was successfully added to your cart.


internal audit

Prepare for your mind to be blown!

Well, we think that this is mind blowing – its made us think very differently and we bet you do too once you’ve read this! It’s quite a long read, but stick with it – we promise it’s worth it.

So, what are we talking about?

The topic we’ve chosen to write about in this issue ‘why internal audit training doesn’t work’ covers and touches so many parts of what we do inside the factory setting, including training, the practice of internal audit, management commitment and much, much more so let’s look at internal audit training and how we currently handle it and the options available to us…

Internal Audit Training

We all need to complete internal audits.  To do this, you need to train internal auditors. There are two types of audit training available:

  • Internal auditor training (typically one day)
  • Lead assessor training (typically five days)

So, which training do we go for? Well the clue is in the name and also the fact that it’s normally just a one day course!  We all do the internal auditor training course and there are a few options of internal audit training out there (I’m going to generalise here, so forgive me):

  • eLearning
  • accredited courses (RSPH or HABC)
  • unaccredited courses

Let’s review the internal audit training options one by one…


These courses can range from a couple of hours to perhaps a day.  Many need the learner to read the content of the course.  The AllSafe internal auditing course comes in either distance learning format (reading) or online (reading the text on the screen, or the text on the screen is read to you).  This course is £55 plus vat, so it’s not expensive.  The course covers:

  • “Background and overview of the BRC Standards (Food, Packaging, S&D, A&B)
  • Preparation for audit
  • Preparing and using Audit Checklists
  • Techniques for Obtaining Information
  • System Reviews”

Reference: http://www.allsafe.org.uk/store/#!/Internal-Audit-Training-Distance-Learning-Course-For-BRC-Standards/p/59375890

Looking at the content of the course, you’ll see that it teaches you the basics of how to do an audit, but it doesn’t teach you what to audit.  Once you’ve completed this course, you won’t understand the standard that you need to audit.

Accredited course

These are courses offered by Awarding Bodies governed by Ofqual (who regulate qualifications in this Country).  These courses are delivered by approved training providers, so the cost does vary from provider to provider.

HABC are a popular Awarding Body and they provide a one day, Level 3 Award in Effective Auditing and Inspection. The curriculum for this course covers:

  • “the importance of undertaking effective auditing/inspection
  • the competencies and characteristics of an effective auditor/inspector
  • the importance of a planned approach to conducting effective audits/inspections
  • how to analyse and use evidence collected to inform the audit/inspection process”

Reference: https://www.thetrainingandrecruitmenthouse.co.uk/media/uploads/L3%20Audit%20RQF%20Qual%20Spec.pdf

Again, you’ll notice that this course only teaches what auditing is and how to audit.  It doesn’t teach you anything about the standard or provide the understanding you need, in order to audit effectively.

Unaccredited courses

There are many training providers out there, who can provide unaccredited courses.  One well-known provider is Campden BRI who have a 2-day course, at a whopping £895 for members and £1155 for non-members.

Their course covers:

  • “Purposes and benefits of internal audits
  • Audit planning and preparation
  • Preparation of check lists
  • Interview techniques
  • Auditing skills
  • Quality meetings, audit reporting
  • Corrective actions
  • Audit records
  • Practical auditing activities using short group exercises”

Reference: https://www.campdenbri.co.uk/training/internal-auditing

Even Campden’s 2-day course, still only covers what an audit is and how to do them.  It still doesn’t teach the learner the standard they need to know, in order to able to actually do the audit.

So, why am I telling you all about this?

I’d like you to think about what internal audit means. We know that we need to do internal audits.  Internal audits are one of the most valuable tools we have, to make sure everything is working as it should. We need to train those who do the internal audits, so that they can do them well and pick up things before they go wrong, or before an external auditor finds them. So, why do we train with a curriculum that doesn’t teach the standard that those who carry out internal audit need to know, in order to do the audit properly? It really makes no sense. Now, ask yourself:

  • Would you ask your doctor to check if your boiler was working correctly?
  • Would you ask your car mechanic to give you a health check?
  • Why would you ask your internal auditors, to audit subjects that they have no understanding of?

Let’s go back to the training options and look at the other option…

Lead assessor training

Ok, we’ve learnt that internal audit training doesn’t teach you about the subject you need to audit, it just teaches you what an audit is and how to do it (and to what detail it teaches you this, depends on what course you choose).

The lead assessor training is a 5-day course and this does teach you about the standard.  When you choose a lead assessor course, you have to pick what standard you want to learn about. This could be ISO 22000 or the BRC Food Safety standard – for example.

BRC provide a lead auditor course, which covers:

  • “the background and benefits of the BRC Global Standard for Food Safety.
  • the relationship with other Standards: SALSA, ISO and the GFSI-benchmarked Standards.
  • the fundamental clauses and statements of intent.
  • BRC Global Standards audit methodology, the enrolment program and the unannounced audit schemes.
  • the know how to close an audit and deal with corrective actions.
  • know how reports are uploaded onto the BRC Global Standards Directory and how certificates are issued.
  • the benefits of a BRC Global Standards Directory listing.
  • how certification bodies are monitored for compliance by BRC Global Standards.”

