Alternative Internal Audit Methods - Seeking Enlightenment

[Denis9001 - 2007]

CliffK

I don't know whether filling Form 123 is important (sorry silly example I know) but IF it is not important it should not be defined in the system and won't be audited then. You can't have things in your system and then start to say "ah that's important and that's not". If you have such cases then the system should make clear.... fill in the form at your discretion or if time permits.

You seem to be suggesting that if the manager is meeting his objectives then how he does it is up to him. In practice that may be the case, in that managers have authority to decide how they do things BUT the system must be defined and documented. So in that case all the manager needs do is change the system to say Form 123 is optional or not needed.

[CliffK]

Denis9001,

The audit report is reviewed by top management at the management review, who will then initiate actions. Correct?

Good point. That is the theory we all teach and preach, isn't it? I fear it does not work that way in practice, however.

In my experience, poor management teams find a way to ignore, gloss over or excuse ingrained dysfunctional behavior, no matter how glaring it is to a truly independent observer. I suspect a good management team will not have the need to react to bad internal audit reports in the management review.

And how likely is a registrar to withdraw registration? Not very, I think, in the light of increased competition and commoditization of registration.

[Denis9001 - 2007]

Benjamin28

Didn't fully understand your situation but no matter. It would seem you have good (high efficient and maybe even failsafe controls) combined with very good personnel. Great but let's not forget the standard is generic and every company may not be in the same fortunate situation as you.

The fact remains how do I know you are doing what you should be doing. Do you want me to just take your word for it? Does your financial auditor take your accountants word for it because he's a good and honest man? It may well be that the nature of your system means it's impossible not to follow the system. Great, we just need independant verification that's true and then thats your audit.

[Denis9001 - 2007]

CliffK

Yes your 100% right that the theory and practice aren't the same. But isn't that true of everything. Let's not forget 9001 is a model and a basic framework. It doesn't pretend to be the perfect answer.

Whether management reacts to the auditor report is up to them. If they feel it's a minor thing then (maybe) no problem. It depends what Form123 was. If that document called for a customer signature on a million dollar order maybe they would like to know they are at potential risk. If it's a meaningless form (as many are) then the problem is who the hell designed the system with meaningless forms.

I'm an auditor with a CB and had a client where the system documents said they did it this way and the department manager told me they did it another way. I raised a NCN (in part because I was annoyed at auditing what was a fairy tale) basically saying the documents (theory) and reality (practice) didn't match. I told the department manager just to change the docs and no problem.

As to withdrawing regsitration IF the NCN was so serious that quality is serious impacted I would (although in practice a major is raised first). If the company don't care about a serious quality risk then we've got a major problem here.

[CliffK]

Denis9001,

Thanks for sharing your thoughts. Good points all.

I still can't help thinking that internal audits are an expensive way to find the problem with our hypothetical form AB1234.

I would propose that if the form were important, neglect of it would cause a blip in the measurements or a complaint from a downstream process, triggering a corrective action. Once CA is running, the organization can prioritize the urgency of the problem and allocate resources to suit. 8.2.2 attempts to deny prioritization by stating that internal audit nonconformities must be fixed without undue delay. I know that there are workarounds for this denial, but the words are still in the standard.

On top of that, internal audits may not find the problem with form AB1234. There's the standard audit disclaimer, after all: "the assessment was based on random samples and therefore nonconformities may exist that have not been identified." If I recall correctly, Deming had some rather strong words about sampling, which boiled down to this: don't do it.

[Denis9001 - 2007]

CliffK

We (or better said me) have maybe done this topic to death. I think now we're pretty much in agreement regarding the theory. The problem comes on the reality and the aspect you've just introduced about cost. Let's not forget that we have different compaies and it's very much horses for courses. If you're a big multinational you will want to know that your overseas office in Bangkok are doing what they're supposed and you don't have wild cannons there. Conversely you're a small company with the MD sitting at a desk next to the staff.

Regarding the paperwork aspects of the audit (ie filling in form 123) I'd suggest you think of it as housekeeping. Run through the file and if the form ain't signed then sign it. The staff can do this.

Otherwise you knock up a simple questionairre eg "have all form 123 been filled in" and have tick boxes. You can run through the questionairre in 10 minutes and whammo you've met the 9001 requirement. IF you get a serious problem that you realise would have been trapped had you done a more thorough audit then you will change your view. If that doesn't apply then no problem, the kwikkie audit is effective for your business. End of story.

The registrar would be hard pushed to raise NC since you have the record of the audit (ie questionnaire). And if there isn't any problem found later in his audit which should have been caught by the audit then there's no evidence to suggest the audit wasn't effective. Agreed?

[Colin]

In Reply to Parent Post by Denis9001

Regarding the paperwork aspects of the audit (ie filling in form 123) I'd suggest you think of it as housekeeping. Run through the file and if the form ain't signed then sign it. The staff can do this.

On finding unsigned forms, I would prefer that the auditor ask the question "why does form 123 need signing?" If the job is being done satisfactorily without a signature, why ask someone to sign it?

Auditors should challenge the systems that are in place, not merely try to find examples of where the system is not being complied with. This is what clause 8.2.2 b) means when it asks us to audit for effective implementation and maintenance.

[Juliana - 2008]

In Reply to Parent Post by Bev D

I also like to schedule 'verification' audits for areas that have implemented corrective actions to ensure that controls and solutions are being performed and are effective (not just forced on the operators) use the concepts of Lean (5S, continuous improvement, visual workplace) as the basis for auditing to ensure that the preventive/continuous improvement activities are effective...

This is just what my company wants now – as their complete system audit program, not just as verification. We dropped ISO certification for our QMS 2 years ago, one of the reasons being that external system audits never found anything, were time consuming and very expensive (we do not have to have our system certified, it was just something the top management (TM) 9 years ago wanted). Our internal audits were conducted in the same fashion as external audits, and were also time consuming and expensive. The TM group that took over 3 years ago found the disruption from internal audits to production a hindrance and nuisance and could see no value in any findings that came out of those either, especially since the auditors couldn't tell them how to fix the things they were finding.

For the last 2 years no system audits have been done, although lean (5S) audits are done weekly & monthly. I have been trying to come up with a way to incorporate the system audits into the lean audits, in little bite sizes (talking 10 -15 minutes per process once a month) that gives TM the information they want on process and improvement while still addressing the conformance, implementation & effectiveness of the quality system itself.

I have gotten many ideas from reviewing comments in "the cove" and hope to soon have a proposal that will be acceptable to TM, so that we can resume at least some system auditing. It will be far from meeting ISO 9001 auditing or 19011 requirements, but I'm hoping it will meet the needs of and benefit our company.