Awareness, implementation or internal auditor
Three levels of training, what each one is for, and how to tell which one a person needs.
Awareness means understanding a standard and your part in it. Implementation means building and running a control. Internal auditor means checking that the system works inside your own organisation. Everyone in scope needs awareness, the owners of a process need implementation, and only the people on your internal audit schedule need the auditor course.
Updated · 4 minute read
The three levels side by side
Awareness answers what a standard asks of me. Implementation answers how to build and run a control. Internal auditor answers whether our system works. Each level has its own courses, and a person needs only the levels their job actually uses.
The levels stack. An implementation course assumes the person knows what the standard asks, and an internal auditor course assumes they know how the controls are meant to run. Skipping a level does not save time; it moves the missing learning into a course that was not built to teach it.
| Level | Who needs it, and the ITF courses at that level |
|---|---|
| Awareness | Everyone inside the scope of the system. The one-day awareness courses for ISO 9001:2026, ISO 14001:2026, ISO 45001 and ISO 22000, plus the food handler, general safety and cybersecurity awareness courses. |
| Implementation | The owners of a process, a plan or a register. HACCP, risk assessment, document control, COSHH, permit to work, root cause analysis, corrective action, FSSC 22000 and AI in operations. |
| Internal auditor | The people on your internal audit schedule. ISO 9001:2026 internal auditor and ISO 45001 internal auditor, two days each. |
How to tell which one a person needs
Ask whether the person will audit. If they will not, they need awareness, and implementation too if they own a process, plan or register. If they will audit your own organisation's system, they need the internal auditor course, ideally after awareness.
Owning a process is the test for implementation. The person who signs the risk assessments, keeps the document master list, runs the HACCP plan or issues the permits needs the course that teaches that control. A person who works under the control needs to know it exists and why, which is awareness.
Being on the audit schedule is the test for internal auditor. Seniority is not. A production manager who will never audit gains little from two days of audit technique, and a junior quality officer who audits every quarter needs them.
- Will not audit, owns nothing: awareness
- Will not audit, owns a process or register: awareness, then implementation
- Audits inside your organisation: awareness, then internal auditor
Why awareness comes before the auditor course
An internal auditor tests a system against a standard, so they need to know the standard first. The auditor course opens with a clause refresher, but it is a refresher: two days of audit practice are wasted on someone learning the clauses for the first time.
The same logic runs across a whole site. Train the auditors before anyone has read the standard and the first internal audit finds that nobody knows what the standard asks, which the auditors could have been told for less. Awareness for the people in scope, then implementation for the owners, then the audit layer, is the order that makes each course land.
Two mistakes we see in who gets sent
The first is sending a supervisor to internal auditor training when they will never audit, which spends two days on a skill they will not use. The second is training auditors before anyone has read the standard, which is why awareness comes first.
Both come from choosing a course by how senior it sounds. The fix is to write down, for each person, what they will sign, own or audit, and pick the level from that. That list is the start of a training matrix, and it is the document an auditor asks for under clause 7.2.
Asked when choosing a level
Is an internal auditor the same as a lead auditor?
No: lead auditor is a different qualification, for people who lead audits of other organisations, and an internal auditor does not need it to audit inside their own.
How many internal auditors does a site need?
No standard sets a number. The standards ask for internal audits that are objective and impartial, so the practical minimum is enough trained auditors that nobody audits their own work. On a small site that often means two people auditing each other's areas.
Does the internal auditor certificate expire?
No. The ITF certificate of completion records a course on a date, and that record does not go out of date. When an auditor needs refreshing, for example after a standard is revised, is your competence decision and belongs on your training matrix.
Can one person take awareness and the auditor course in the same week?
Yes, if the awareness day comes first. On site we can run the awareness day for the wider group and keep the auditors back for the two auditor days that follow.
The courses at each level
ISO 9001:2026 awareness in one day
What the new edition asks of ordinary jobs, for the people an auditor will interview.
Read moreInternal audit · 2 daysISO 9001:2026 internal auditor, two days
Two days that end with delegates writing nonconformities that hold up.
Read moreInternal audit · 2 daysISO 45001 internal auditor training
Auditing safety where the record says one thing and the floor says another.
Read moreBy roleTraining by role
Six jobs, each with the courses and levels that person needs.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
Tell us the person, and we will name the level
Send the job title and what the person signs, owns or audits, and we will say which level and which course fits before you book anything.