Outsourced Internal Audit in Morocco: Rules, Programme, Independence

What is an outsourced internal audit, and what stays with the company?

It is a first-party audit, carried out on the company’s behalf by an auditor who is not one of its employees. The company keeps ownership of the programme, the decisions and the actions; the external auditor plans and conducts the audits assigned to them, writes the findings and checks the evidence of closure.

The framework comes from ISO 19011:2026, the guidelines for auditing management systems. Its fourth edition, published on 27 May 2026, replaces the 2018 edition, according to the ISO page for the standard. Three of its provisions settle the question:

• Internal audit (definition 3.1, note 1): sometimes called a first-party audit, it is conducted by the organization itself or on its behalf. An external auditor appointed by the company is therefore carrying out a genuine internal audit.
• Audit client (definition 3.13, note 1): for an internal audit, the audit client can also be the auditee or the people managing the audit programme. Your management, or your quality manager, commissions the audit, not the auditor.
• Scope of the standard: its introduction states that it focuses on internal audits and on second-party audits of external providers. Certification audits fall under ISO/IEC 17021-1.

This division of roles belongs in the engagement letter.

BRCGS Food Safety Issue 9 sets the same limit for any outside expertise. A site that lacks the appropriate in-house knowledge may use external expertise, food safety consultants for example, but the day-to-day management of the food safety systems remains the company’s responsibility (clause 1.2.4 of the site self-assessment checklist).

When is outsourcing internal audits the right answer?

When the company cannot field, from its own staff alone, auditors who are both competent and independent of the activities audited. The need rarely comes from cost-cutting. It comes from an internal audit that no longer finds anything, a team that is too small, or a standard nobody in-house really masters.

Six situations come up again and again in our assignments in Morocco:

A cannery in the Safi region certified to IFS Food Version 8 and ISO 9001 does not have the same need as a packaging manufacturer near Kenitra certified to ISO 9001, ISO 14001 and ISO 45001. The first needs an auditor who knows KO requirement No. 8 and IFS scoring; the second needs a combined audit that links each finding to the right standard.

Outsourcing is not always the right answer. If your goal is to build lasting audit capability, train your internal auditors first: our guide to ISO 9001 internal auditor training describes the path. The strongest model is often mixed: an external auditor who leads a few audits and calibrates the team, and internal auditors who carry out the rest of the programme. Our article on the cost of internal auditors versus an outsourced internal audit helps you decide.

What do ISO standards and GFSI schemes allow?

All of them allow outsourcing; none of them describes it. They require a programme, competent and independent auditors, findings backed by evidence and actions that are followed up. Those are the requirements against which an external auditor should be selected and evaluated.

ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018

The three QHSE standards each have a requirement on internal audit, built on the same structure. The company must:

• conduct internal audits at planned intervals to check that the system conforms to its own requirements and to those of the standard, and that it is effectively implemented;
• establish a programme that takes into account the importance of the processes, the changes affecting them and the results of previous audits;
• define the criteria and scope of each audit;
• select auditors and conduct audits so as to ensure objectivity and impartiality;
• report the results to relevant management, and retain the evidence.

This summary follows the wording of the 2015 and 2018 editions. The transition document of Global ACI (Global Accreditation Cooperation Incorporated) does not list internal audit among the changes in ISO 9001:2026, and its ISO 14001:2026 counterpart does not list it either; both lists, however, are presented as not exhaustive. The exact wording belongs to the paid ISO standards, which we do not reproduce.

For a system certified to ISO 22000:2018, the standard’s internal audit requirement plays the same role. FSSC 22000 Version 7 adds the site’s quality elements (clause 2.5.9) to the scope of the internal audit.

BRCGS, IFS and FSSC 22000

Food safety schemes are more precise about the programme itself. The table summarises the rules checked in the official texts.

Two details matter in practice. BRCGS also requires a separate programme of documented inspections, at least monthly in open product areas (3.4.4); IFS also requires planned site and factory inspections (5.2). These inspections stay with the site team. And for multi-site FSSC 22000, the certification body assesses internal auditors’ qualifications every year, including the year of experience in the organisation. The scheme does, however, allow their internal auditor training to be provided by the qualified internal Lead Auditor or by an external training provider: the external auditor supports the internal audit team (training, annual calibration, paired audits) without replacing it.

The scheme makes no exception to the one year of experience in the organisation required of every internal auditor in a multi-site group, which the certification body checks every year: this is what limits the place of an external auditor in the internal audit team.

For these food safety audits, ACG draws on the experience of its founder, Dr. Ismail Idrissi, the only BRCGS-registered consultant in Africa and an IFS Food and BRCGS auditor.

