Hi Cove
i have a confusion
" i found out an audit report without any Non conformance. Just some observations which is included, indeed, some NCs. when i asked about the NC and why i wasn't highlighted to the auditees. I receive the answer that as well as this is the first time this area was audited and there is no procedure written, the Auditor prefered to not give them a Non conformance and told me that in the next audit, he will verify the observation and in case of it wasn't fixed; he will issue a Non confomance.
Is it allowed to proceed like this. i know that when you don't have a procedure or any evidence to audit against it; we should audit the process.
if this is the first audit in one area; is it okay to take it like this :confused:
thank you in advance
:thanx:

Just another example of ineffective internal audits. Likely, due to people being thrown in the internal audit process without being competent for performing the tasks at hand.

Hello Selena, I have some questions.

Was this an internal audit?

If there is no procedure for the process, is a procedure required by the standard?

Which standard are you auditing against?

Were the observations written against element(s) of the standard? If so, which ones(s)?

What were the write-ups for?

Hi ladies and gentlemen
sorry for the late

Jennifer; it was an internal audit. these area was audited against the standard ISO 9001, good practice of the organization and the procedures relating to this process. The procedures required by this standard is documented but our issue remain the huge resistance when we deployed the procedure.
This is the reason that some people present when they get this kind of behave as described in this thread. When i asked the auditor why there is no NC presented as this to the auditees; he explained to me that they prefer sometimes to take it easy and prefer to let something in order to win the important thing, mean the deployment of procedure first and they think that they won't get nothing if they make it tough since the first step. The method worth what it's worth :frust:

The elements of the standard concerned is in the chapter 7.2, mainly the 7.2.1 & 7.2.3 and many points relating to how the presentation of the goods to the customer and marketing.
I hope that it is more clear

I want to highlight one point, i wanted to know if there is any reason which can justify to not show the NCs to the auditee ? :confused:

Hi Selena,

For me is not logical. Why do they do internal audit?
If they find nonconformities or observations (opportunities for improvement- or whatever you call them in your internal audit procedure) the auditee is the first to be informed because “The management responsible for the area being audited shall ensure that any necessary corrections and corrective actions are taken without undue delay to eliminate detected nonconformities and their causes.”

I think that your auditors must be retrained.


Off Topic I also have XY chromosomes inside:)

Alin

Hi Al
The procedure of audit is correct; and they informed the auditee durant the closing meeting about the NC detected, not as NC; but as observation which should be improved :notme:

I'm Agree that some retrainning is requested

I would agree with Alin....a nonconformance or observation should be viewed as an opportunity to improve and not as being too tough. By taking the 'easy' approach, the importance of the audit findings may appear diluted....it's always better to find a nonconformance internally than have an external auditor find it.

Sandra

I hope I have understood everything correctly.:)

You have procedures in place that upper management has approved. An internal auditor found objective evidence that the procedures are not being followed. Instead of documenting and issuing the non-conformance, they... simply don't. The reason is due to "pressure" and such.

1. The internal auditor should always call it like they see it. If there is an NC, it should be issued and acted upon. There will always be interpretations and such in auditing, but if the evidence is there, it should be responded to.

2. If the procedure is bad, rewrite it. If it is not necessary, remove it. But if management agrees it needs to be in place, then they should be notified when the organization is not following it.

If this NC is soft-peddled, so will the next one, and so on. I believe Internal Auditing can be one of the strongest components of any quality management system, if it is correctly embraced and utilized by management.:)

Now in fact we have some new procedures in registration audits.
In the first audit (1st visit), which mainly documental auditing, the auditor will not write any nonconformance. He will only write the situation founded without the word nonconformance.
In the 2nd visit (normally 2 weeks after the first visit), it’s a normal audit.

I agree with Brad. :agree1:

Here was a very telling point: The procedures required by this standard is documented but our issue remain the huge resistance when we deployed the procedure. You later suggested the auditors need to be retrained. I would like to caution you against a hasty move toward correcting auditors' behavior. Instead, it seems there is a cultural force that they hesitate to press against. A retraining could do more damage than good, if they feel they are being somehow punished for something not in their control. :whip:

It's time to back up and revisit the procedure. If it is not correct for the overall needs, change it. If it is correct but receives no departmental support, I suggest the auditors may not be the people who need "retraining."
:2cents:

This type of situation is possibly caused through the auditor not doing a complete job of auditing! We haven't found out, yet, if what the people are doing is causing any problems or not, regardless of what the procedure says.

