Internal audit: how do you keep auditors independent in a small company?

ISO 19011 asks that auditors do not audit their own work. In a company of forty people, the person who knows enough about procurement to audit it is usually the person who runs it. The options are training someone from an unrelated function and accepting slower, shallower audits, swapping auditors with a friendly company in the same sector, or buying in an external auditor for the areas where independence is impossible. All three have been used by clients of ours. Which have you tried, and did the certification body accept it without argument?