Certification Readiness & Internal Auditor Training
Neksus builds the team competence to understand the standard and run internal audits per ISO 19011. An independent certification body performs the certification audit, and we prepare your people to face it.
4.9/5 · 287 reviews
300+ clients nationwide
2,000+ trainers
1 to hundreds of participants
Standard · Premium · Private 1-on-1
2,000+ trainers and experts
Our group's teaching network, matched to what your team needs.
Neksus prepares your team for ISO standards, from awareness through internal auditor. 6 active tracks, each tailored to participant experience and your audit schedule.
An organization's ISO certificate is issued by a certification body, after its auditors have checked that the organization's management system runs the way the standard requires. Neksus does not issue ISO certificates. Our role sits before and around that audit: preparing the people inside the organization so they understand the standard, apply it in their daily work, and are able to check it themselves through internal audits.
This part is easy to miss. Many organizations prepare their documents neatly, then get a surprise when the auditor walks onto the floor, asks a staff member directly, and hears an answer that differs from the written procedure. A management system lives in people's habits, and those habits are built on a shared understanding at every level of the organization.
That is why the training on this page comes in two kinds. Awareness training for the people who run the system, and internal auditor training for the people who check it from the inside. Both can be delivered without a special permit, because what we do is train. The conformity assessment itself remains the work of the certification body.
Foreign-owned companies: when the ISO certificate belongs to the group
Many foreign-owned companies in Indonesia operate under a certificate held by the parent company or a regional office. Here is how a local site fits into that arrangement, and what it means for training.
A group certificate usually covers several locations under one multi-site scope. The certification body samples the sites it visits in each audit cycle, and a local site can be selected for a visit even when head office handled the previous one. The local people still have to answer the auditor's questions about their own processes, their own records, and their own corrective actions. A certificate held elsewhere does not move that conversation out of the Indonesian site.
In practice, the group's policies, manuals, and procedures arrive from abroad, often in English, while the people who carry them out in Indonesia work in Bahasa Indonesia. Awareness training here translates the group system into the daily work of the local team: which records they keep, which procedures apply to them, and how to explain what they do to an auditor in plain terms. Internal auditor training for a local team gives the site its own capacity to check itself between group audits, so findings surface before the certification body arrives.
The certification body behind a group certificate is usually accredited in the country where the group holds it. A certification body operating in Indonesia may instead be accredited by KAN (Komite Akreditasi Nasional), Indonesia's national accreditation body. Ask which accreditation the certificate carries, because a tender or a regulator in Indonesia may ask for that detail, and the answer decides whether the local site can rely on the group certificate for that purpose.
Mixed teams raise the question of language. A regional manager may expect sessions in English, while most of the floor team works better in Bahasa Indonesia. We discuss the mix of participants at the start, and we confirm which trainers can teach the standard in English before a format is put forward. Where a program needs both, the options include separate sessions per language group, English materials with delivery in Bahasa Indonesia, or a trainer comfortable in both. What is available for your standard and your dates is confirmed in the written proposal.
Local regulations sit beside the ISO system. Indonesian occupational safety law, administered by Kemnaker (the Ministry of Manpower), runs its own track of certified K3 training, which is occupational safety training delivered by PJK3 providers, the companies licensed to deliver it. An ISO 45001 certificate does not replace those obligations, and an auditor expects the site to know which local requirements apply to it. The same pattern appears with local rules on personal data, environmental reporting, and public procurement. For certified K3 training we connect you to a licensed provider. For the ISO side, we train your people.
One more practical point. The group's quality or HSE function usually owns the certificate and the relationship with the certification body, while the Indonesian site owns the training budget and the audit date on the ground. Bring both into the first conversation, so the program follows the group's audit calendar and the site's working hours at the same time.
The certificate's scope statement, and whether the Indonesian site is listed in it by name and address.
Who the local PJ is (the penanggung jawab, meaning the officer accountable for the management system), and who at head office they report to.
Which documents are controlled centrally and which the site may adapt, so training uses the version the auditor will read.
The language each participant group works in, from the regional manager to the shift supervisors.
Which standards are usually pursued, and by whom
The list below sets out the standards organizations pursue most. Each standard has its own page, linked from its name.
Almost every kind of organization: factories, service providers, hospitals, schools and universities, and public agencies that want their service to be measurable.
Most common triggers
A customer or tender that requires it, complaints that keep repeating, and a leadership wish that the way of working no longer depends on one or two people.
