Outsourced Internal Audits for ISO Management Systems in Norway

Outsourced internal audits give an organisation internal audits delivered by qualified, independent auditors against the management system standard of the organisation, and itmad provides outsourced internal audits in Norway for organisations that itmad does not certify. itmad is a certification body: ISO/IEC 17021-1 prohibits a certification body from performing internal audits for an organisation that the body certifies, and itmad applies that rule strictly. itmad uses Norway-based auditors and a travelling team, and has worked in Norway for more than 10 years. Last reviewed: October 2026.

The internal audit requirement

Every management system standard requires internal audits at planned intervals, covering every clause and every process across the cycle. Most organisations know the requirement and most struggle with the requirement, not because the requirement is difficult, but because the people competent to audit a department are usually the people who work in the department.

The independence problem

The standard requires auditors not to audit their own work. In a small or medium organisation that is often impossible: the quality manager wrote the procedures, the operations manager runs the process, and nobody is left who both understands the work and is independent of the work.

The result is an internal audit programme that exists on paper, produces no findings of substance, and is written up as a non-conformity at the certification audit, usually with the observation that the internal audits did not detect issues that the external auditor found in a day.

Where itmad can and cannot act

itmad is a certification body, and ISO/IEC 17021-1 prohibits a certification body from performing internal audits for an organisation that the body certifies. itmad applies that rule strictly: where itmad holds the certification of an organisation, itmad does not conduct the internal audits of the organisation in any capacity.

Where the certification is held by another body, which is the case for most organisations that need outsourced internal audits, there is no conflict. itmad auditors bring the competence applied in certification work, without the certification relationship that would compromise independence. itmad audits as thoroughly as the certification body of the organisation will, and has no incentive to find the system compliant. An organisation that might later seek certification from itmad should raise that before commissioning internal audits, so that impartiality can be assessed.

What outsourced internal audits cover

• Programme planningAn audit programme covering every clause and process across the cycle, weighted by risk, by previous findings and by change in the organisation, rather than the same schedule repeated annually.
• Audit deliveryAudits conducted on site to ISO 19011 principles, sampling objective evidence and interviewing at the levels where requirements are actually met.
• Findings and reportingNon-conformities classified by severity with the evidence recorded, written so the finding can be acted on rather than merely logged.
• Corrective action follow-upVerification that action addressed the cause and was effective, not simply that a form was closed.
• Management review inputConsolidated reporting in the form that the standard requires as an input to management review.
• Multi-site programmesCoordinated auditing across dispersed sites, with consistent criteria applied so results are comparable between locations.

Standards covered by internal audit programmes

Internal audit programmes are delivered against any management system standard, including ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22000 and HACCP, ISO 22301, ISO 50001, ISO 41001 and ISO 37001, and for integrated systems covering more than one standard at once. Where an organisation holds several, integrated internal auditing covers the common clauses once.

When organisations use outsourced internal audits

• Where no internal auditor can audit a function without auditing their own work
• Ahead of first certification, where the standard requires a completed internal audit before stage 2
• Between certification cycles, to keep the programme running rather than compressing the programme before surveillance
• Where sites are too dispersed to audit with internal resources
• Following an internal audit non-conformity at a certification audit
• Where the internal audit function has lost the personnel who ran the function
• To supplement an internal team on the technical areas where the team lacks competence

What itmad provides

• An audit programme covering the full cycle, agreed with the organisation before the programme starts
• Audit reports with findings, objective evidence and classification
• Non-conformity records in the format of the organisation where the organisation has one
• Follow-up verification of corrective action
• A consolidated summary suitable as management review input
• Auditor competence records for the certification body of the organisation to examine

Related audit services

Where the audit is of suppliers rather than the system of the organisation, supplier audits cover that. Where the organisation needs a gap assessment ahead of certification rather than a recurring programme, pre-assessment applies.

How itmad delivers internal audits in Norway

itmad delivers outsourced internal audits in Norway through Norway-based auditors and a travelling team.

Frequently asked questions

What are outsourced internal audits?

Outsourced internal audits are internal audits delivered by qualified, independent auditors against the management system standard of an organisation. The auditors deliver the full programme, with findings that stand up at the certification audit.

Can itmad perform internal audits for an organisation that itmad certifies?

No. ISO/IEC 17021-1 prohibits a certification body from performing internal audits for an organisation that the body certifies, and itmad applies that rule strictly. Where itmad holds the certification of an organisation, itmad does not conduct the internal audits of the organisation in any capacity.

Why do organisations outsource internal audits?

The standard requires auditors not to audit their own work, which in a small or medium organisation is often impossible, because the people competent to audit a department are usually the people who work in the department. An outsourced internal audit programme gives independent auditors who understand the work.

Which standards do itmad internal audit programmes cover?

itmad delivers internal audit programmes against any management system standard, including ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22000 and HACCP, ISO 22301, ISO 50001, ISO 41001 and ISO 37001. Integrated systems covering more than one standard are audited together, so the common clauses are covered once.

When should an organisation commission outsourced internal audits?

Organisations commission outsourced internal audits where no internal auditor can audit a function without auditing their own work, ahead of first certification where a completed internal audit is required before stage 2, and between certification cycles to keep the programme running. Organisations also commission outsourced internal audits following an internal audit non-conformity at a certification audit.

Does itmad use auditors based in Norway?

itmad uses both Norway-based auditors and a travelling team for internal audits in Norway. itmad has worked in Norway for more than 10 years.