Internal Audit Best Practice

ISO 19011:2002 is the standard that covers the auditing of Quality and Environmental management systems and, after 8 years, the International Standards Organisation (ISO) is looking to revise this.

With a focus on enhancing the standard, ISO 19011 is now out for final comment and will be published next year.   This will include the following changes:

• There will be more of a focus on internal auditing.   The standard at the moment covers internal auditing but has a focus on supplier and certification body (second and third party) auditing.   With the previous publication of ISO 17021, there is now a standard for certification body auditing and ISO 19011 should focus more on internal auditing.
• ISO 19011 was originally published to cover Quality and Environmental auditing.   Over the last few years there are now many different systems to audit (Health & Safety, Food, Social Responsibility, Information Security etc) and ISO 19011 is being updated to reflect the differing competencies required to audit these systems adequately.    Competencies will include for instance knowledge of legal requirements, and other specialist areas such as waste minimisation, risk assessment and sustainability.
• The concept of risk based auditing will also be included,  where by significant business risks (eg most important contract, most significant aspect and most significant H&S hazard) are prioritised for auditing.   Although you could argue this is nothing new, it is a step in the right direction to make sure internal audits continue to deliver value to any organisation.
• Remote auditing is another area covered by the revised standard.   Although traditional face to face auditing is still favoured by many, the use of video conferencing and remote web based reviews are now covered in the revision.

It may be easy to dismiss the changes to this standard as custom and practice but ISO 19011 is used as the guidance for IEMA and IRCA auditor training courses so you should see these concepts filtering into training courses when the standard is published sometime in 2011.