Selecting and Training Internal Auditors

by Craig Cochran 

Selecting and training internal auditors will have significant impact on the success of your audit program. After all, these people are the living face of your program. Sure, you have someone fulfilling the role of audit manager, but the real magic happens with the team of internal auditors you recruit and train. Don’t make the mistake of just selecting people who have some extra time on their hands. Choose the right people who will help develop the audit program and make it a true engine for improvement. So, what sort of criteria should you use when selecting internal auditors? Here are some attributes to look for:

• Curiosity. Good auditors are naturally curious. They want to know how things work. Everything about a process is fascinating to them: the materials, tasks, equipment, measurements, and products. Good auditors are not curious about these details because they want to write nonconformities, they’re curious because they want to learn. Intellectual curiosity is at the heart of auditing. When people are naturally curious, they will automatically ask probing, insightful questions. And they will learn very quickly how effective the process is.
• Persistence. This is what I would refer to as “stick-to-it-ness.” Auditing can be a very challenging activity, but good auditors thrive on these challenges and keep on going. They have the strength and determination to get the job done. People who are satisfied with giving a minimal effort don’t make good auditors. They simply aren’t persistent enough. It’s important to note that auditing can be a physically challenging activity as well as a mentally challenging activity.
• Focus. Focus is the ability to keep your thought patterns aligned with the task at hand. When you are an internal auditor, distractions abound. Phones ring, emails ding, and people come to you with problems and questions. In spite of all this, good auditors politely shoo away distractions and stay focused on the audits. This requires equal parts of diplomacy and resolve. Not only do auditors have to keep themselves focused, but they also have to help the auditees stay focused. The same distractions that can sidetrack auditors will also sidetrack auditees.
• Detail orientation. Auditing is all about details. Yes, truly great auditing involves the recognition of trends, but all trends begin as individual details that somebody has to discover. Good auditors pick up on details that other people miss. They use their senses simultaneously: sight, sound, smell, and touch. Through these diverse interfaces, they receive and process a wide range of information. Of course, it’s always the temptation for a detail-oriented person to nitpick. This temptation is countered by reminding oneself that ultimately the internal auditor is seeking conformance, not nonconformance.
• Strategic thinking. This is what top managers are supposed to do. It involves looking beyond the day-to-day tasks that are carried out, and contemplating the actions that will make or break the organization over the long term. Strategic thinking is difficult because the vast majority of employees are task-oriented. They’re paid to carry out specific activities, not think about what could happen five years from now. Good auditors incorporate strategic thinking into their audits by delving deep into the processes that really affect future success. These include:
  • Top management and management review
  • Customer feedback
  • Risk management
  • Corrective action
  • Internal auditing
  • Product realization

Not all processes are created equal, and it’s the job of strategic-minded auditors to recognize which ones are more important. Strategic auditors are also able to recognize which opportunities and nonconformities pose the biggest risks to the organization, and they highlight these in their reporting so the risks get the correct amount of attention.

• Enthusiasm. Good auditors are enthusiastic about their missions. Auditors understand the benefits of auditing and believe in the process. They want to be auditing because it feeds their intellectual curiosity. Auditors’ enthusiasm rubs off on everybody they speak to. Little by little, this enthusiasm helps build a culture of continual improvement within the organization.

As you identify candidates to serve as internal auditors, make sure to touch base with their supervisors. Discuss auditing and the expected time commitments with their supervisors before speaking to the candidates. The supervisors will certainly have questions about what auditing involves, why their subordinates were selected, and how it could affect their existing workloads. Address all these issues and get supervisor buy-in before going any further. Only after you have the full support of the supervisors should you approach the potential auditors.

How to sell the auditing role

Based on the personal attributes listed above, it’s obvious that we’re seeking some impressive people to serve as internal auditors. The obstacle with impressive people is that they’re already busy. As you propose the idea of people serving as internal auditors, one of the first responses you’ll hear from these folks is, “Hey, I already have too much to do.” Your job is to sell the benefits of serving in this role, and thankfully the benefits are many:

• You will see parts of the organization nobody else gets to see. Internal auditing is the best on-the-job training exercise imaginable. As an internal auditor, you will have a deeper and broader understanding of our organization than anybody else.
• Auditing is endlessly fascinating. This statement comes from someone who has performed auditing for thirty years: me, the author. You will never get bored auditing. It is an activity that will keep you engaged and challenged, no matter how long you do it.
• You will learn something new every time you audit. Best practices pop up all the time during audits. You will discover innovative practices and cutting-edge methods, some of them completely informal and preserved only through verbal communication. As an auditor, you’ll be able to expose these methods to the rest of the organization.
• You will have the ability to initiate significant improvements. Do you like to make a positive impact? If your answer is yes, then internal auditing is for you. You will have unparalleled ability to influence the direction of change in the organization.
• You will catch the eye of top management. Few employees have the visibility of top management, but as an auditor you will have their undivided attention. The opportunities and nonconformities that you uncover will be presented directly to top management for their review.
• Auditing will make you more effective and successful in your regular job. Your experience as an internal auditor will have an immediate and positive impact on what you do now for the company. How? You will be able to apply the principles that constitute best practices, and avoid the missteps that constitute nonconformities.
• You won’t be asked to audit all the time. Internal auditing is a periodic activity. The actual time commitment will be a few hours a month at the most. Top management supports your involvement and will make sure that you don’t get overwhelmed.