I'm always concerned when I read the audit was against 'the standard'. This isn't good criteria for an internal auditor to use. It should be they're auditing the qms documentation. Furthermore, if the auditor had determined that there is resistance to the procedure, then maybe it's because of the way it's written or introduced to people. We can't tell from what's reported.

The auditor should be reporting the facts - not 'grading' findings to ameliorate the situation. Call it like it is (as Brad says) - this is one of the downsides of 'allowing' auditors to 'grade' findings! It shouldn't be there call. The 'grade' comes from the nature of what's reported!

I agree with Jen, that 'retraining' isn't likely to be worthwhile. What are you going to 'retain' on - the same behaviours? I think the way you select criteria and scope may be part of it, plus the amount of planning and how that's done needs scrutiny. Just arming the auditor with the standard etc. is not going to work!

Did anyone ever coach this auditor to know how to audit? Just being in a training class isn't sufficient to get an effective audit.

In the first audit (1st visit), which mainly documental auditing, the auditor will not write any nonconformance. He will only write the situation founded without the word nonconformance.
In the 2nd visit (normally 2 weeks after the first visit), it’s a normal audit.That is what ISO 17021:2006 prescribes for Stage 1 and Stage 2 audits.

I agree with Brad. :agree1:
Instead, it seems there is a cultural force that they hesitate to press against. A retraining could do more damage than good, if they feel they are being somehow punished for something not in their control. :whip:
:2cents:

Good point about the cultural force....Sandra

That is what ISO 17021:2006 prescribes for Stage 1 and Stage 2 audits.


Yes Sidney, in fact that’s what registrars now have to do.
In the case of one Organization that is to be audited having a poor QMS, this new procedure might be good.
On the other hand for an Organization that has a great QMS this is no more that a total waste of time.
I faced this situation last week, on the first stage audit there were no notes. On the second stage audit, the auditor has nothing more to see…
:notme:

I faced this situation last week, on the first stage audit there were no notes. On the second stage audit, the auditor has nothing more to see…It seems that the auditor does not know what s/he is doing.

Not sure what you mean by "no notes". A documented report from Stage 1 audit is a requirement.

Hi cove
i'm agree with you Brad and this is why i notified this issue here. for to be more a clear the problem is that the procedure is correct and approved by management but as Jennifer said " Instead, it seems there is a cultural force that they hesitate to press against." and honestly this idea that the cultural force is enough tough that it make audits or any others component which can have an effect on the Quality Management
system is frustring me :mad:. and here i will ask you to read, if it isn't already done, one very exciting thread that i issued before called "corporate culture" and i wish if Wes can reply here :cool:

http://elsmar.com/Forums/showthread.php?t=30493

Inderstang me, if you are aware that there is any kind of resistance and you accept to let some procedure or some of their manner in order to be gentle and permit to, indeed, this culture to stay confort, what will be the gain of to established one QMS and use some components whitout to benefit of their result, what we will win? :confused:

"A retraining could do more damage than good, if they feel they are being somehow punished for something not in their control. " I didn't htink about this possibility !!! when i approuve the suggestion of retrainning, it was just in the idea to correct some manner ..etc. But you are right to suggest that others have to be retrained.

ISO 17021:2006 is relating to the certification and the first stage before the certification, does its guidelines is working for an internal audit?!
"Did anyone ever coach this auditor to know how to audit? Just being in a training class isn't sufficient to get an effective audit." good point Andyn, the trainning was done internally and as i know no coach. You know how it is the trainning in general, read together the standard

Selena:

It's so good to see you come here with problems and see how our advice is helping you! It's very gratifying to know we help, even so far away...

Your comment is very interesting. I have made similar comments when talking about ISO/IEC 17021 that the 2 phase approach could be used to such advantage in an internal audit situation.

Why can't internal auditors spend time with the management of the process they are to audit, to check for 'readiness', understanding of the scope, criteria etc? It would certainly help to ensure a much more successful outcome than we get today!

Try it - you might like it!

the trainning was done internally and as i know no coach. You know how it is the trainning in general, read together the standard

The outcome required of any effective training isn't just that the people were simply 'trained', it's that they are assessed as competent.

