Writing an Internal Audit Report Finding for Employee Awareness of QMS Documents

[azuker]

Our internal audit teams are finding an overall trend of lack of employee awareness when it comes to QMS documentation. Many employees are either unable to access our QMS via the company intranet, or they are simply unaware of SOPs, Work Instructions and Forms that have been posted.

We are new to the internal audit process and want to write our nonconformances as accurately as possible. If an employee lacks this type of knowledge, should the nonconformance be written against 4.2.3 Control of Documents, 5.5.1 Responsibility & Authority or 6.2.2 Competence, Training & Awareness? Or perhaps each requirement is applicable to a degree?

The documentation on the intranet is current, there are no printed copies being used in this instance; but employees are simply not aware of many of the work instructions that have been posted and actually apply to them and their process.

Help as to which requirement is the best fit would be most appreciated! Thanks!

 

[Golfman25]

Re: Employee Awareness of QMS Documents

I would focus less on whether the employee can recall or retrieve a certain document and more on whether they are operating within the parameters of the document. If they are following the SOP or work instruction, then you should be ok.

If they are not following the SOP or work instruction, it would be more on 6.2.2 Competence, Training and Awareness. Somebody obviously wrote the instruction without properly training the users on the document.

 

[Michael_M]

Re: Employee Awareness of QMS Documents

Are there any specific requirements that state to use "this form/work instruction" that are or are not being followed? What (if any) training have they gone through to know what form or work instructions to use? Are there forms and/or work instructions for each process or just some?

To me, these answers would help direct your answer, for example:

Every process has work instructions and setup procedure directs the operator to the work instructions. This would go against training (and maybe 5.5.1) as the operator has the instructions but are not following them.

About 20% of the process have work instructions and there is no information passed to the operator that work instructions exist. To me, this would go against 7.1 (Product realization), the information is not being flowed down to the operator properly.

 

[AndyN]

While it's tempting to "hang" an audit finding on an ISO clause, in this case will it help? Firstly, as internal auditors, you have to determine what your organization's requirement is for employees to know, access etc the various documents they need because THAT's of greater significance to management, not the ISO requirement (which many are as clueless about as the employees are about their documents).

A helpful audit addresses the (root) cause of the issue. ISO isn't this. The QMS and managements' understanding of it IS.

 

[azuker]

In some instances, employees are operating within the requirements that are outlined in process flow maps and supporting work instructions, they are just not actually aware of the documentation on the QMS.

In other instances, employees are not taking all steps required of them due to a lack of awareness of these steps.

I am pretty confident at this point that some Dept Mgrs are creating/revising documents without effectively training employees to the changes or additions.

I want to be sure that the audit team is on point when writing their nonconformances that will be presented to Dept Mgrs and Executive Mgmt. so they are less likely to be challenged.

 

[Kronos147]

I am pretty confident at this point that some Dept Mgrs are creating/revising documents without effectively training employees to the changes or additions.

If you found instances where the procedure was not being followed, I think Training and Awareness is a good place to focus.

A lot of good advice has been stated so far, IMO.

 

[AndyN]

In some instances, employees are operating within the requirements that are outlined in process flow maps and supporting work instructions, they are just not actually aware of the documentation on the QMS.

In other instances, employees are not taking all steps required of them due to a lack of awareness of these steps.

I am pretty confident at this point that some Dept Mgrs are creating/revising documents without effectively training employees to the changes or additions.

I want to be sure that the audit team is on point when writing their nonconformances that will be presented to Dept Mgrs and Executive Mgmt. so they are less likely to be challenged.

Don't fall into the trap that just because a document is revised, that retraining is needed. It isn't. It's a common bias some auditors have. If you approach any audit thinking that way, you will lose respect of management.

Anyone who says "I'm pretty sure..." when they audit, hasn't done a complete job and, yes, someone WILL challenge you. You should be challenged! Your audit is incomplete and you've NOT provided sufficient "objective evidence" that the QMS isn't effective in implementation. In short, you've allowed "suspicion" to color your thoughts.

Employees may not be "aware" of steps in documents. So, as an auditor, did you determine the effect of this? I make a very good cake but I don't follow all the steps in the recipe. I put everything in a food processor. It still gives me the same result, but I don't follow the steps. Same ingredients. Same baking. Same (tasty) result. What's the point? The result is the same!

As an internal auditor, you job is to follow the signs and conclude, for management, if these steps are actually needed. Are they even certain those documents are needed? Maybe they did them because they think "ISO-says-so", but in fact, they bring zero value - people don't need them, even if they do exist...

See where this is going?

 

[azuker]

Yes, I see what you mean. I appreciate your feedback.

There is evidence that shows in some areas, employees are unaware of quality control steps they are to take. For example, confirming customer approval of a product BEFORE proceeding with the manufacturing of that product. Not knowing how they are supposed to handle nonconforming product would be another.

 

[John Broomfield]

azuker,

From what you say you may have evidence that your management system's processes are not being monitored for conformity and effectiveness.

That would be an 8.2.3 nonconformity.

Ask the process teams and their managers how they monitor and correct their processes for conformity and effectiveness and engage them in understanding and applying their processes' criteria for success (see 4.1c).

Also find out what they do if a process needs frequent correction. Of course, in this case you expect them to invoke corrective action.

Try not to suggest through your questioning that employees must be familiar with all the system documents. Indeed, you may find many documents are completely unnecessary (see 4.2.1d).

John

 

[AndyN]

azuker,

From what you say you may have evidence that your management system's processes are not being monitored for conformity and effectiveness.

That would be an 8.2.3 nonconformity.

Ask the process teams and their managers how they monitor and correct their processes for conformity and effectiveness and engage them in understanding and applying their processes' criteria for success (see 4.1c).

Also find out what they do if a process needs frequent correction. Of course, in this case you expect them to invoke corrective action.

Try not to suggest through your questioning that employees must be familiar with all the system documents. Indeed, you may find many documents are completely unnecessary (see 4.2.1d).

John

Further to John's advice, it also points to the need for involvement of management and supervision when the auditor plans and prepares for their audit. Most auditors mimic the CB auditors with little/no face to face involvement of their "client" in planning the audit (only the so-called "stage 1" does this). But why not? You'd all be on the same page and also you can find out where their heads are with issues, challenges, problems whatever.

That's the way you bring value in audits. Just turning up, to some arbitrary calendared event, like most IAs isn't likely to provide much help, nor you with much respect...