AASHTO re:source Q&A Podcast Transcript
 Season 3, Episode 3: Internal Auditing Awareness Month – Who Can Perform Internal Audits

Released: May 24, 2022

Hosts: Brian Johnson, AASHTO Accreditation Program Manager, and Kim Swanson, Communications Manager at AASHTO re:source

Guest: Tracy Barnhart, Quality Manager at AASHTO re:source

Note: Please reference AASHTO re:source and AASHTO Accreditation Program policies and procedures online for official guidance on this, and other topics.

Transcribed by Kim Swanson

 [Theme music fades in.]

Announcer: Welcome to AASHTO resource Q&A. We’re taking time to discuss construction materials testing and inspection with people in the know. From exploring testing problems and solutions to laboratory best practices and quality management. We’re covering topics important to you. 

Kim: Welcome everyone - I’m Kim Swanson and on this episode of AASHTO re:source Q & A, in honor of Internal Auditing Awareness Month, [Theme music fades out.] we’ve pulled together audio from previous episodes and webinars about internal audits.  Specifically, in this episode, we will be talking about who can perform internal audits, how consultants factor into the discussion, and training auditors.  In these clips - You will be hearing myself, Brian Johnson, and of course, AASHTO re:source’s Quality Manager, Tracy Barnhart.

[Audio Transition.]

Brian:  Yeah, now let’s get into who the auditor is now.  We have a question that asks: Can certain functions of an audit be performed by someone in a management position that is not independent of the operation, as long as it’s reviewed by someone who is?

Tracy: I’m not sure if I would suggest doing it that way. Because if we audit our own stuff, we might miss some things that somebody else might uncover. I would avoid doing that – if possible. We understand that we have some laboratories that aren’t able to do that because they are only 1 or 2 people there. But I would try to find somebody to do an independent review, if possible.   

[Audio Transition.]

Brian:  How can it be both independent and internal? 

Tracy:  Where possible, the internal auditor should be independent of the activities being audited. That’s actually a requirement in AASHTO R18. So, for example, a Laboratory Manager should not be auditing their own records and documentation, if they are responsible for those activities. If there is someone else in the laboratory that is able to do that.  I think a lot of our customers think that internal audits have to be conducted by the Laboratory Manager, and that is not correct. An internal audit can really be conducted by anyone with proper training and knowledge of the QMS and what’s being reviewed during the internal audit.  It could be an administrative person. It can be a technician. You can have different people involved in different aspects of the audit to ensure independence.  So, I think at most of our laboratories the independence factor is able to be achieved. 

Brian: Yeah, I would agree. I think a lot of people don’t think outside the box enough and think about some of the positions you just mentioned, and they really should.  And I’ll give you an example. We are relatively large at our organization, but we try our best to ensure independence in our own internal audits. And I’d say the most notable instance of that is the fact that our quality program actually goes through an internal audit, with you, as the Quality Manager.  Now Tracy, you are normally the person that conducts the internal audits or is the lead auditor for all of the other programs. How do we ensure that independence when the quality department is being audited?

Tracy: We have a separate audit of quality-related activities. Those are things like customer feedback, corrective actions, management reviews, and the internal audit process itself, among other things. And how that is coordinated is Bob Lutz, the Manager of AASHTO re:source, he actually takes the lead on that. He’ll send an email to staff, ask for volunteers to be part of that audit team. He is responsible for training the auditors, giving them all of the documents that they need to conduct the audit.  I’m completely out of the loop on that, except when it comes to scheduling.  Obviously, I need to be available at a convenient time.  But Bob takes the lead on that so that activity is completely independent of what I normally do with those activities.  

[Audio Transition.]

Brian:  Yeah, what advice would you give to an internal auditor who has – who is dealing with a colleague who might be a little more – uh - prickly about [Tracy: Laughs.] the situation where they're being audited by one of their colleagues? What kind of advice would you give? 

Tracy: Sure.  Nobody likes to be audited, let’s be honest. Even at AASHTO re:source, we love auditing, but I understand – I have been on the other end of auditing. It can be an uncomfortable feeling.  So, I think it’s really important to select the right auditors, to begin with.  You want to select people that are going to make people feel comfortable…  

[Audio Transition.]

Brian:  Yeah, should that audit be performed strictly by quality management staff or could it be other laboratory personnel? 

Tracy: Definitely could be other laboratory personnel. I encourage you to get others involved in the internal audit process.  At AASHTO re:source, people love helping me do the audit. It’s something different for them. They’re learning so much about the other programs that they didn’t know anything about before.  And they are learning auditing skills.  I think the more the merrier, just make sure that you train them properly and that they are familiar with the audit criteria. 

Brian:  Yeah, I agree. I think we get a lot of value-added when people who aren’t in the program – you know, work at AASHTO re:source but maybe aren’t as familiar with the program that they’re auditing – they get a lot out of it, we get a lot out of it. It’s a win-win.  

[Audio Transition.]

Brian:  What about a consultant? Sometimes people ask if they can have a consultant perform the internal audit.  At what point does the internal audit become an external audit? Is that even acceptable?

Tracy: The short answer is, yes.  You can use a consultant for this activity. You do have to be careful not to cross the line between internal audits and external audits. Keep in mind that no one knows your business better than you do. So, ideally, you would want to perform the internal audit yourself if you want to focus on finding those improvement opportunities specifically. But yes, a consultant can be used. Again, make sure they are familiar with the audit criteria.  If they are doing an audit to R18 or ISO standards, they need to have familiarity with those concepts.  They also need to have familiarity with construction materials testing – in general, not the specific test methods themselves but…in general.  And how your business operates.  If you are going to use a consultant for this, be sure that that is indicated in your procedure for internal audits as well. Because that is something we will be looking at for the AASHTO R18 review. 

[Audio Transition.]

Brian:  How do you take someone who is not internal to your company, like a consultant, and have them conduct an internal audit in a way that is still considered to be an internal audit?

Tracy: That is a great question. [Brian: Laughing.] We do get that one a lot. A lot of the consultants that I’m familiar with have the background with internal auditing and they are very familiar with construction material testing. So, I think that helps a lot right there.  If you are looking into hiring a consultant, you want to make sure that they actually have the CMT experience. Uhh – that would definitely help the effectiveness of the internal audit.  And you want to make sure that they’re somewhat familiar with your business practices in your laboratory. I think that has complete unfamiliarity with both CMT testing and your own laboratory’s business practices, I’m not sure how effective that internal audit would be.  I’m not sure what your experience has been with that Brian, but that’s how I would answer that question. 

Brian: Yeah. My-my experience has been that sometimes people ask about whether they can hire a consultant to perform them, and I would say that consultant really needs to be knowledgeable about everything about your business.  So, they can’t come in cold and just perform an internal audit.  That would be more like an external audit. They’ve got to understand all the inner workings.  They need to know the people more.  So, I would say that you’d probably have to have a couple of – maybe a few meetings, or a long meeting where they get to know everybody and they really get to dig into how you do your work and interview a lot of people. And perform the internal audit the way that your quality management system indicates that it needs to be performed internally. But we kind of have to evaluate and determine whether or not that’s suitable as an internal audit.  

Tracy: Right. And our customers should also realize that nobody knows their business better than they do. So, ideally, you should be conducting your own internal audits because another benefit of conducting internal audits is to identify improvement opportunities.  It’s easier to do that with your own people because you are really familiar with your own processes, requirements, and everything else that goes on in the quality management system.  So, I wouldn’t be too quick to hire a consultant if you are able to conduct an effective internal audit yourselves because those improvement opportunities are going to be identified a little bit easier if you do them on your own.  And Brian, you brought up something that I wanted to touch on as well, uh – if you are hiring a consultant – or no matter how you are doing the internal audit, you want to make sure that your quality management system procedure for internal audits accurately reflects what you’re doing, as far as the internal audit process. 

