Hello all.

I am a little peeved. One of my internal auditors quit. I had a feeling she might. She's currently involved in a bit of a political thing with management. She hasn't really been doing her audits (i've noticed). But she leaves me in a bit of a bind because the other 2 auditors are the quality manager and I. We can't audit the areas we give to the Quitter because we are responsible for them. What can I do? I have a maintenance audit in a couple of months. I know that I have to train another auditor, but meanwhile back at the ranch....

Any suggestions?
:ko: :mad: :ko: :mad: :ko: :mad:

See if your local ASQ chapter has an audit consortium and see if someone from there needs audit hours or simply contract it out.

If there is a time element that is borderline where you think you can get someone trained but the audit will be a month or two late - call your registrar and see if they'll 'be understanding'.

8.2.2 does not set a requirement for 1 year audit minimums - QS-9000 does. Whilst some auditors might try to attack you citing another clause - don't let them. There is no set audit frequency. It is quite normal for audits to be postponed for one reason or another.

Some thoughts on this can be found at http://Elsmar.com/Forums/showthread.php?threadid=2390

Another good one is http://Elsmar.com/Forums/showthread.php?threadid=2392

Another thread you might find enlightening is http://Elsmar.com/Forums/showthread.php?threadid=2296

One specifically on schedules is http://Elsmar.com/Forums/showthread.php?threadid=2257

Firegirl,

How have your previous maintenance audits gone? If the areas she audited have a pretty good history, then I don't think you should have too much trouble. Just explain the situation to the auditors.

Is there someone else in the company sho can step up (at least temporarily) and do the audits? It has been my experience that most, reasonably intelligent people can be taught the basics of a process audit in a fairly short time.

I'm sure others will have better input, but I hope this helps.

James

:bigwave:

Fire Girl,

Remember one thing, internal audit can be done by an outside auditor. Nowhere does it say the internal auditor must be employed within the company.

If you are in Ontario I am close to you and could help you if you e-mail me.

I have encountereed many companies that are contracting internal audit due to the pressure of taking time from employees that are better used in other areas of their expertise.

Even an internal auditor has a "built in" bias in my opinion.

Say I am the internal auditor and my best friend is the manufacturing manager, how much bias is going to influence the audit. At best zero, but usually a certain percentage.

Hope this helps!

Fire Girl,

Maybe I can drive up from Connecticut to help on your audits:biglaugh:
Anything to help out a "buddy":bigwave:
Then again, maybe not.:thedeal:
Select from within. Give them a short quiz. Like, what's your name, Anyway? Do dogs bark? Do bears .... in the woods? What's down the road, a piece? :ko: No, all kidding aside: It's management's problem. Someone has to step up. Post for volunteers and you may get a surprise. Failing that, Mgt. has to "appoint" the lucky candidate.
:smokin:

energy

Where are you? I've been waiting for 2 days for you to come and help me audit!! You'd better be here soon........ or else you'll have to be punished.... :ko:

I know it's managements problem, but I still have to be the one to explain to my auditor why audits are not completed or why they are behind or whatever. Believe me, when I have an auditor in the house, my management team is goodness knows where.:(

Oh well. I guess I'll just suck it up and come up with something.

Later.

Peace out.:cool:
Fire Girl

Fire Starter
In my previous life, I worked in a place very similar to yours. It was a sheet metal stamping house fabricating brackets and stuff for the Aircraft industry. At one time we had 10 people trained, by an outside accredited institution (ha ha), but they were always too busy to do their assigned audits. I simply placed them on “reserve” when needed. We were able to conduct audits with half the people. They were actually hurt that they weren’t needed. Management did not give anybody the option of not becoming an auditor, they were assigned, but they also put product before the auditing and allowed the system to deteriorate to the point that all one had to say is that they were too busy for auditing and it was allowed. Take someone from your office with a good history for accuracy and “assign” them. After all, my understanding of ISO, is that it is everybody’s responsibility, not just yours. Take a load off, kick back and put your feet up on the desk and delegate, delegate-dance to the music! :smokin:

A quick scan of the thread didn't reveal what I thought was the obvious answer.
The difference between 1994 and 2000 in auditing is that you are now given the latitude to audit your own area, just not your own work. Surely that allows you to cover the audit schedule until you get at least one more auditor.

If you get an external audit against 1994 then point out that you are moving towards the 2000 standard, it gives you that latitude to do this, plus you are following the resource requirements guff in the standard (get something recorded in some minutes so you can wave it in their faces as objective evidence that management has come to this solution). At worst they'd call it an observation.

