Fact vs. Fiction? Qualifications for Internal Auditors

What are the requirements for individuals to perform ISO 9001:2000 internal audits for your company? There are not as many as you might think. In fact, you determine most of the requirements. The only requirement specified in the standard is that auditors shall not audit their own work. There is a requirement that personnel performing work affecting quality be competent on the basis of appropriate education, training, skills, and experience (ISO 9001:2000, 6.2.1). Note the use of the word "appropriate". What constitutes appropriate may be different for different companies.

1. Education/Training - An internal auditor should have some type of training, whether held internally or through a company that offers this type of training. If you have an experienced auditor on staff, he or she may be able to conduct the training for you.
2. Skills - Auditing skills are usually acquired through experience.
3. Experience - Once an internal auditor has completed training, it is a good idea for him/her to conduct audits under the guidance of a more experienced auditor for a period of time before doing audits on their own.

If you hire an individual who is a Certified Quality Auditor (CQA) through the American Society for Quality (ASQ) or holds another type of auditor certifications, they can be qualified based on the certificate. Some companies have required all internal auditors to become Certified Quality Auditors. This is a noble pursuit but not a requirement. It is also not a requirement for internal auditors to complete Registrar Accreditation Board (RAB) lead Assessor training. When defining your requirements for internal auditors be careful not to make things more stringent than necessary.
In small companies, even meeting the requirement of auditors not auditing their own work may be difficult. See the our article on Internal Audits in small companies for some suggestions on this area.

An organization can also look to the requirements for audit in the ISO 19011 standard when determining the qualifications of auditors. Again, remember that this may be excessive depending upon the size of your company and you are the one who define the qualification of your auditors.