What is trained
Process-based working, control of documents and records, handling nonconformities, and continual improvement.
Organizations with physical work risk: manufacturing, construction, energy, logistics, and healthcare facilities.
Most common triggers
An accident or a near miss, client requirements, and the wish to bring separate safety programs into one system.
What is trained
Hazard identification and risk assessment, worker participation, incident investigation, and internal audit of the system. Certified K3 training under the Kemnaker scheme is delivered by licensed PJK3 providers, and we connect that need to one of them.
Banking, technology service providers, logistics, and organizations whose services cannot stop for long.
Most common triggers
A major disruption that has already happened, client requirements, and the need to show readiness for disasters or system outages.
What is trained
Business impact analysis, continuity strategies, recovery plans, exercises and tests, and internal audit of the system.
The road to a certificate, step by step
This sequence applies generally to management system certification. How long each step takes depends on the size of the organization and how far the system is already running.
1
Choosing the standard and the scope
Leadership decides which standard to pursue and which departments or locations fall within scope. This decision determines who needs to be trained.
2
Mapping the gap from today
The organization looks at what already runs and what is still missing against the standard's requirements. The result becomes a work list, including the training needs.
3
Building a shared understanding
Awareness training for leaders, process owners, and staff, so everyone understands why the system is run and what their own part in it is.
4
Running the system in daily work
Procedures are used, records are kept, and nonconformities are handled. The system needs to run long enough before the audit so there is evidence to examine.
5
Preparing and running the internal audit
A trained internal auditor team checks the system from the inside, reports its findings, and follows up the fixes. The guideline commonly used for auditing management systems is ISO 19011.
6
Management review
Leadership reviews the internal audit results, the system's performance, and opportunities for improvement, then decides on the follow-up.
7
Choosing a certification body
The organization selects a certification body accredited for the relevant standard and business sector. In Indonesia, accreditation of certification bodies is granted by KAN, the national accreditation body.
8
The certification audit and what follows
A certification audit usually runs in two stages: a readiness and document review, then an audit of implementation. After the certificate is issued, the certification body carries out periodic surveillance audits during the certificate's validity, which is commonly three years.
Who needs which training
Awareness training is for the people who run the system: the leaders who set direction, the process owners who write and maintain procedures, and the staff who work with those procedures every day. For leaders, the session is usually short and focuses on the responsibilities and decisions the standard asks of them. For staff, the session focuses on what changes in their work and how to answer an auditor's questions honestly.
Internal auditor training is for a small group of people who will check the system from the inside. They are usually chosen from different departments, so nobody ends up auditing their own work. In this training they practice drafting an audit plan, interviewing, gathering evidence, writing clear findings, and following up corrective actions.
Lead auditor training, for people who want to audit on behalf of a certification body, is a separate track with its own scheme and its own providers. This page does not cover it.
The role of leadership, and why leaders are trained too
ISO management system standards written on the common clause framework reserve one clause for leadership. There, top management is asked to demonstrate commitment: set the policy, make sure the objectives line up with the organization's direction, assign roles and authorities clearly, provide resources, and review the system's performance at regular intervals.
During a certification audit, the auditor usually interviews leadership directly. The questions are simple and hard to answer without preparation: what are this system's objectives this year, how does leadership know they are being met, and what decisions came out of the last management review. Answers that only point to the management representative or the consultant signal that the system has not yet become part of how the organization is led.
That is why we recommend a short awareness session for leaders, separate from the staff session. It covers the responsibilities the standard asks of them, how to read an internal audit report, and how to run a management review that produces decisions. Two to three hours is usually enough, and the effect is felt across the whole system, because staff follow what their leaders treat as important. For regional managers based outside Indonesia, this session can be timed around a site visit or held online together with the local leadership team.
What awareness and internal auditor training cover
This outline helps you judge whether a program answers your organization's need. The order and depth are adjusted to your standard and your work processes.
Awareness training
Purpose
Everyone within scope understands why the system is run, what the standard asks of their department, and how their daily work becomes evidence for the auditor.
What is covered
The intent of the standard and its key terms, the organization's policy and objectives, the processes and procedures that concern the participants, the records they must keep, how to report problems or nonconformities, and what happens when the auditor arrives and starts asking questions.
How it is taught
Examples drawn from the participants' own processes, practice in answering audit questions with evidence, and discussion of the work habits that need to change. For leaders, more of the time goes to the responsibilities and decisions the standard asks of them.