Hope it helps.

Originally posted by Fire Girl
energy

You'd better be here soon........ or else you'll have to be punished.... :ko:
Promise or threat? :thedeal:

We have a similar situation at our place - EVERYONE too busy to audit after trainng (top management sees to it they are too busy and endorses the practice)

My current solution - hired outside auditors to complete the cycle for this year... - when auditing 4.17 the lack of internal resources and managements decision to use outside auditing to complete internal audits was documented & sigened off by "the powers that be". :thedeal:

The final result will remain in the hands of our external auditor who "strongly suggested 5 to 6 "active internal auditors should be made available during the last external audit.


"time will tell":lick:

> our external auditor who "strongly suggested 5 to 6
> "active internal auditors should be made available during
> the last external audit.

Why not just keep farming them out? I do internal audits for several local companies. Once a year. I go in, do the audit, write and submit the report and one of the VP's is responsible for CA, etc. They've never had an internal auditor. The registrar checks to see they followed up on my CAs and I check to see they followed up on the registrar's CAs (as if the regisrtar didn't already - I still re-check). I'm there 6 months after the registrar (they're on 1 year cycles) - so either the registrar or I are there every 6 months. No muss. No fuss. For many companies this is an appropriate way to go. Apparently you've found someone local. Go with it. Save yourself a headache every year.

Thanks for all the great advice guys!

DAvid Mullins- Here's the deal. I'm still in ISO 9K:1994. So auditors cannot audit areas for which they are responsible for.

Marc- That is a promise- you want pics?

energy- I have convinced management to assign the HR girl in the office. She's perfect (don't tell her I said that) for the job! None of the things she does is covered under the Standard.


But now I have another question- I would like to train her myself for the interim so I can get her to help me get caught up on audits. I intend to send her out eventually to get training at our registrar. Do you think internal training will be acceptable for the interim, even though my other auditors were trained outside? Any ideas?

Thanks again!

Fire Girl
:biglaugh: I'm losing it!!

Internal training is OK. You're the trainer - train. I have done internal auditor training for a number of clients. They then use the files from my course and do their own internal course with it.

Auditor question: How do you demonstrate competence after training? I use a test and observation of their setting up and doing an internal audit - most of my larger clients pair a trainee with an 'experienced' auditor for an audit or two.

Fire Girl why would you have to send her out to be trained to do audits. There is nothing wrong with doing it internally. In fact I would be more than willing to share with you training material I have which I used to train internal auditors at our company. You would have to change things up a little but it should work. Let me know.
:smokin:

Fire Starter,

We had teams for the "new" internal auditors. They had to perform X amount of time with an experienced auditor until such a time that they could get the External training. That doesn't really help you because of the limited amount of Auditors you have. But, it looks like there are some auditors in this forum available and willing to travel up there to assist you for a modest fee. Or maybe it's the punishment you will meter out if they don't show. Kick me, pinch me, stomp me. No whips please!:lick: :biglaugh: :smokin:

I got this in an e-mail and figured I'd add it...

> Marc,
> Just a quick question you stated that you do internal audits for companies and
> they are on a yearly cycle. Do the Registrars of these companies find this
> adequate? The only reason I ask is that if they are finding problems during
> surveillance audits then internal audits should be occuring more frequently or
> if the CAPA system shows a problem area then that area should be audited more
> frequently. Just wondering???

One time an auditor from a registrar questioned my audit. He said since I found no non-compliances he had reason to believe my qualifications were not adequate. Of course, I was called by my client after the audit. I pointed out that his audit revealed 1 minor and that the previous visit by one of the registrar's auditor (surveillance) revealed no findings. So - how could he determine my audit was deficient by reason of having found nothing 'something' when the company's auditor before me found nothing. The 'finding' was dropped.

How many findings an auditor finds is really a company dependent thing like so many other things. If the company has an internal discipline problem, then minors will be found - an example being employees not completing forms (such as leaving out the date). Look to the findings to determine what the problems are. As opposed to the 'not completing documentation' minor, how about 'not keeping up with corrective actions' or 'corrective actions not acted on in a timely manner'. Ask yourself - is this part of my company's personality? Is it a function of the size of the company? What are the registrar's auditors finding that the internal audits aren't?

> if they are
> finding problems during surveillance audits then internal
> audits should be occuring more frequently or if the CAPA
> system shows a problem area then that area should be
> audited more frequently.

As far as frequency goes, you have to look at your findings. If I saw a consistent problem in an area I would point it out and possibly recommend a re-audit in 6 weeks or something. If the registrar saw it, and then I again saw it 6 months later I might argue for 'more frequent auditing'. To me it's really more of an issue in the corrective action system, however, if the same things keep popping up.