What the certification body will do with your internal audits

Read them. According to the ISO/IEC 17021-1 assessment checklist of SADCAS, the Southern African Development Community Accreditation Service, the stage 2 audit covers internal auditing and management review among other things (9.3.1.3), and every surveillance programme includes them at a minimum (9.6.2.2). An outsourced programme must therefore produce evidence a third party can read: a dated programme, reports, findings, verified actions.

How do you build the audit programme following ISO 19011:2026?

Start from the risks and from each standard’s requirements, then fill in a calendar. ISO 19011:2026 (clause 5.1) recommends giving priority to matters with a high inherent risk and a low level of performance, and adapting the programme to the size, complexity and maturity of the management system. It also points to the added complexity of multiple sites and outsourced functions.

According to the standard, the programme brings together its objectives, its risks and opportunities, the scope of each audit, the schedule, the types of audit, the criteria, the methods (remote methods included), the criteria for selecting audit teams, the possible role of observers, the organisation’s context and the relevant documented information. It is entrusted to competent people, monitored and reviewed.

In practice, eight steps:

1. List the criteria. ISO standards, the GFSI scheme, customer specifications, legal requirements: every requirement must find its place in at least one audit.
2. Rank processes and activities by risk. Importance, changes, past results, complaints, incidents.
3. Set the scheduling constraints. At least four dates for BRCGS, IFS coverage within 12 months, production seasons, certification audit dates.
4. Combine where possible. ISO 19011:2026 adopts the principle of the combined audit: goods receipt can be examined at once from the quality, environment, health and safety and food safety angles. The integration method is detailed in our article on the ISO 9001, 14001 and 45001 cross-reference matrix.
5. Build the teams. An external auditor leading, internal auditors working alongside in pairs, each outside their own activities.
6. Choose the methods. On site for workshops, loading docks and construction sites; remotely for a document review or an interview with a distant site, as the 2026 edition allows.
7. Write down the reporting rules. Report format, severity scale, response times, verification of actions.
8. Plan the programme review. At least once a year, with management: actual coverage, recurring findings, frequencies to revise.

An illustrative example for a site certified to ISO 9001:2026 and IFS Food Version 8, to be adapted to your own risks:

How do you guarantee the external auditor’s independence?

In two directions: towards what they audit, and towards certification. An external auditor is not independent by nature; they become independent through the rules you set.

Towards the activities audited. BRCGS is blunt: an internal auditor does not audit their own work (3.4.2). IFS requires auditors who are independent from the audited department (5.1.2). ISO 19011:2026 makes independence the basis of audit impartiality (principle 4.6) and recommends that, where internal auditors cannot be independent of the activity audited, every effort be made to remain objective. Three practical cases follow:

• the consultant who wrote your HACCP plan or your environmental aspects analysis does not audit them: another auditor does;
• if an outsourced QHSE manager runs your system, their own activities are audited by someone else;
• the external auditor does not write the corrective actions they will later verify.

Towards certification. The SADCAS ISO/IEC 17021-1 checklist prohibits a certification body from providing internal audits to its certified clients, and from certifying a management system on which it provided internal audits within two years following the end of those audits (5.2.6). IFS Food Version 8 requires certification bodies to ensure that their auditors have not acted as consultants for, or on behalf of, the company being audited during the previous two years. An auditor who carries out your internal audits therefore cannot become your certification auditor within those periods, and a certification body cannot sell you your internal audits. The detail of each role is in our article consultant or certification body: who does what.

Before assigning an audit, check:

• The auditor has signed a declaration of no conflict of interest with the site and its activities.
  
• They have neither designed nor run the processes they audit.
  
• They will not audit your site for a certification body within the periods set by impartiality rules.
  
• Their firm has no link with any certification body that certifies you.
  
• Confidentiality of the information collected is written into the engagement letter.
  
• The report is addressed to management, not only to the quality manager.
  

What should an outsourced internal audit deliver?

Evidence that a certification body, a customer or your management can read without the auditor in the room. BRCGS requires reports that identify conformity as well as non-conformity, with objective evidence, actions and timescales that are agreed and then verified, and a summary of results reviewed at management review meetings (3.4.3). IFS requires documented audits, with results communicated to senior management and to the persons responsible for the activities concerned (5.1.3).

A useful finding always reads the same way: the requirement, the fact observed, the evidence consulted, the severity. “Nothing to report” on a process that generates complaints is not a result; it is a warning sign the programme manager should look at again.

The steps on the site’s side, from the documents to prepare to the follow-up of findings, are described in our how-to on preparing for an outsourced internal audit. The changes of 2026 and 2027 (ISO 19011:2026, ISO transitions, FSSC 22000 Version 7) are gathered in our article on internal audit requirements for 2026-2027, and a combined programme applied to three plants in our case study of a food group.