Audit Team Lead – Timothy E. Allen | Former Special Agent (U.S. Secret Service & DOJ-OIG)
ISO internal audits are an essential aspect of a company’s compliance mechanisms, particularly if the corporation conducts business internationally. Implementing international standards of quality is only the first step in the compliance process; companies also have to take care to conduct regular internal audits to ensure that the correct procedures are actually being followed and that the resulting goods and services hold up to the appropriate standards.
The internal auditing professionals at Corporate Investigation Consulting help companies, both large and small, take the steps necessary to come into compliance with ISO standards and then maintain their certifications through a rigorous internal auditing process.
The ISO Compliance System
The International Organization for Standardization (ISO) has set a host of standards for businesses to voluntarily comply with. These standards are meant to ensure that the company’s products and services meet expectations in regards to quality and safety. Companies that meet these standards can become ISO certified – a designation that carries great importance in international business. Companies that are currently certified by the ISO can be trusted to meet at least the minimal standards required by the organization. This lets customers and other businesses reasonably anticipate and rely on the company’s products being consistent and dependable.
However, ISO does not just require companies to meet their standards for quality. The ISO also demands that companies maintain that level of quality. This is to ensure that ISO certification continues to carry meaning. Otherwise, companies could meet ISO’s standards, get certified, and then immediately roll back their efforts of dependability in order to cut down on costs.
Instead, part of ISO’s required standards involve regular internal ISO audits. These audits must ensure that the compliance mechanisms adopted by the company to meet ISO standards are still being followed and upheld. Not conducting these internal ISO audits can imperil the company’s ISO certification. If that certification is lost, other businesses and customers are likely to seek their goods or services elsewhere, knowing that losing certification means that the company has had internal setbacks that have hampered the quality of what it produces.
Put our highly experienced team on your side
Roger Bach
Former Special Agent (OIG)
Timothy E. Allen
Former Senior Special Agent U.S. Secret Service
Chris J. Quick
Former Special Agent (FBI & IRS-CI)
Maura Kelley
Former Special Agent (FBI)
Ray Yuen
Former Supervisory Special Agent (FBI)
Michael S. Koslow
Former Supervisory Special Agent (DOD-OIG)
Marquis D. Pickett
Special Agent U.S. Secret Service (ret.)
The Many Different Types of ISO Audits
Because there are so many different ISO standards that have to be met in order to get certified by the organization, there are also numerous different types of internal ISO audits. Each of these types of audits inspect distinct business practices and protocols that bring the company into compliance with unique ISO certification requirements, such as the following standards:
- ISO 9001
- ISO 13485
- ISO 14001
- ISO 14971
- ISO 17025
- ISO 20000
- ISO 27001
- ISO/IEC 17025
- ISO/TS 16949
- OHSAS 18001
- R2 and RIOS recycling
- AS9100
- AS9110
Just a few of the types of ISO audits that can be performed to ensure compliance with these standards are:
- Gap analysis
- Supplier audits
- Pre-assessment audits
- Internal audits
- Complete audit program maintenance inspections
The auditing professionals at Corporate Investigation Consulting can help on any of these fronts.
Gap Analysis
A gap analysis is a crucial part of implementing an ISO compliance scheme. The analysis reviews a company’s current compliance infrastructure, compares them to the needs that have to be met in order to satisfy the targeted ISO standard, and identifies the gaps between what exists and what needs to be in place. Implementing an ISO compliance protocol without doing a gap analysis first is a blind endeavor that is almost certain to miss important aspects of compliance or create duplicative or needless compliance policies.
Supplier Audits
Unfortunately, coming into compliance with ISO standards is not something that only involves the company seeking certification. No company exists in a vacuum. Shortcomings by a company’s supplier can prevent that company from meeting ISO’s stringent expectations. Just because it is a third party that is responsible for the shortfall does not absolve the company seeking ISO certification.
Auditing suppliers is a critical component of seeking ISO certification. By examining suppliers’ services early on in the process, companies can identify weak components in their supply chain and issues that can affect their certification efforts. It can also pinpoint problems that can be improved upon, to the company’s benefit.