If I have understood what you said correctly, it seems to say that the training consisted of reading the Standard together. Just doing that that really isn't enough for effective training, nor for your auditors acquiring real competency. And 'retraining' them the same way? :nope: Won't work.

It sounds like there may be issues on both sides of the equation...

Good morning Cove

you are welcome AndyN, i will tell you , of course the Cove is master in sharing and learning and also sometimes, i start a thread just to inform about some behave; discrepancy ...because i know that many Folks here are member in the revision or whatever organizations of the standards and this is my manner to notify, if usefull, about this facts even from so far, in order to contribute :)

About the approach of ISO 17021, my inderstanding of that is when we ask for a certification, The QMS is enough implemented and we know that the comments issued from the first step is important to be fixed and it is enough to be commited to it.
Now concerning the internal audit, as you said your self, this is component to be used effectively in order to get the best outcome, this is why i asked if is allowed to use the 17021 approach.

Why can't internal auditors spend time with the management of the process they are to audit, to check for 'readiness', understanding of the scope, criteria etc? It would certainly help to ensure a much more successful outcome than we get today! Jane This method is used as usual as possible and also the Quality manager try to be involved in the meetings of departement , sites to remember them again and again what should be done; the outcome is " yes ,yes you are right, i'm agree with you and so" after no feedback :confused:

But you are right to spend time and time on these.

I think that the commitment of the Top mangt have lot to do here. I'm not saying that there is no documented and communicated commitment or so;
I will tell, the Quality objectives is included in the descriptif poste of folks, but the deal is , what does this realy mean? during the annual evaluation; the question is : the manager of each will focuse on the responsability relating to the function and the quality ones separatly and with different level of focusing or it will be mixed and revaluated as one set ? i don't know if i explained enough or correctly my opinion

"If I have understood what you said correctly, it seems to say that the training consisted of reading the Standard together. Just doing that that really isn't enough for effective training, nor for your auditors acquiring real competency. And 'retraining' them the same way?" yes, this is kind of reading an audit; answering to the questions and also somme training audits; but as i read in one thread here; what about coaching and assisting a person until to feel her competent.
Let focuse on this point; after trainning and one obeservation audit; you can participate in audit and after 3 , you can be a responsible, but what about what product "these training audits" as Additional value. i mean more than following up the requirement of ISO 19011
.for example; if i get a participation in one audit , which is so classical , if i can use this word. No special situation will occur which can let me see what to do ( as instance: auditing an activity which don't have a documentation; get some :mad: behavors....etc) i'm sure that you can remember some situations which was not linear. I4m aware about this, what about the novice on this activity?
You are right to say that the retraining won't work in these case.
:agree1:

It seems that the auditor does not know what s/he is doing.

Not sure what you mean by "no notes". A documented report from Stage 1 audit is a requirement.

Of course there was a report on the stage 1 audit. What I meant with “no notes” was that as on the stage 1 the auditor can’t write nonconformances (just “notes”),
The QMS I was talking about, although new, was almost perfect.
So, to audit it twice (1st stage and 2nd stage) was a complete waste of time.
In fact, knowing that this was going to happen, we asked the Registrar that the two stages were made on continuous days, but unfortunately the auditor’s schedule didn’t allow it…

I've seen this before at a company I worked for. There is so much pressure to maintain certification, and so much riding it on it that its hard for inside people to be objective or even honest. Gary

The QMS I was talking about, although new, was almost perfect.
So, to audit it twice (1st stage and 2nd stage) was a complete waste of time.
In fact, knowing that this was going to happen, we asked the Registrar that the two stages were made on continuous days, but unfortunately the auditor’s schedule didn’t allow it…

Antonio:

You're looking at it from a different point of view than that of the CB auditor. They didn't know 'its perfect' (hard to believe, frankly) before the visit. The auditor is not auditing the system twice, by doing a two stage audit! The first stage is a planning and preparation activity, a 'readiness' review. Did you know that's the purpose? Who was it a waste of time for? Just reading a manual and procedures (remotely) before hand was never an effective way to prepare for a CB audit. The auditor is supposed to evaluate other issues before the stage 2, which can really only be done on site.

There is a 'Heads Up' advisory to CB's in the USA about why they shouldn't be doing 'back to back' stages like you wanted. It might not have been just his schedule!

At the core of the issue is the lack of buy-in of the procedure.

