QHSE Internal Auditor Training: A Moroccan SME Case Study

What is the starting point of this case study?

An industrial SME certified to three standards, whose internal audit rests on a single person. This case is composite: it brings together situations we often encounter in Moroccan industrial SMEs, without describing a real company. The profile and the calendar are illustrative.

The company manufactures electrical cabinets and steel structures for industry and construction, in the Casablanca–Settat region. It works in two shifts, with a sheet-metal workshop, a paint booth, a wiring workshop and a site installation team. Its customers are manufacturers, general building contractors and a European prime contractor.

Its management system is integrated. It is certified to ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018, with a combined audit carried out by the same certification body. Recertification of all three certificates falls in the first half of 2028.

The QHSE manager runs the system alone. Two internal auditors had been trained several years earlier; one has since left the company, and the other no longer audits for lack of time. The QHSE manager therefore carries out most audits personally, including on document control and the management review, which they lead. At the last surveillance audit, the certification body noted a lack of objectivity in the internal audit programme.

Why train six QHSE internal auditors rather than two?

To cross audits and keep the programme running. With six auditors from six departments, nobody audits their own work, and every process has at least two possible auditors.

Management chose one auditor per department: production, maintenance, purchasing, logistics, sales administration, human resources. The profiles are team leaders, technicians and managers, chosen for their knowledge of the site, their listening skills and their credibility with the teams. Two of them conduct their shop-floor interviews in Arabic, the others in French.

The human resources auditor was given a specific assignment: auditing the QHSE manager’s processes. This is the direct response to the issue raised by the certification body.

What training suits an integrated QHSE system?

Combined audit training, built on the editions in force: ISO 9001:2026, ISO 14001:2026, ISO 45001:2018 and ISO 19011:2026. It was organised in-company, in modules spread over time, with an audit carried out between two modules.

The first module covered the common core: harmonized structure, principles of auditing, audit programme and plan, conducting interviews, writing findings. The second module covered each standard’s specific requirements and how to audit them on the ground: environmental aspects and compliance obligations of the paint booth, risk assessment in the sheet-metal workshop, worker participation. The amended clauses of ISO 9001:2026 were built into the common checklist, in particular quality culture (5.1.1 and 7.3) and the management of changes (6.3).

Between the two modules, each pair audited a real process on site. The final session was devoted to reviewing the findings as a group and presenting them to the process owners. The method for this first audit follows our article on the first ISO 9001 internal audit after training.

The calendar was built backwards from the 2028 recertification. The Global ACI transition document sets the end of the transition at 30 September 2029 for ISO 9001:2026; the document for ISO 14001:2026 sets it at 30 April 2029. The company chose to make both transitions at recertification, after written confirmation that its certification body would have completed its own transition.

How was the training funded?

By entering it in the training plan before it took place, so that it qualified for the planned training rate of the special training contracts (contrats spéciaux de formation, CSF) run by OFPPT, the Office de la formation professionnelle et de la promotion du travail, Morocco’s public vocational training office. The reference rules, those of the CSF procedures manual of May 2006 and its Amendment No. 2 of 2 June 2014, are 70% of the retained cost for planned training delivered by an external provider, within a ceiling calculated on the vocational training tax (taxe de formation professionnelle, TFP) the company declares. The resulting amount is indicative, before ceilings, with no commitment.

Three precautions protected the file. The six participants were enrolled by name, and their absences anticipated: reimbursement is calculated in proportion to the participants actually present. Sessions started only after the period set by the procedures manual. Evidence was produced session by session: QR-code attendance, tests, end-of-session evaluations, numbered certificates and training report. No amount had been promised to management; the simulation gave an order of magnitude, with no commitment.

Support for the transition itself did not qualify for the CSF: it is not a training action. The cost factors for this type of training are detailed in our article on ISO 9001 internal auditor training cost, and the rules on our page on CSF and OFPPT funding.

What did the first cycle of combined audits show?

That a combined audit finds what three separate audits miss. The findings described here illustrate what this type of cycle brings to light.

The manufacturing audit looked at the installation of a new paint line. On the quality side, the change had been planned, but with no effectiveness criterion and no review of its results, which clause 6.3 of ISO 9001:2026 now requires. On the environmental side, the aspects analysis had not been updated for the new products. On the safety side, the risk assessment for the workstation had not been reviewed. One change, three nonconformities, one cause: the lack of a single process for managing changes.

The audit of customer orders, led by the logistics auditor, found that the European prime contractor’s new requirements had not been brought up at the management review. With ISO 9001:2026, the review must include changes in the needs and expectations of relevant interested parties: the gap became visible.

Finally, the audit of the QHSE manager’s processes showed an up-to-date master list but workstation documents in Arabic that had not been revised. The finding was accepted without argument, because it came from a trained colleague rather than from the QHSE manager.

What lessons for a QHSE-certified SME?

Training auditors is first of all a way of sharing out objectivity. The choice of people and the cross-audit matrix matter as much as the course content.

• At least one auditor per department, so that nobody audits their own work.
  
• An auditor appointed for the QHSE manager’s processes.
  
• Combined audit training on the editions in force, with a real audit in pairs.
  
• Interviews conducted in the teams’ own language.
  
• Written qualification of each auditor after their first audit.
  
• Training entered in the plan before it takes place, with evidence produced at each session.
  
• A first cycle of combined audits before the management review and the transition audit.
  
• An upgrade planned for when the ISO 45001 revision is published.
  

For an overview of the training, see our guide to ISO 9001 internal auditor training, and for the system itself our page on the integrated QHSE management system.