditors can audit supporting functions like IT or accounting.

After all, ISO 9001:2000 requires that "The organization shall a) identify the processes
needed for the quality management system and their application throughout the
organization (see 1.2). Organizations need to ask themselves honestly if they have
internal auditors competent on the basis of appropriate education, training, skills and
experience." (6.2.1)

Beware of Train-the-Trainer Concept

Thinking that "train the trainer" means sending a person to a subject-related course is one
of the major misconceptions of modern management. To ensure a sufficient number of
internal auditors, many organizations rely on utilizing the externally trained auditors as
teachers for the others; even worse, this is repeated in the same organizations over many
generations. We all know the game Telephone, in which one person hears a sentence and
tells whatever he understood to his neighbor, who in turn tells the sentence to his
neighbor. At the end of the communication chain, it is a funny situation to compare the
original and resulting messages. It's funny when it's a game, but sad if it's a method used
by organizations that want - and need - to compete in an increasingly demanding
international market with fierce competition.

Another disadvantage of utilizing internal auditors as trainers for the next generation is
obviously that the teacher generation is not necessarily trained in training and presenting
difficult material. There is a general misunderstanding that all managers, directors and
vice presidents are also born teachers. Presenting and teaching are skills that some have
acquired better than others. In many countries, teachers of children and adults go for
many years to the universities and learn how to teach. However, the overwhelming
majority of managers never even think about pedagogics - the art of teaching. The same
is true for many so-called consultants - better known as "insultants" - as they tell their
clients what they already know for literally thousands of dollars. But in their defense,
there are some good consultants worth their weight in diamonds.
Organizations serious about the implementation of an effective quality management
system need to ensure that their internal auditors are trained properly. Pursuing or
maintaining a certified quality management system requires the unconditional
commitment of executive management. Lip service will not help; words are cheap, action
is what counts. Executive management needs to be totally and unconditionally behind
every management system. This is a team of people that needs to justify the expenses to
shareholders. This is the same team that constantly ensures that ROI standards are met.
Then, why is it that many organizations are seeing the implementation and maintenance
cost of a management system as a burden and an expense, rather than as an investment in
the future and the competitiveness of the organization? If properly done, it will be a
profitable investment for the delight of the shareholders.

So what can be done? What are possible solutions for the aforementioned problems with
internal auditor training and for continual training of employees in organizations?

Solution #1
An unconditional commitment from the executive management team is needed, not with
lip service, but actions and a commitment of resources. Don't get me wrong; I'm talking
about everything included in resources: people, equipment, money and time.
Management needs to answer a very simple question: Why is it in many organizations
easier to buy a piece of equipment for $200,000 than to get the approval to send
employees to training for $2,000?

A South African saying proclaims: "You pay peanuts, you'll get monkeys." The
translation and interpretation remain the responsibility of the reader.

Solution #2
The selection of internal auditors MUST NOT be limited to a few employees from lower
ranking levels or, even worse, only employees from the quality department. Selection of
internal auditors needs to be from across functions, preferably on the highest possible
level. Imagine the impact and the signal it sends to all involved if a VP is auditing the
shipping department, HR, or any other department. Yes, modern management systems
require a holistic approach and who, if not management, has the overview and knowledge
about what processes are supposed to work across the traditional silos built by
departmental managers?

Solution #3
The selection of the training method - whether it be external, internal by previously
trained employees, the usage of consultants, or teachers coming into the organization - is
not an easy task and the organization needs to understand that the most appropriate
method will not necessarily be the cheapest.

Solution #4 Organizations still wishing to train their internal auditors internally need to
understand that "train-the-trainer" does not mean just sending the trainer to an external
course for the subject he/she should teach. The internal trainers also need to be trained
and prepared in teaching adults. (All of the first four solutions require actions and
decisions by the organization.)

Solution #5 Continuous training is a must. Training should be ongoing throughout the

year.

Solution #6 The cost structure of external courses needs to be revised in such a way that
sending several internal auditors to a class does not exclude many organizations from
sending several of their associates to these classes.

Solution #7 The structure of the courses provided for internal auditors needs to be
changed and a tier system with three or even four levels is needed:

1. Introduction to ISO 9001 or ISO/TS 16949 - this would be pretty much the same
as the current three-day courses, covering the basics and ensuring that all
participants are on the same level before continuing on to the next level.
2. Identifying difficult situations, report writing, the art of writing non-
conformances.
3. Psychology of auditing - dealing with stress, difficult people, cultural differences,
and handling unknown situations.
4. Mastering auditing means moving on in order to help

Solution #8
Technology needs to be better utilized in providing training. LCD projectors have
replaced old-fashioned overhead projectors we used 20 years ago. However, modern
technology allows much more than presenting a handful of slides on a LCD projector.
Teachers and trainers need to understand that using technology might be more expensive,
but it also opens the door to a better training and learning experience. Interactive systems
are available but not widely used in training internal auditors.

Solution #9 We need world-class presenters and presentations. Many trainers are good;
few are excellent.

Solution #10 Internal auditor classes need to be available in multiple languages. This will
ensure that a representative cross-section of employees are trained as internal auditors
and really understand the concepts, preferably in their native languages.

Solution #11 Internal auditors need to understand that they are not just the eyes and ears
of their executive management team, but also represent the customer. After all, ISO/TS
refers to the customer 157 times (of which 79 are TS-specific). However, many
organizations interpret ISO/TS requirements (8.2.2.5 Internal auditor qualification) in a
way that they think it is sufficient to send their internal auditors to one of the
aforementioned auditor courses. However, as customer requirements as well as regulatory
requirements form an integral part of the new standards, the question is how internal
auditors are really trained in these areas. Training for internal auditors therefore needs to
be modular so that it can be tailored to the needs of the organization and its customers.
The content of training needs to include aspects such as:

 Business planning
 Regulatory requirements
 Organizational skills
 Auditing techniques
 Question techniques
 Interviewing techniques
 Procurement
 Human resources
 Risk analysis
 Project management
 Basic information security systems

May this help the readers to review the situation in their own organizations and help them
to rejuvenate their internal auditing programs.