But again - companies have personalities. Some keep the corrective action system very tight and everyone is 'into it'. In other companies the corrective action system is little more than a constant source of internal friction.

So far, the clients I have run pretty tight ships and findings are not easy to come by.

As a reminder: Go back to what your registrar told you. Just because they don't find anything doesn't mean there aren't problems that they may find in a later audit. An audit is a SAMPLE and does not guarantee every problem will be identified (this is their main legal out when it comes to responsibility).

I would be looking at the internal findings and comparing them to the external findings and see how they compare. And remember - your auditors are no better than a registrar's auditors. Just because they find nothing doesn't mean there are no problems. They, as well, are just doing a SAMPLE. Bottom line is check and be able to answer this question:

Are our internal audits effective, and if not why?

Note that when I go in we do all the audits. In, do it, out and report. Most companies which do their own spread them out due to manpower issues.

I know we've had some good discussions here on Auditing Frequency. Do a Search here in the forums - and maybe on the site proper - using those key works --> Audit Frequency

Do you have a procedure that addresses IA selection and training? If you do and don't want to update it to accomodate 'temporary IAs' how about writing a deviation to cover for the period?

We ran into similar problems, however our registrar stated as long as we can show that the IA doesn't have 'primary' responsibilities...then they can audit. For instance...we also just had an auditor removed for not performing the audits as scheduled...unfortunately that left the QA Manager performing the IA on 4.11 (calibration). Even though the QA Manager does have 'associated' responsibilities...it's the QA Auditor that has 'primary' responsibility, so it is okay! We also have very clear and detailed audit records to substantiate 'objectivity' of the IA. And remember that by using a 'team' approach, the other team member can ask even an 'associated responibility' question by the IA changing roles for that portion of the audit.

We've had 2 different registrar auditors tell us the same thing about this topic. It origionally came up when I first joined the company and asked how could an IA possibly audit element 4.17? and promply arranged for the Corp QA Mgr to audit (hehehe, you shoulda heard the groans I got when I announced that locally) this element the next time he was visiting our site. When it was brought up later to the registrar, he gave the response above and we've handled everything internally ever since with no problems.

Originally posted by Fire Girl


Marc- That is a promise- you want pics?


Fire Girl
:biglaugh: I'm losing it!!

Marc gets a promise and Pics?:confused:
Not fair!:smokin:

I KNEW I was walking the thin line posting that in public...

The one that always gets me is the statement on a finding that " the method for XXX in unclear" ****, he was the one that performed the desk audit, the assessment audit that passed, and the "unclear" statement came during a surv. audit.

I did not make a friend of him when I asked why it was "unclear", it was clear to the 11 people at the table.

Maybe he was fishing, but don't fish in my pond unless to bring the game warden with you.

Sorry, sour mood today, out of work!:bigwave:

Eileen

I got nailed on my last audit for auditing Internal Auditing element. Up until I wasn't really doing any audits except that one element. My reasoning was that my internal auditors shouldn't be auditing their own work. However, my registrar felt that if I was responsible for internal auditing than I shouldn't be auditing it. So now I just get an auditor to do it.

Sorry energy- don't take it personally.:p

So if I train my own auditor, as long as I can show competency thru a quiz or modelling or something, than that should be totally acceptable, right guys?

Ok. Thanks

Fire Girl is on Fire

David Mullens,

“The difference between 1994 and 2000 in auditing is that you are now given the latitude to audit your own area, just not your own work. Surely that allows you to cover the audit schedule until you get at least one more auditor.”:)
Cute kid in the avitar. No, not you.:rolleyes: I hadn’t paid attention to the difference between the 2 standards before. Thanks for the reference. Now comes the rub:

1994 Version”…shall be carried out by Personnel independent of those having direct responsibility for the activity being audited.”

2000 Version..”Selection of auditors and conduct of audits shall ensure objectivity and impartiality of the Audit Process. Auditors shall not audit their own work.”

My “work” here is, among other things, administer and monitor the Internal Auditing process. Fire Starter is in the same boat. She is responsible for the Internal Auditing, therefore it is her “work”. I don’t believe that a department manager can audit his/her department just because they do not perform actual work in it. That does not ensure impartiality.

It appears to be a parsing of words, like what “is” is. Responsibility and work mean the same thing to me, with respect to Supervisors and Managers.