Ultimately, you as a supervisor might have the ability to “volun-tell” people that they are going to be internal auditors. If that’s the case, good for you, but it’s still important to make the benefits clear to the new auditors. They will operate much more effectively if they understand what they’re getting out of the arrangement.

Try to recruit a wide range of personnel

The ideal audit team is made up of diverse personnel from different backgrounds and different parts of the organization. This makes for a team that is going to challenge itself and examine audit evidence from vastly different perspectives. This is highly desirable. When you have auditors with a wide range of experiences, your team is better able to understand and audit all processes within the organization. You won’t fall into the trap of people trying to audit departments with which they have no familiarity, and you also won’t fall victim to everybody on the audit team thinking the exact same way. Try to get representation across the full spectrum of personnel, including:

• Hourly employees
• Salaried employees
• Production employees (manufacturing or service)
• Front office administrative employees (e.g., purchasing, accounting, or human resources)
• Engineering and technical employees

Personal attributes are the most important selection criteria for internal auditors. If you’re able, also strive for diversity of backgrounds, experience, and organizational roles. Your audit team will be stronger and more flexible.

Training for internal auditors

When you believe you have a solid team of auditor candidates, the next obligation is training them. Auditing is not a process that many people are naturally good at. They need exposure to the full range of auditing tools and techniques with opportunities to practice them under supervised conditions. Training that is provided solely online is seldom going to be effective. Neither is classroom training all by itself.

• Audit principles. As you know by now, audit principles are the foundation that we build the audit program on. These are the important ideas that auditors need to understand and adopt.
• Standard requirements. Most management systems are based on an international standard of some sort, such as ISO 9001. The big challenge is that these standards are often hard to understand. They’re full of requirements that can be used during an audit, but the actual meaning of your requirements can be a bit fuzzy. Auditor training needs to cover standard requirements in detail, with an emphasis on practical interpretations.
• Audit procedure. The audit procedure is the document that describes how an audit should take place at your organization. By the time you conduct auditor training, you will have a written an audit procedure and all your internal auditors need to understand what it says.
• Preparing for an audit. You don’t just wake up one morning and start doing an audit. There’s a significant amount of preparation that has to happen even for a relatively short audit of a few hours. This includes refreshing yourself on the procedures in the department you’ll be auditing and developing some preliminary audit trails. It could also include the development of an audit checklist.
• Developing an audit plan. The audit plan is a simple and concise document that says where you’re going to go and what you’re going to do during the audit. It covers times, places, and topics to be discussed. Like any multifaceted plan, it takes some training and practice to develop.
• Interviewing techniques. At its heart, auditing is nothing more than friendly conversations. It’s conversations with a very specific objective: to gather evidence that indicates conformity. As such, there are some methods to these conversations that we will label interview techniques. The better your auditors know interviewing techniques, the smoother the audits will go.
• Audit requirements. Audit requirements are the full set of criteria that you can use during the audit. These include standard requirements, procedures, policies, work instructions, contracts, etc. that have been adopted by the company. Auditors’ opinions never constitute requirements.
• Objective evidence. This is what you’re seeking during audits. It’s the factual, unbiased, and verifiable proof that we either met or did not meet the audit requirements. Sometimes it’s easy to get objective evidence mixed up with subjective evidence.
• Matching evidence to requirements. One of the keys to auditing is matching evidence to requirements. It’s a relatively simple task once auditors understand the logic and have had some practice with it. Failure to match evidence to requirements means that auditors are just casting about and wasting everybody’s time.
• Writing nonconformities. Writing is a difficult task no matter what the context. Writing audit nonconformities is an especially difficult task because you’re balancing detail with brevity; you’ve got to state the facts, but you can’t write a book. The fact that some people believe they’re being personally evaluated during audits raises the stakes even further.
• Conducting opening and closing meetings. The book ends of the audit are the opening and closing meetings. Auditors need to understand how to conduct these meetings in a dignified and professional way, yet still retain personal warmth. Closing meetings are especially important because this is where we officially discuss the audit results.
• Audit reporting. The written output of internal audits is what we refer to as audit reporting. Audit reports must be clear, concise, and no longer than absolutely necessary. It takes some practice to achieve this.
• The link to corrective action. There is a direct and critical connection between internal auditing and corrective action. Internal auditors need to understand the corrective action system just as well as they understand auditing.
• Following up on audit findings. Finally, auditors need to be trained on how to follow up on and close out audit findings. This is one of the most neglected phases of the audit process because it takes place well after the on-site audit is completed.

Don’t settle for less than the best when you assemble your internal audit team. Sell the program enthusiastically to impressive auditor candidates, and clearly communicate all the benefits that can accrue to auditors who carry out this important role. Internal auditors with strong personal attributes—combined with effective training—will become engines of improvement.

About the author

Craig Cochran is the North Metro Regional Manager with Georgia Tech’s Economic Development Institute. He has assisted more than 5,000 companies since 1999 in QMS implementation, problem solving, auditing, and performance improvement. Cochran is a Certified Quality Manager, Certified Quality Engineer, and Certified Quality Auditor through the American Society for Quality. He is certified as a QMS Lead Auditor through Certus Professional Certification.

He is the author of numerous books, including ISO 9001:2015 in Plain English, published by Paton Professional. This article was excerpted from Cochran’s book, Internal Auditing in Plain English.

Copyright 2015 by Craig Cochran. All rights reserved. Reprinted with permission from the author.