Cl 8.2.2 on Internal audit - Interpretation of Status and Importance

[Falco]

8.2.2 Internal audit reads in part, An audit program shall be planned, taking into consideration the status and importance of the processes and areas to be audited...
Can someone elaborate a little on "status"? I need a little push through the weeds. Thanks

[Stijloor]

In Reply to Parent Post by Falco

8.2.2 Internal audit reads in part, An audit program shall be planned, taking into consideration the status and importance of the processes and areas to be audited...
Can someone elaborate a little on "status"? I need a little push through the weeds. Thanks

Status (Maturity and Performance)

Maturity of the process.
(Less mature processes will likely be audited at a higher frequency.)

Performance of the process.
(Processes that have excellent performance will be audited at a lower frequency.)

Importance

"Important" processes are processes that have a higher impact on the Customer and Customer satisfaction.

Manufacturing processes will be audited at a higher frequency as opposed to a Human Resources- or a Financial Process.

Hope this helps.

Stijloor.

[Craig H.]

In Reply to Parent Post by Falco

8.2.2 Internal audit reads in part, An audit program shall be planned, taking into consideration the status and importance of the processes and areas to be audited...
Can someone elaborate a little on "status"? I need a little push through the weeds. Thanks

Simply, mature and often audited processes don't need as much attention as new, and less audited, processes. If the process in question is not very important to the delivery of "quality" product to the customer, the process does not need as much attention.

Focus your attention on what is important.

[AndyN]

This topic has been beaten to death in other threads.....However, since it's a favorite of mine.....

Jan's correct, I'd put it this way.....

Status: (of the process)

Poor performance, i.e. not meeting objectives, not fulfilling customers' needs

New or changed, i.e people, process, suppliers, technology, machinery, customers and/or requirements, regulations, controls, measurements etc.

Importance; (of the process)

Customers, i.e the impact of the process on customer is the most important!

Regulatory Compliance, does the performance or change affect this?

Bottom line/profitability, could it/is it costing the business money.

Considering these things in tandem, will help drive internal audits to areas of risk and impact in the business. How many times have customers been impacted by something 'new' or 'changed'? - so use audits to head them off before they escape! By using a process approach too, will also help address the 'covering the clauses' question (which is bogus anyways).

By using these criteria to drive the scheduling of audits, you will help management control risky situations and avoid embarrassment!

[Falco]

Thank you all for your comments. Sometimes we just need a little help from our friends.