But, I been made to see the light before, so let’s hear from others. :ko: :smokin:

Energy,

Agreed, I could audit myself all day and audit my audit staff all day. As a management rep I could audit management. Is there a bias there, **** tooting. Even if it is not overt.

Keep the impartiality for the sake of internal processes and harmony, no matter what a manual, specification, or ruling allows. It's good business/management practice.

I have also found that the best way to do it is to go with an outside auditor. It costs alot less than having internal auditors.

Let me re-phrase that, dam tootin!

> So if I train my own auditor, as long as I can show
> competency thru a quiz or modelling or something, than
> that should be totally acceptable, right guys?

You're walking a fine line. I don't think I'd object to an auditor working for you auditing your work.

> 2000 Version..”Selection of auditors and conduct of audits shall ensure
> objectivity and impartiality of the Audit Process.
> Auditors shall not audit their own work.”

The Bold text is the key phrase.

I wouldn't object to an Inspector auditing Quality functions, including the Audit System as it pertains to my own work. Would I be able to audit Inspection & Test when it's my responsibility to ensure we have a procedure in place to comply with the standard? Would I be able to audit the Internal Auditing function when it's my responsibility to maintain it? Do I have to have intimate contact with the procedure daily for it to be considered my work? I don't think so, but as Dennis Miller says, "I don't want to go off on a rant here, but it's just my opinion and I may be wrong!":smokin:

Focus on the word DO when you think of 'Their Own Work'. If you do it, you can't audit it. Being responsible for and doing *can* be, and often are, different. I may be responsible for the audit system by my role is to ensure people are doing their audits, etc. I can't see a problem in one of my auditors auditing my to my job responsibilities. They don't do what I do and their activities under me are from where the sample would be taken - as such they're incidental.

How's that for rationalization? :thedeal:

Originally posted by Marc

How's that for rationalization? :thedeal: Like trying to press down on a marble coated with grease:bigwave: :smokin:

Energy,

1. It's MULLINS

2. If Greg Mack were here, as he pointed out in a thread earlier this year (which I couldn't find), one person companies can prepare, review and approve documents, so why can't they audit themselves to determine the state of compliance of their business. This compliance is then confirmed via external audits.

3. If we followed your thinking, the factory manager couldn't audit anything anywhere in the factory. Don't you have a part to play in the quality of products/services being delivered, therefore you can't audit any of those areas? And on it goes.

4. See that corner you've painted yourself into? Either sit quietly 'til the paint dries or take the walk of shame (I assume you have 'the weakest link' in the US).

i agree with the aussie bloak.......As an auditor, i would like to see that you audited yourselves (to stay within the schedule), and added another audit to the schedule, for when you have a new trainee, or have the trainee tag along to "keep it honest' if you think its necessary....present the evidence clearly to show no bias taken.....a clear comprehensive audit is obvious to an auditor.

for the interim, you gotta do what ya gotta do, as long as there is a plan and not a pattern......and you are upfront about it, not an after thought.

I strongly agree with Al...outsource the audits ......its the most economical:cool: :cool:

"1. It's MULLINS"

David, Sorry about the misspelling! Man, you don't know how sorry I am.

David says:
2. "If Greg Mack were here, as he pointed out in a thread earlier this year (which I couldn't find), one person companies can prepare, review and approve documents, so why can't they audit themselves to determine the state of compliance of their business.

I call that running your business the best way you know how. Not conducting an audit. By your definition, I start auditing when I note the condition of my car, the working status of my computer, traffic intersections on the way to work. People always assess situations, like a “one person company” would do, but, are they “auditing” as I thought I knew it? I have my doubts, now, because of your brilliant interpretation of “auditing”. Why have Auditor training? Heck, it’s easy!

David says:
"This compliance is then confirmed via external audits."

Exactly, because you can’t prove compliance, even though YOU say they are auditing. Do you now make your Registrar your Internal Auditors?

David says:
3. "If we followed your thinking, the factory manager couldn't audit anything anywhere in the factory. Don't you have a part to play in the quality of products/services being delivered, therefore you can't audit any of those areas? And on it goes."

Again, that’s what a Factory Manager does. Run the business. He/She are continuously assessing ways to improve production, increase profit, manage personnel, etc. How this results in a written audit report to show compliance escapes me. But then, that was before my world was shattered.

David says:
"Either sit quietly 'til the paint dries"

I use quick drying paint, so it isn’t as long a wait as you think. I also don’t water it down or put in on with a mop and bucket.

David says:
"or take the walk of shame"

Hazard Warning: Rose colored glasses should never be worn continuously.

David says:
"(I assume you have 'the weakest link' in the US)."