Pre-Assessment Audits
One of the last steps to take before applying for ISO certification is to conduct a pre-assessment audit to ensure that the steps that have been taken are satisfactory. ISO will assess them as a part of the certification process. Performing your own pre-assessment audit before applying for ISO certification can discover potential shortcomings that can doom your application.
Internal Audits
Companies that have been certified by the ISO still have to actively audit their compliance measures to make sure they are still working the way they are supposed to work.
These internal audits have to meet the expectations of ISO 19011:2018, the standard promulgated by the ISO to cover these internal audits.
Conducting Internal ISO Audits
Internal ISO audits can be performed by auditors within the company or by external auditing teams. Generally, external audits performed by professionals, like those at Corporate Investigation Consulting, are considered to be more reliable, as they do not carry the potential for conflicts of interest that are always present when the audit is done in-house.
Regardless of who conducts the internal audit, though, certain steps will have to be taken before, during, and after it. A few of these are to:
- Identify the precise type of audit to be performed
- Isolate which ISO standards are at play or have to be met
- Determine the audit’s scope and depth
- Figure out which types of evidence will be reviewed while conducting the audit
- Set a timeframe
- Define noncompliance
- Gather all evidence within the scope of the audit
- Plan how to correct any shortcomings that were discovered in the review
Each of these steps have to be thorough in order for the audit to have its desired outcome.
Some Frequently Asked Questions About ISO Internal Auditing and Corporate Investigations Consulting’s Services
What are the Goals of Conducting an ISO Internal Audit?
The major goal of running an ISO internal audit is to maintain the company’s standing as an ISO certified organization. This label tells other companies and potential business partners that the corporation can be trusted to provide safe and qualified goods and services.
However, these standards are not arbitrary. Meeting ISO’s standards to achieve their certification makes the company a better and a more efficient organization. Conducting an internal audit of the company’s compliance mechanisms that are in place to obtain that certification also ensures that the qualities underlying the relevant ISO standards are being met. Therefore, the goals of an ISO internal audit also include reviewing the company’s practices to ensure:
- The company’s goods and services are up to par
- Quality control protocols are being followed
- Customers are being kept happy
- Relevant statutory and regulatory requirements and obligations are being met
- Potential legal liabilities are being kept to a minimum
Reviewing the company’s performance on these fronts pays its own dividends.
Can ISO Internal Audits Be Performed by a Company’s Own Auditing or Compliance Team?
ISO internal audits can be performed by the corporation’s own personnel. However, there are several reasons why company stakeholders and decision makers should strongly consider getting external help.
First and foremost, external auditors are likely to be more familiar with the particular requirements of ISO internal audits, as they perform them as a matter of course. The experience that they have accumulated by conducting numerous ISO internal audits for a variety of other companies gives them a leg up on the company’s own auditing personnel, who may only run one of these audits once a year.
Second, external auditors are immune from potential conflicts of interest affecting their work and the outcome of the inspection. Even if the company’s auditing team is well segregated from the rest of the organization, there will always be the perception of influence that cannot be shaken off.
These are just a couple of the most pressing reasons why companies should consider bringing in external professionals to conduct an audit.
What Sets Corporate Investigation Consulting Apart from Other Auditing Professionals?
The auditing professionals at Corporate Investigation Consulting have extensive experience in some of the most thorough and nuanced investigative work. Many of the members of our staff have worked as investigators in some of the leading federal law enforcement agencies in the country, including in the Federal Bureau of Investigation (FBI), the U.S. Department of Justice (DOJ), and the Internal Revenue Service (IRS). The lessons and techniques that they picked up during that time has proven to be invaluable for sensitive internal auditing and corporate investigative work in the years since.
Corporate Investigation Consulting Provides ISO Internal Auditing Services
ISO internal audits are a crucial component of protecting one of the most important certifications that many companies have: Their ISO certification. Customers, other businesses, and potential clients often look for ISO certification before conducting business with a company, as it signals a base level of quality that they know that they can expect. Not having an ISO certification or, worse, losing it sends a strong signal to potential business prospects that your company may be too risky for them.
Performing internal ISO audits are required for maintaining that certification.
The auditing professionals at Corporate Investigation Consulting have helped numerous corporations maintain their ISO compliance and protect their certification. Contact them online or call their offices at (866) 352-9324 to tap into their extensive experience.