In a discussion the other day over this subject where it was suggested that you can have one person responsible for the whole management system, who also has direct responsibility for doing some of the things required by the system, including doing all the internal audits. I put it that if the person does some of the work they would not be able to do an internal audit on themselves; someone else has to do it (with no conflict of interests). However having thought about it some more, I can see their point in a smaller organisation you could possibly argue that if they are ultimately responsible they would not “ cheat” or not do their bit as they have overall responsibility and the buck stops with them. What are your thoughts on this? Not the merits of these standards and the management system that comes from them, just the issue of internal audit. I guess the situation would be the same for ISO9001 and 14001. Have you had such a discussion with your management / external auditors / course providers?

Hey...I think you are talking about the IMS (Integrated Management System) ie., all the management system. And as you said, there is a possibility of cheating if the employee do the Internal Auditing..because, he may be do favor to his boss...but most of the organizations has no other go..so they appoint one of their employees to do the Internal Audit...

Section 8.2.2 of ISO 9001 states that auditors shall not audit their own work. Section 4.5.5 of ISO 14001 & OHSAS 18001 also say the same thing. One sole person is not responsible for the management system either. You can have one person who is responsible for the maintenance, monitoring & measuring of the system but everybody in the organization one way or another is responsible for the whole system and the achievement of the objectives. I can remember recieving an NCR from a certification auditor for this very thing (auditing an area i had responsibility for). The problem at the time was that there was nobody else trained to carry out the internal audits. That was soon addressed but even in a small company there should be more than 1 person to carry out the audits (unless you use a consultant) as explained by Kate in above post.

I carry out internal audits at my site and of course continue then to have the external audit for accreditation. This is normal practice on a lot of sites. The idea of carrying out an internal audit is to ensure that your management system is working. If you are using a standard then surely you know if the particular section is in place or not. Have I mis-read the post?

They want me to carry out the internal audits and as you do and be the responsible person for the external ones. The issues is that some of the actual day to day work (other than audits) is also down to me, so I either would have to audit myself or not audit those areas I deal with, so they never get an internal audit. Chiefinspector "One sole person is not responsible for the management system either" not all company's understand this. Though I know one that soon will. Thanks for the comments everyone. Chris

Management systems need to be adequately resourced Clearly yours isn't When I was with a smallish company Both me (HS & E) and the Q manager were qualified auditors and we did each others areas.

Walker I think you have hit the nail on the head. Yes you may only need one other internal auditor to check on the things you have direct responsibility for. However I am the H&S and Environment and Quality Manager. Again thanks everyone, I thought I understood most issues regarding these external accredited management systems, but this gave me some doubt. They have been running with just the one person since year dot, yet their manual talks about internal auditors. The external auditors seem to have never picked up on this issue and they are a very well known organisation. Just spent the last 4 days being audited for a company I only started with 2 weeks ago, with a management system that seems to be full of holes - what fun.