Reference: https://www.brcgs.com/training/courses/

You’ll notice though, even with the course content of the lead assessor/auditor courses, they only provide you with a ‘background’ knowledge of the standard, or detailed knowledge of ‘fundamental clauses’. Plus, when you think about it, we only really send someone on a lead assessor course, when they’ve got to the stage that they’re going to be doing an external audit, such as a supplier audit.  But what’s the point of that? Auditors need to know the standard when they’re doing internal audits, you don’t audit suppliers to the standard, you normally have a much shorter condensed standard to work to.

So, what’s the problem with training?

To me, the training available just doesn’t make sense.  An internal auditor needs to understand the standard from the get go, in order to do internal audits effectively and really challenge our systems.  So, why do we not teach them the standard?

Really, if you think about it, internal auditors should be the most knowledgeable people on site. They need to really know the detail of each part of the standard, because if they don’t – how will they know whether what they’re looking at, is right or not? Why do we send them on a course that only teaches them how to audit and not what they need to audit?  And then, expect them to be able to do it right?

We’re asking a bit much, they’re not super human.

The most common question…

We get asked all the time, variations on the same question – “Our internal audit system doesn’t work, surely there’s a better way of doing audits?” or “My internal audit system doesn’t work, how can I fix it?”

The most common statement…

We do a lot of audits and by far the most common thing we hear when we’re auditing is “Nobody ever picked that up before.”


Hopefully by now, the penny will be starting to drop for you.  One of the reasons (there are more, which I’ll explain later) internal audits don’t work, is because we don’t equip our internal auditors with the detailed knowledge and understanding they need to be able to do audits really, really well. The reason why we pick things up at sites, when we’re doing internal audits, “that nobody has ever picked up before” is because we know the standard inside out.

Internal auditors are your superstars – so think of your audit team this way, as those that protect you from product contamination issues and protect you from non-conformances from external auditors.  Your internal audit system will work much better when you train them, to do the job properly.

Now you’ve read this, here’s a sneak peak at our new video and an introduction to what we’re doing to fix this problem!

I’d love to know your thoughts on this, please tell me if you think I’m wrong. Tell me if your mind is blown – if it’s not, I bet you start thinking differently over the coming days and weeks and as we go deeper into this subject, I bet you change your mind!


  • Amy Brooks says:

    This looks great Kassy!
    The problem we have at my site is that we are a very small business. If as the Quality Manager I was to carry out the internal audits, how would I get away with adhering to clause 3.4.2 “Auditors shall be independent (e.g. not audit their own work). We’ve just had our very first BRC audit and we were using consultants who were supporting me to do the IA’s, however I had more up to date knowledge of the standard but no experience in IA’s and as I am the Quality Department, I would be auditing my own work at times. How do we go forward with this? Do we get someone else to learn how to do IA’s?
    Your advice on this would be greatly appreciated!

    • Nikki says:

      Our site is also quite small, I was the supervisor in the packing department. Our company had the same issue so I was pulled out of the department to audit. So my only job is to audit. I start auditing roughly a month after all the non conformances are closed out from our external audit.. We audit using the standards so I take each element one at a time and make sure we cover it.
      Over the years I have become more involved with the HACCP (I honestly believe I am the only one who really understands how to do it!) so I trained one of the supervisors and he now audits section two. To get round the auditing my own work in the audit section I have trained one of the directors in auditing so she can audit my audits. We have never used external training sources for training as it has always be done internally and this has never caused an issue. In fact last year our auditor stated they had learnt more from me than they could ever learn from a course.

  • Ken Driver says:

    An interesting subject Kassy. In my experience, internal audits are not effective as the internal auditors are trying to audit against the clauses of a standard instead of against their own processes. (in effect trying to replicate what the third party auditor is doing). Third party auditors need to know how to interpret a standard for a specific industry, Internal auditors need to have knowledge of the procedures and standards which have been implemented to meet the third party certification scheme and the audit skills needed to evaluate this. This becomes apparent when you compare the ISO process approach vs BRC clause approach to internal audits. I admit that a clause approach can identify requirements which have been overlooked when first developing the management system but should this be part of the role of the internal auditor? An interesting debate!

  • R Parry says:

    Thank for including a mention of the Allsafe Internal Auditing course in your article. Just to correct your information the latest version updated for issue 8 BRC Standard for Food Safety clearly states what needs to be audited, other reference materials required and the importance of including compliance to polices, procedures and work instruction in the scope of all internal audits. Our on-site course emphasises this even more during the practical live audit component of the course. Our clients very often receive very positive comments from BRC auditors on the depth and detail of their internal audits (unlike most sites) which is testimony that the Allsafe courses provided are effective. With out doubt internal audit is the secret to success on certification and with all our clients AA and AA+ that is all the evidence you need.

    • Kassy Marsh says:

      Thanks for this. The BRC Issue 8 does include what needs to be audited, but it doesn’t explain how to ‘translate’ that into what it means. The interpretation guide helps, but it doesn’t go into enough detail to be able to do it really well. We would also like to be able to provide a really comprehensive eLearning version of the course, which as you say only normally is provided when you teach an inhouse course.

Leave a Reply