Some Options for Risk Based Auditing

C

Chance

The factors are subjective to me preparing the report. Managers might not agree with my finding classifications. Can you tell us more details what triggers an audit finding to fall in each of the factors?

1. systemic problem
2. Process gap, dysfuction
3. Human performance, not following procedures
4. Procedural gap, need revision
5. Audit readiness issue

Right now, I am trying to summarize in a report our audit findings per year using Process Perfomance Wighted Scores. It is nice. But I have trouble filling out the gray cells.
 

Jen Kirley

Quality and Auditing Expert
Leader
Admin
The factors are subjective to me preparing the report. Managers might not agree with my finding classifications. Can you tell us more details what triggers an audit finding to fall in each of the factors?

1. systemic problem
2. Process gap, dysfuction
3. Human performance, not following procedures
4. Procedural gap, need revision
5. Audit readiness issue

Right now, I am trying to summarize in a report our audit findings per year using Process Perfomance Wighted Scores. It is nice. But I have trouble filling out the gray cells.
1) Systemic is defined as "affecting or relating to a group or system (such as a body, economy, or market) as a whole, instead of its individual members or parts." We can then consider systemic breakdowns to involve multiple instances or more than one interdependent group. For example: Auditees described that several times last year a manufacturer halted one or more lines due to shortage of critical material because of an inability to accurately forecast what was needed to produce the manufactured goods. Or, the supplier sent repeated shipments of materials/chemicals that failed receipt inspection. This involves both process realization and purchasing element groups.

2) Process gap, dysfunction: a group of employees was hired without identifying or performing training needed to do their work accurately and efficiently. This involves one element group. If this routinely happens or has occurred with a large group of people for whom the organization fails to plan for regulatory training, the issue could be considered to be a systemic one.

3) One or two operators insist on doing things his/her way instead of following procedures. The issue may be one of procedures themselves not being optimum (they are in fact inefficient) or the immediate person makes a choice not to adhere to the procedures on the basis of personal viewpoints or a lack of understanding of how this affects downstream processes. Note that if this is widespread throughout the processes it could be considered to be a systemic problem.

4) A process has been changed but the written procedure has not been updated. Note that if this is widespread throughout the processes it could be considered to be a systemic problem.

5) One or two copies (out of dozens) of a work procedure on the manufacturing floor were out of revision. No impact on product could be found. Note that if this is widespread throughout the processes it could be considered to be a systemic problem.

Of course these are guidelines. Nothing is writ in stone, so to speak. Overall the weight of impact is judged on how widespread the issue it, or its result, or possible result, on what's delivered to the customer (product or service) or regulatory compliance.

I hope this helps!
 

Raffy

Quite Involved in Discussions
Jen,
I dunno if this question would be appropriate in this reading room. Nevertheless, I would like to make a follow-up question with regard to the new requirements of ISO19011:2011 which somehow I think has a link. How to identify and evaluate audit program risks? Do we need to one by one identify the said guideline and implement it to our system? Please advice.
Thank you very much in advance for the usual kind attention you will give this matter.
Best regards,
Raffy :cool:
 

Jim Wynne

Leader
Admin
Jen,
I dunno if this question would be appropriate in this reading room. Nevertheless, I would like to make a follow-up question with regard to the new requirements of ISO19011:2011 which somehow I think has a link. How to identify and evaluate audit program risks? Do we need to one by one identify the said guideline and implement it to our system? Please advice.
Thank you very much in advance for the usual kind attention you will give this matter.
Best regards,
Raffy :cool:

There are no requirements in ISO 19011--it's a guidance document.
 
D

dwayne_dhey

Do you also have some materials on the definition of root cause based on ISO? May I have some of it? I am still hard up in this subject matter since ISO 31000 does not provide.
 
Top Bottom