Internal auditor training
Purpose
A group of people in the organization can check the system from the inside in a way that is fair, planned, and evidence-based, then write findings that can be acted on.
What is covered
The standard's requirements from an auditor's point of view, audit principles according to ISO 19011, building the audit programme and the audit plan, preparing checklists, interview and observation techniques, collecting and weighing evidence, writing findings, the closing meeting, and following corrective actions through to closure.
How it is taught
Audit simulations on processes that resemble the participants' work, practice in writing findings from evidence provided, and feedback on how participants ask their questions. Participants are usually asked to draft an audit plan for a department in their own organization.
If the organization pursues more than one standard
Many organizations run several standards at once, for example quality, environment, and occupational safety. The newer ISO management system standards are written on the same clause framework, so the policy, document control, internal audit, and management review can run as one integrated system.
For training, this means one internal auditor team can be trained to check several standards in one audit, and awareness training can be organized by work process, so the parts shared by several standards are taught once. Mention every standard you are pursuing or planning to pursue in the first conversation, so the program does not repeat the same material three times. Groups often add standards in sequence, and a local site may join a certificate that already combines two or three. The same approach keeps the local training from growing with each addition.
Questions auditors commonly ask staff
A certification body's auditor reads the documents, then walks to the workplace and asks the people who run the process. The questions below are typical examples, and good awareness training prepares staff to answer them honestly and with evidence.
What is the organization's policy for this standard, and what does it mean for your daily work?
What do you do if you find a product, a service, or a situation that does not conform?
Where are the records for this work kept, and who checks them?
How do you know the procedure you are using is the current version?
What is the most important risk in your department, and how is it controlled?
When did you last receive training for this job, and what is the evidence?
If there is a problem or an incident, who do you report to, and what happens next?
Which of these procedures come from head office, and which were written here at the site?
What commonly slows a certification audit down
Documents are written neatly by one person or a consultant, and the staff who do the work do not recognize what is in them. When the auditor asks on the floor, the answer differs from the procedure. The way out is a shared understanding built through awareness, and procedures written together with the people who carry them out.
The internal audit is run as a formality shortly before the certification audit, with a checklist that only verifies whether documents exist. As a result, the real findings first appear in front of the external auditor. A trained internal auditor checks implementation and asks the people doing the work.
Corrective action stops at correction. The faulty item is fixed, and nobody looks for the cause, so the same finding returns at the next audit. Good training teaches how to find the root cause and close a finding with evidence.
The management review is not recorded, or is held without the inputs the standard asks for. Leadership has in fact already discussed performance in its routine meetings, only without linking it to the system. This part is often resolved by adjusting the agenda of a meeting that already exists.
The system has not run long enough before the audit, so the records and evidence of implementation are still thin. Scheduling the training early gives the system time to produce that evidence.
Group documents are adopted without local adaptation. A procedure written for a plant in another country refers to roles, forms, or regulations the Indonesian site does not have, and the auditor finds the gap in the first interview. Awareness training for process owners is where those procedures are read against local reality and marked for adjustment.
Common formats and durations
Awareness for staff usually runs half a day to one day, and can be repeated in waves so that work does not stop. For leaders, a shorter session is often enough. Internal auditor training usually runs two to three days, because audit simulations and practice in writing findings take time.
Training can be held at your office, online, or as a combination of both. Audit simulations come alive most when run face to face at a location where the process can be observed, while awareness for many branches is often more practical online. For several standards at once, the program is arranged so the same material is taught once. For sites with mixed-language teams, the language of delivery is settled before the format, as described in the section on group certificates above.
An example program sequence for an organization starting out
This sequence is an example, and the real shape is built from your scope, your headcount, and your audit schedule.
1
Leadership session
Two to three hours with the board or the unit heads: leadership responsibilities under the standard, the objectives to be achieved, and how the management review will be run.
2
Process owner awareness
One day with department heads and the people who write procedures: reading the requirements, mapping each process, and agreeing which records will be kept.
3
Staff awareness in waves
Half a day per wave, so work keeps running: what changes in daily work and how to answer an auditor's questions with evidence.
4
Internal auditor training
Two to three days for a team chosen from several departments, with audit simulations on the organization's own processes.
5
First internal audit
The team runs its first internal audit. On request, a review session afterwards goes through the findings and how to close them with evidence, before the management review.