When doing an audit, if a discrepancy is found between the procedure and what's actually being done, the discrepancy needs to be somehow noted. All that does is point out there is a disconnect. No one is getting slapped, no one should be sent to the guillotine. It's just someone noticing things are not being done the way the document says. Auditors need to be empowered to perform this very simple, and crucial service. If they are not, the entire audit program could lose credibility... maybe the QMS also.

Once that a discrepancy is acknowledged - and it should be very easy to agree on this basic fact of QMS life - the question becomes one of what to do to align the process document and what is actually going on.

If the document is unclear, is unrealistic, is too strict, or offers no flexibility where some could be allowed, it's possible the document could be changed to match what is really going on.

If, however, activities are being allowed or promoted that do not conform to either the process document, customer requirements or the standard the QMS is built upon, the problem is different, and arguably more serious than an auditor not writing a nonconformity. Section 5 in the standard addresses responsibilities.

Does your audit process say all nonconformances will be addressed as such when found in an audit? If it does, now that you have noticed this issue you should assign a CAR to your own audit process.

As part of the containment action to resolve your own nonconformance, if the previously unassigned nonconformances are important you can issue them and pursue the problem of the process buy-in at that point. If the first level responsible person does not agree with the nonconformance, then the next higher up shold be drawninto the conversation. And so on.

In this way the onus is removed from the auditor - the issue of pressure has been "elevated" to management (you).

As a long term fix, you would need to ask yourself a series of hard questions.

1) Does the auditor have support of the auditee?
2) If so, is the auditor suitable for the work?
3) If so, what kind of remediation is needed?

If #1 is No, then questions #2 and #3 are moot for this immediate issue; the main issue is not clearly one of auditor behavior. Address #1 and then ask the series of questions again.

Understand that performing successful audits requires the ability to perform successful Crucial Confrontations (http://w2.byuh.edu/alumni/chapters/documents/crucial_confrontations.pdf). (I am not affiliated with the makers, VitalSmarts) It can take some time for a diplomatic person to develop this ability and the confidence to use it, if he or she ever can.

I have a paper titled When Employees Don't Follow Procedures here (http://elsmar.com/Forums/showthread.php?t=12122).

I hope this helps!

Thank you
My lady for this wonderful post.
Just FYI, as requested, the audit procedure is correct as you described
I will surely read the docments attached
:thanx:

There is a 'Heads Up' advisory to CB's in the USA about why they shouldn't be doing 'back to back' stages like you wanted. It is available @ 145. Time Interval Between Stage 1 and Stage 2 Audits (http://www.anab.org/HTMLFiles/docs/HeadsUp/HU145.pdf)

Antonio:

You're looking at it from a different point of view than that of the CB auditor. They didn't know 'its perfect' (hard to believe, frankly) before the visit.
.../...


In some Organizations this 1st stage and 2nd stage method is a total waste of time!
The trouble here is that people generally consider that the registrar is almost God in the knowledge of the standard requirements and implementation.
That is not true!
There are people working in some Organizations that know much more about the standard and the function of a QMS than any person in any registrar!
For example we’ve been working (full time) with ISO 9001 since 87, is it not expected that we are able to implement an almost perfect QMS?

:topic:

Re: Stage 1 and stage 2 audits (really ought to be a separate thread!)

Gentlemen, I think both of you make some excellent points. While I agree with Sidney (and the ANAB guidance) that in general, and in most cases, the stage 1 and 2 should not be 'back to back' and should have a reasonable amount of time elapse between them, I think António has some valid points.

I think there can be a case for this to occur, but only on very, very, very (did I say very?) rare occasions.
But the ANAB (and other countries') guidance specifically allows for these occasional exceptions, provided that the client is clearly informed of the attendant risk, and presumably clearly informed by the certifier that it is neither their recommended nor their preferred mode.

Bottom line, if António is strongly convinced in a particular case that he/they are better informed than the certifier, and everyone communicates clearly - I think he has a right to go ahead.

That it's 'often' or 'frequently' a waste of time to have stage 1 and stage 2 time-separated, I strongly disagree with.I cannot think of an occasion where I would advise a client to do it, in fact, quite the opposite. I invariably advise and make sure clients do have a reasonable gap between - and that's even when I'm confident (based on very solid experience and many, many certifications) that this one will also succeed.

Jennifer,

Very, very good post. You have accurately homed in on the core issue:At the core of the issue is the lack of buy-in of the procedure.

and provided excellent clear advice. :applause: