Internal Audit - Process based vs. Procedure based

[ValleyGirl]

When conducting internal audits we have used AS9101. Our auditor tells me that we need to use a process based audit procedure - not audit to standard requirements. I was hoping I could get some help on how you conduct this type audit. Does anyone have a process based audit checklist?

[BradM]

I changed the title for clarification. Let me or another moderator know if you would like it re-worded.

[Jennifer Kirley]

In Reply to Parent Post by ValleyGirl

When conducting internal audits we have used AS9101. Our auditor tells me that we need to use a process based audit procedure - not audit to standard requirements. I was hoping I could get some help on how you conduct this type audit. Does anyone have a process based audit checklist?

To make my audits process based, I make special checklists for each process based on the procedures, and use "Plan-Do-Check-Act" as a basic framework for asking questions. I ask about inputs, activities, improvements, how success is understood, how corrections are done, specific controls, and the essentials like awareness and communications.

Sometimes I use a turtle diagram and make a process flow chart.

I don't post checklists because using them too often steers the auditor back to what amounts to inspection versus true process auditing.

[Randy]

1st...he would need to show me a solid "shall"

But....What type of process is he referrining to? If one carefully and objectively looks at the requirements of AS9100 (basically ISO 9001 on steroids) one would see that every requirement from 4.1 to 8.5.3 has the needs for input, creates an output and does something in between (oh my gosh, that's the definition of process)

As for a process checklist.........never happen. Why? Because the process most likely being referred to is that of "YOUR" system and organization so any checklist must be tailor made for you and you alone.

This isn't rocket science...I know because I worked with rocket scientists at Aerojet and Northrop Grumman and they didn't do this. Simply identify what it is you do (or in this case want to audit), what are the necessary inputs, what are the desired outputs, how do you make it all happen, and how do you monitor or measure everything to show effectiveness of the whole mess. Then just get the evidence that it is occuring as planned. TA-DAAAAAAAAAAAA! Process Approach.

Take something simple like the document control process.........break it all down (maybe use a Turtle to help) and go for it.

[Jeff Frost]

When my organization started to wean itself from clause based (like AS9101) to process based audits we used sticky notes. First two notes contained the input and output information. We then went through our process documentation and wrote short to the point statements about what was required of the process referencing the procedure number and paragraph number.

After completing this exercise we then grouped together stick notes with similar requirements and then created simple flow chart combining the similar requirements into even more simplified to the point statements that we use to audit the process.

As we gained experience with process based auditing we moved away from creating flow charts and now follow a standard format which we complete. Our format consists of ten informational boxes which are group as follows:

Process Name
Process Owners
Top Level Control Procedures
Sub-process Procedures
Key Personnel
Inputs to Process
Summary of Process Steps
Output from the Process
Next Step in the Process
Documents and Records Reviewed By the Auditor.

This standard format is used to collect audit information that we use to complete the audit report and it is not retained. When a process procedure changes we update this information for the next audit of the process.

[AndyN]

In Reply to Parent Post by ValleyGirl

When conducting internal audits we have used AS9101. Our auditor tells me that we need to use a process based audit procedure - not audit to standard requirements. I was hoping I could get some help on how you conduct this type audit. Does anyone have a process based audit checklist?

Your auditor did you a favor! AS9100 internal audits aren't clause or element based. Since AS9100 is ISO 9001 based, internal audits should be process based.

You are going to be auditing a process-based qms, so you should - as we've posted here countless times - not be auditing to the standard, but auditing what your qms descriptions are. Hence, your planning for your audit should be based on whatever your process documentation says, plus some other considerations like customer requirements, FAA regs etc. Throw in there the organizations own objectives etc. for the process, plus its current performance and we might be humming........

Take a look in the attachments for my audit 'football' (Randy forgot to mention it - he's an animal lover) and see if that helps you.......

[ValleyGirl]

Take a look in the attachments for my audit 'football' (Randy forgot to mention it - he's an animal lover) and see if that helps you.......[/quote]

I must know - what do you mean Randy is an animal lover??

I'll take a look at the "Audit Football" attachment.

[AndyN]

In Reply to Parent Post by ValleyGirl

Take a look in the attachments for my audit 'football' (Randy forgot to mention it - he's an animal lover) and see if that helps you.......

I must know - what do you mean Randy is an animal lover??

I'll take a look at the "Audit Football" attachment.[/QUOTE]

He mentioned 'Turtles'..........