Keeping the system alive after the certificate is issued
The certificate marks the start of the surveillance period. During its validity, the certification body visits for surveillance audits, and at the end of the period there is a recertification audit. Between those visits, the system has to keep running and keep being checked from the inside.
Three situations usually call for further training. New staff need to be introduced to the system from the start of their employment. The internal auditor team needs renewing when members move or leave. And when the standard is published in a new version, the organization needs to understand the changes before the transition period ends.
How to choose an ISO training provider
First, ask who the trainer is and where their experience comes from. A trainer who has run or audited a management system in a real organization can answer participants' questions with examples, and that is what makes the material feel close to the work.
Second, ask for a description of the simulations and exercises. Internal auditor training that only explains the requirements, with no audit simulation, rarely produces auditors who are ready to ask questions on the floor.
Third, make sure the material uses the current version of the standard and is adapted to your organization's processes. Case examples from a factory do little for hospital staff, and the reverse is just as true.
Fourth, be clear about the provider's role. A training provider trains your people. The certification body assesses the system and issues the certificate. A provider who promises that you will pass the certification audit is promising something outside their authority.
Fifth, for a site inside a group, ask how the provider handles procedures that arrive from head office, and in which language it reports training outcomes to the regional function that owns the certificate.
What to prepare before contacting us
The standard you are pursuing, and whether the organization is already certified or just starting.
The scope: the departments, locations, or services included in the certification.
The date of the next certification or surveillance audit, if one is already set.
Headcount per group: leaders, process owners, staff, and candidate internal auditors.
The results of the last internal or certification audit, if any, so the training answers its findings.
The budget range you are working with. We shape the program to fit that budget.
For a site under a group certificate: the certificate's scope statement, who at head office deals with the certification body, and the language each participant group works in.
Frequently asked questions
Does Neksus issue ISO certificates for our organization?
No. An organization's ISO certificate is issued by a certification body after a certification audit. Neksus prepares the people in your organization through awareness and internal auditor training, before and around that audit.
We have no plan to get certified. Is this training still useful?
Yes. Many organizations use ISO standards as a framework to tidy up the way they work, without pursuing a certificate. Awareness training helps the team understand that framework, and internal auditor training gives the organization the ability to check its own processes regularly. If one day a customer or the parent company asks for a certificate, most of the foundation is already running.
When should the training take place, relative to the audit date?
Awareness training is most useful at the beginning, before the system starts running. Internal auditor training should be completed well before the certification audit, so the team has time to run an internal audit and leadership has time to hold a management review.
We are already certified. Do we still need training?
Often, yes. Especially when the internal auditors change, when a finding keeps returning in surveillance audits, when new staff join, or when the standard is published in a new version.
Can the training be adapted to our industry?
Yes. Case examples and audit exercises are built from your organization's own work processes, so a factory, a hospital, and a public agency receive different exercises even when the standard is the same.
How many internal auditors do we need?
It depends on the scope and the number of processes. The principle we hold to: an auditor does not audit their own work. That is why the internal auditor team is usually drawn from several departments, so every process can be checked by someone from another department.
Can all of the training be delivered online?
Awareness works well online, especially for many branches. Internal auditor training can also run online, with simulations that use documents and recordings of the process. Where possible, one face-to-face simulation session at the workplace makes the practice of observing and questioning far more vivid.
Our standard has just been published in a new version. What do we need to do?
Learn the changes first, then adjust the system before the set transition period ends. Update training is usually shorter, because it focuses on the parts that changed and their effect on your organization's procedures.
What about certified K3 training under Kemnaker?
Certified K3 training, the occupational safety training required by Indonesian law, is delivered by providers licensed as PJK3, and the certificates are issued under the Kemnaker scheme. Tell our team about that need, and we connect you with a licensed provider.
How much does the training cost?
Price is driven by how many people are trained, how many standards are in scope, and how many awareness waves are needed. There is no published price list. Share the funds you have for the certification year, and we lay out a training sequence that fits them, set out in a written proposal.
Our certificate is held by the regional office. Can we train only the Indonesian site?
Yes. The training is scoped to the people at the site, and the group certificate stays where it is. What we ask for is the scope statement of that certificate and the name of the person at head office who deals with the certification body, so the local program lines up with the group's audit calendar and its document control.
Can the sessions be delivered in English?
Sometimes. It depends on the trainer available for your standard and your dates. We check that availability before we propose a format, and for mixed teams we often suggest separate sessions per language group, or English materials with delivery in Bahasa Indonesia. The language of delivery is confirmed in the written proposal.