Outsourced Internal Audits Delivered by Independent Auditors

Outsourced internal audits give an organisation internal audits delivered by qualified, independent auditors against its management system standard, and itmad provides them for organisations that itmad does not certify. itmad is a certification body: ISO/IEC 17021-1 prohibits a certification body from performing internal audits for an organisation that it certifies, and itmad applies that rule strictly. itmad uses local auditors and a travelling team. itmad operates across the Middle East, Asia and Europe. Last reviewed: October 2026.

The requirement

Every management system standard requires internal audits at planned intervals, covering every clause and every process across the cycle. Most organisations know the requirement and most struggle with it, not because it is hard but because the people competent to audit a department are usually the people who work in it.

The independence problem

The standard requires auditors not to audit their own work. In a small or medium organisation that is often impossible: the quality manager wrote the procedures, the operations manager runs the process, and nobody is left who both understands the work and is independent of it.

The result is an internal audit programme that exists on paper, produces no findings of substance, and is written up as a non-conformity at the certification audit, usually with the observation that the internal audits missed what the external auditor found in a day.

Where itmad can and cannot act

Under ISO/IEC 17021-1 a certification body may not perform internal audits for an organisation that it certifies, and itmad applies that rule strictly: where itmad holds an organisation's certification, itmad does not conduct its internal audits in any capacity.

Where another body holds the certification, which is the case for most organisations that need outsourced internal audits, there is no conflict. itmad auditors bring the competence used in certification work without the certification relationship that would compromise independence. itmad audits as thoroughly as the organisation's own certification body will, and has no incentive to find the system compliant. An organisation that might later seek certification from itmad should say so before commissioning internal audits, so that impartiality can be protected.

What a programme includes

The programme is planned to cover every clause and process across the cycle, weighted by risk, by previous findings and by change in the organisation, instead of repeating the same schedule each year. Audits are carried out on site to ISO 19011 principles, sampling objective evidence and interviewing at the levels where requirements are actually met. Findings are classified by severity with the evidence recorded, written so that they can be acted on and not just logged.

itmad then follows up corrective action to verify that it addressed the cause and was effective, not merely that a form was closed, and consolidates the results in the form that the standard requires as an input to management review. For multi-site organisations, auditing is coordinated across dispersed sites with consistent criteria, so that results can be compared between locations.

Standards covered

Programmes are delivered against any management system standard, including ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22000 and HACCP, ISO 22301, ISO 50001, ISO 41001 and ISO 37001, and for integrated systems that cover more than one standard. Where an organisation holds several, integrated internal auditing covers the common clauses once.

When organisations outsource

Organisations outsource where no internal auditor can audit a function without auditing their own work; ahead of a first certification, where a completed internal audit is required before Stage 2; between certification cycles, to keep the programme running instead of compressing it before surveillance; where sites are too dispersed to audit with internal resources; after an internal audit non-conformity at a certification audit; where the people who ran the internal audit function have left; and to supplement an internal team in technical areas where it lacks competence.

Related audit services

Where the audit is of suppliers and not of the organisation's own system, supplier audits cover that. Where an organisation needs a gap assessment ahead of certification and not a recurring programme, pre-assessment applies.

Frequently asked questions

What are outsourced internal audits?

They are internal audits delivered by qualified, independent auditors against an organisation's management system standard. The auditors deliver the full programme, with findings that stand up at the certification audit.

Can itmad perform internal audits for an organisation that itmad certifies?

No. ISO/IEC 17021-1 prohibits a certification body from performing internal audits for an organisation that it certifies, and itmad applies that rule strictly. Where itmad holds an organisation's certification, itmad does not conduct its internal audits in any capacity.

Why do organisations outsource internal audits?

The standard requires auditors not to audit their own work, which is often impossible in a small or medium organisation, because the people competent to audit a department usually work in it. An outsourced programme provides independent auditors who understand the work.

Which standards do the programmes cover?

Any management system standard, including ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22000 and HACCP, ISO 22301, ISO 50001, ISO 41001 and ISO 37001. Integrated systems are audited together, so the common clauses are covered once.

When should an organisation commission outsourced internal audits?

Where no internal auditor can audit a function without auditing their own work, ahead of a first certification that requires a completed internal audit before Stage 2, and between certification cycles to keep the programme running. Also after an internal audit non-conformity at a certification audit.

What if an organisation might later certify with itmad?

It should say so before commissioning internal audits, so that impartiality can be protected. Where itmad certifies an organisation, itmad cannot perform its internal audits.