That may very well be, but is still stronger than the best links manufactured anywhere else. :biglaugh:
:smokin:

And if it were manufactured in Texas it would be the biggest link, and if manufactured during the Nixon years it'd be the missing link.....

At the end of the day we need to satisfy the requirements of the standard and the needs of the company and customer. It's the compliant manipulation of the standard to meet the company's and customer's needs that makes us great managers of quality.

Outsourcing audits is fine, it's just a shame that you lose the learning potential gained from having your own staff conduct audits. On the flip side, I'm sure Barb and Marc would inject some education during the course of their audits, so we'll put this down to swings and roundabouts (I hope this aussie language isn't confusing you guys). So you can win either way.

Originally posted by David Mullins
Outsourcing audits is fine, it's just a shame that you lose the learning potential gained from having your own staff conduct audits.

David,
Our company of 44 people has trained “staff” in Internal Auditing from outside sources. They are the CFO, Human Resource Manager, Materials Manager, 2 Engineers, MIS –System Administrator, 2 Manufacturing employees and myself. (Lead Auditor)
We just have to be aware of “conflicts of interest". It’s not a hard thing to do with this many auditors. These people were “selected” by the GM because of the amount of detailed accurate information they process. The production personnel selected also have shown a lot of attention to detail. They will be valuable auditing Management functions where we determine there may be a problem with “closeness” to a particular procedure.

And, I like the “swings and roundabouts” description. Keep posting, Aussie Bloke.
:smokin:

the best of both worlds is a partnership with the consultant doing the auditing, and accompanying them with your own personnel....works well for all involved....less time and $$$ invested and everyone wins.....

auditing is best left to people with an auditing mind.....nice if you have some in house, but they are few and far between..or too busy.

My last company just took from existing staff a coupla part-time auditors as decided in a MR forum.

How do you think I became involved in quality?

Who can audit the audit process? [Warning—Long post]

1994 says: “…and carried out by personnel independent of those having direct responsibility of the activity being audited.” The question here is who does the word “those” relate to. If “those” equals the auditor, the auditor cannot audit areas he/she is responsible for. If “those” equals auditee, the auditor must be independent of that person. You can’t audit your spouse, boss, or charges. (my interpretation)

9K2K says: “ensure the objectivity and impartiality” Kinda takes care of the second “those”. “Auditors shall not audit their own work.” Clearly takes care of the first “those”.

Now the point, if there is one. Who audits the audit process is a question that has been around as long as I’ve been in this business. I have posed this question to countless registrars (okay, they can be counted, but you might have to take off your shoes). Here is their collective response. The audit process needs to be free from bias. If the lead auditor, management rep, or other person can show evidence that the audit process is meeting the objectives, then there is no problem. The check is simple. If the internal audit is finding nothing, but external audits are finding bad things, the audit is probably not working. Relying strictly on the third party audit of 7.17, or 8.2.2 does not give a clear indication. Comparing what internal audits find, globally, with what external audits find give a much clearer indication.

I would never be afraid to audit my audit process.

Dave B (the other Dave) ;)

The answer, if there is one.
Get your worst or least experienced auditor to audit the internal quality audit program.

WHY?
S/he needs the practice/experience.
You can personally monitor and appraise their performance and offer guidance (after audit completed - not during).
You already know if there are any weak points in the audit program, so you don't need a super auditor to set you straight (I hope).

All that is true, although never looked at it quite like that?????

AND the registrar will look very closely at your audit program anyway ...so yeah.....thats a good idea........

Let me enlighten you all!

Just kidding. I too have harassed my registrar about the age old, "who audits auditing?" The latest answer I have received is that the person who is responsible for internal auditing may NOT audit Internal Quality Audits. BTW we are still ISO 9K:1994. I audited internal auditing and he did not like that because I look after it. He said that he would prefer to see a regular internal auditor do it.

So that's pretty much all I have to say about that. I have a maintenance audit coming up on Friday and I'm freakin' out!

later all

Fire Girl

I agree with barb butrym.

I also want to take a minute and thank Barb. Barb has been around here for a long time and knows her stuff. Barb has helped a lot of people with answers to their questions. She also (a very big thank you!) has expressed her support for the Cove as a Cove Premium subscriber almost from the beginning of the subscription rollout.

Thanks, Barb. I appreciate you more than you know. :bigwave:

In the past I audited one of my customers for "Internal Audits" and she recipricated for me. Registrar had no problem with that.

Originally posted by KenS
In the past I audited one of my customers for "Internal Audits" and she recipricated for me.

You rascal you!:)) :smokin: