Consultant or Auditor, What is the Difference? Let us explain what these differences are when talking about management systems.
When we refer to an implementer it is someone that is responsible for implementing a management system within a business. Normally this person works within the business in the capacity of an employee.
An implementer is responsible for establishing, implementing, maintaining and improving the management system. Those four words I just use - establish, implement, maintain, and improve come from the standards. I didn't make them up!
I love those four words as it means that when you put in place a management system, it’s not just a project, it’s an ongoing process.
Now a consultant does exactly the same thing. They still establish, implement, maintain, and improve a system. However, a consultant is normally external to the business. They are contracted to implement and maintain the management system for the company. They would work in the capacity of a consultant.
Absolutely, they can. If you are a consultant or an implementer, you should be conducting the internal audits as part of the process of establishment, implementation, maintenance and improvement.
The only thing that you need to be careful of is that you do not audit your own work.
Within the Standards, clause 9.2 Internal Audit uses the words impartial and objective when referring to internal auditors. As an internal auditor, the conduct of the audit needs to be impartial and objective.
I always say, if you have generated the records, if you have generated the evidence, then you shouldn't be auditing it. It’s perfectly fine to conduct internal audits of a management system that you have implemented if it is in an area that you are not creating the records or evidence. Normally a consultant or implementer does sit at a higher level and is not involved in the day-to-do processes.
I did have an instance recently on an audit where the implementer in the business was at a management level and he conducts the internal audits AND is involved in the management reviews as top management. An internal audit that he had completed was on the management review process. We had a bit of a discussion around that as of course he was a part of that process and a part of generating the records for that.
It can be challenging in small organizations so in this instance I also look for impartiality and objectivity in the results of the audit. There would be a bigger issue if the audit had not identified any issues or improvements, however in this instance the audit report was very detailed and had identified quite a few areas for improvement. The internal auditor HAD demonstrated impartiality and objectivity in the conduct of the audit.
Now, let’s flip this around…
As a certification auditor, the answer is a straight-out NO!
I am a certification auditor myself, so I go into organizations to audit their systems, looking at evidence to see whether it meets the criteria (ISO Standards). The output from this is that we will raise nonconformances, observations and even improvement opportunities.
Can we then tell the organization HOW to fix these – absolutely NOT. As a certification auditor, we do not provide the corrective action – we are not consultants as well.
Now, if you audit against different criteria, such as legislation, then this might be a little different as they do tend to provide what is called ‘recommendations’ with their findings. It is still about determining the extent of compliance against the criteria; however, recommendations may also be provided.
It does depend on the type of audit being conducted and should be identified in the objectives of the audit.
You can see then that auditing, consulting and implementing can be interchangeable however you always have to be conscious of where a conflict of interest may be so that you don’t cross that line.
Note – this is an excerpt from the Auditor Training Online Facebook Live, view the video here.