Internal audits are an important aspect of certification and are required by several provisions of the R2 Standard. Provision 1.c requires an internal audit of a facility’s conformance to each of R2’s requirements. Provision 3.a.3 requires facilities to periodically audit their compliance to all applicable laws and regulations.
In order for internal audits to be effective, they must be conducted by someone with the right competencies. The auditor must have the knowledge and experience necessary to understand the R2 Standard’s requirements, and to evaluate whether the company is meeting those requirements. An administrative person without such knowledge and experience cannot do the audit.
Facilities may find it necessary to have multiple internal auditors – each with their own area of competency. For example, an internal auditor with competency to audit to R2’s requirements may not have the competency to audit the health & safety requirements of RIOS or OHSAS 18001. Likewise, an R2 or EH&S auditor may not have the knowledge to effectively audit data security requirements.
An effective internal audit can help avoid non-conformances with requirements of the R2 Standard that may result in suspension or revocation of your certification(s). Utilizing a competent internal auditor also can minimize the risk of violations and monetary penalties from regulatory authorities.
Competency of the auditor can be achieved through training, hands on experience, and ongoing education. SERI recommends that R2 internal auditors take SERI’s Advanced R2 training webinar and exam. This is a detailed, 5-hour review of all R2 requirements. SERI also recommends that an internal auditor complete a training course on the fundamentals of auditing.
The knowledge base for an internal EH&S compliance auditor is different than that of an internal R2 auditor. An EH&S auditor is expected to be knowledgeable in areas such as storm water management regulations, air quality, respiratory protection, noise, powered industrial trucks, etc. In the United States, formal OSHA training can provide a good start for compliance auditors. Internal EH&S compliance auditors will also benefit from a basic course on the fundamentals of auditing.
The required competency for an internal auditor will vary from organization to organization, depending on the complexity of the organization’s scope and legal requirements. When determining who will be conducting internal audits, it is helpful to create a matrix of the requirements, including various regulations applicable to the organization, and determine who has the qualifications to audit each area. It may be that a single person within your organization is qualified to audit all areas, or it may be that multiple auditors (either internal or external) with different areas of expertise are needed.
The bottom line: you must be able to demonstrate to your Certifying Body auditor that your internal auditor(s) understands how the requirements of R2 and EH&S Standard(s) apply to your specific operation, and is able to identify any non-conformances that may exist.