[Audio Transition.]

Brian:  You know, especially in a small organization where they don’t have a lot of people involved, how do we get somebody who doesn’t normally do those kind of activities up to speed on how to perform an internal audit effectively?

Tracy: Train them on the actual standard itself and also provide any auditing skills training that are necessary.  I did create a PowerPoint presentation for internal audit training, which staff has access to that. So, it is a brief presentation on internal auditing, how to do that effectively, what is ISO 9001, what should you be looking for during internal audits.  So, we have that covered as well.  And then I have worksheets created for ISO 9001 requirements, laid out just as the standard is – clause by clause. And that is a document that is used by all internal auditors when we conduct our audits.  

Brian: Because you have all that background materials, I imagine you could take someone that doesn’t have the background experience, and train them on how to perform that internal audit as well. But let’s say that you are a small laboratory, and you really don’t have those resources at your fingertips, what would you do to make sure you could get somebody – who may be a nontechnical person that works for your company – up to speed on how to perform an internal audit? 

Tracy: There are a lot of external resources for that.  There are webinars available on internal auditing, there are actual classes that you can take – either virtually or in-person, on internal auditing.  I’ve actually taken as well over the years here with AASHTO re:source. Also, you could hire a consultant to assist you with the internal audit.  Again, as long as they are familiar with the audit criteria and your business, they should be able to help you conduct an effective internal audit. 

[Audio Transition.]

Brian: Can AASHTO re:source provide internal audit training? 

Tracy: It’s something we can consider in the future, offering training by AASHTO re:source for this topic. Uh – I would also recommend that you do a Google search and see what types of organizations that are out there offer training.  Unfortunately, I’m not able to specifically identify, specific organizations that do that, but there are lots of good ones out there that offer training for internal auditing.

Brian: Is there any recommendations for internal training at a laboratory? 

Tracy: I created the internal training program. I actually did some Google research on that to identify tips and tricks for auditors from my own 30+ years of experience – what I’ve learned along the way, I added that into the presentation. How to be a good auditor.  How to be a good listener.  What you want to cover during internal audits, and checklists, and things of that nature.  Most of the people that help me do audits are auditors for AASHTO re:source, but I’ve had some people that have never audited before.  So, for people like that, I focus more on how to audit, if they are unfamiliar with that topic.  So, we have a lot of discussion with that.  It usually takes me longer to train someone that doesn’t have the auditing experience prior to the internal audits.  

 [Audio Transition.]

Kim: Where is the best place to find training to conduct internal audits? 

Tracy: I’ve taken external training on internal audits – I don’t want to name the actual agency, because we don’t want to endorse a specific agency.  I took – I believe it was ISO-related training, 9001 – and it was an intense 5-day course on internal audits.  I thought it was fantastic.  It was a number of years ago that I took it. But there are a lot of resources out there for internal audit training. I would direct you to ASQ.org.  The American Society for Quality.  They offer a lot of training and I know they are doing a lot of webinars right now because of COVID. So, maybe check there. 

Kim:  Thanks, Tracy. Also on that topic, also have an article I linked to on internal audits, about the facts of that, so if you look in the chat there’s a link for that too, if you want more information on internal audits that we’ve provided.    

[Audio Transition.]

Kim:  You’ve just heard clips from season 1, episode 28 – Management Reviews Extended Q & A – season 2, episode 24 – Taken from Tech Ex: Internal Audits, the Focus on Improvements, and Season 2 episode 12, Conducting Effective Internal Audits.  I encourage you to listen to those complete episodes for way more discussion on this topic. 

[Theme music fades in.]

Announcer: Thanks for listening to AASHTO re:source Q & A.  If you would like to be a guest or just submit a question, send us an email at podcast@aashtoresource.org or call Brian at 240-436-4820.  For other related news and content, check out AASHTO re:source's twitter feed or go to aashtoresource.org. 

[Theme music fades out.]