Access Database for Internal Audits. Control or not to Control?

[michelle8075]

I am having an internal conflict..... with myself (LOL).

Ok's it's Friday, and the brain is fried. Here is my very basic question. I just put together an Access database for documenting my internal audits that are done. I am excited, because I know basic Access, but the ability to do different reports are such a wonderful addition to the basic (and archaic) Excel spreadsheet that I do. It is going to make my job so much easier. SO..... do I have to put control numbers and such on the intake form in access, the report, and the query reports.

I don't think I need to control the internal audit database. I have a controlled "Internal Audit" form that has even more information that my database, and all the evidence attached, etc.

So, just to make me feel better am I correct in NOT controlling the Access database?

Thanks! Have a great weekend!

 

[Jeff Frost]

If your database is a tool for completing internal audits then you should put a description of it within your operational procedure. Our database started out just like yours but grew overtime and eventually replaced two forms we were using. Your procedure only needs to describe it along the following lines ”internal audits are tracked by using a database which, at a minimum contains (what is in the database here)”. You then are covered by requirements of 8.2.2 to define the records you will maintain.

This electronic record must be protected per requirement of clause 4.2.4 and the best way to accomplish this is to set it up with password/read only protection. Place the database in a secured folder on your companies’ main hard drive. Your MIS people will have to set up the folder and it should be back it up regularly. If your company does not use a central hard drive then back it up regularly to disk/CD from the computer were it lives and you’re covered.

 

[Ettore]

Like you I'm using some "access database" for managing quality reports, but never, 3th parths Auditors tell me to put the database under control. But i don't think this is a problem. I think that the problem is " if the perfection is possible what is the better way for managing quality Audits with an access database?

 

[Joe Cruse]

Hi Michelle!

Hey, I'm working on that myself right now. This Access stuff kind of draws you in, once you learn it. I keep thinking of things I can swap over from spreadsheets and paper records . I'd put our CA/PA system into Access a few years ago, but this year, I've moved stuff like incoming customer concerns, product returns, and supplier nonconforming issues into this system. I decided a few weeks ago to move the audits, including dock audits, into the system.

I would not try to control the d'base at all. What Jeff posted should cover you. The main thing is to make sure your backup system is as surefire as can be, since this is where ALL the data now resides. It also makes no sense to control any of the queries or tables. In our CA/PA system, I DO have the report that is the output of any CA/PA as a controlled document. I'm meaning the formatted/printed report is controlled, and prints out with the SOP# on it, and this document is referenced in our document control matrix in our QMS. A hardcopy is maintained in our system, mostly for use in our management review meetings and for the registrar auditor to hold when he visits. This is a bit anachronistic though, and I may phase out a hard copy in the future. If I do, I could see losing the "control" from it, as far as an SOP number. Neither should you have to control the Access data entry forms you've created. The only forms that could need document control would be any paper forms used to capture audit data, from which the Access project receives its data.

From your post, I get the idea that you maintain both the records in Access, and additional information in a paper file, including you paper auditing form. If you transferred EVERYTHING from the paper form to the d'base, why even keep the paper form anymore? We do this with a LOT of the lab stuff in our Access LIMS. We have a short little paper form to record weight retained on sieves, for particle size testing. The analysts enter these weights appropriately into the LIMS, and then file the paper form. I toss these paper forms after holding them for current month plus one month. Granted, you will still likely have other things to go into a paper file as evidence from an audit.

Great to see another "Access-o-phile" in the Cove, using this program to "save the trees" and streamline the data process. I hope to finish my internal audit portion soon, but we are in the middle of going to a more process-based approach to the audits, and we have to finish up the format of the audit approach before I can finish the project. It has helped our thinking on the approach by using the relational approach of Access.

 

[michelle8075]

Great to see another "Access-o-phile" in the Cove, using this program to "save the trees" and streamline the data process.

That is quite funny that you talked about "saving the trees". My auditor was laughing about me and how much evidence I really do have in those internal audit folders. He also said, "You know, you can try to save some trees". He said that my audits were "extremely detailed", so I guess I am a little too obsessive-compusive.

I do think that I can electronically save the internal audit form with the findings in it, and scan in the evidence. That is actually a great idea. I am tired of paper!



To everybody that has responded, thank you for sharing your comments! I always like to be assured that I am not totally out of if some days.

 

[michelle8075]

If your database is a tool for completing internal audits then you should put a description of it within your operational procedure. Our database started out just like yours but grew overtime and eventually replaced two forms we were using. Your procedure only needs to describe it along the following lines ”internal audits are tracked by using a database which, at a minimum contains (what is in the database here)”. You then are covered by requirements of 8.2.2 to define the records you will maintain.

This electronic record must be protected per requirement of clause 4.2.4 and the best way to accomplish this is to set it up with password/read only protection. Place the database in a secured folder on your companies’ main hard drive. Your MIS people will have to set up the folder and it should be back it up regularly. If your company does not use a central hard drive then back it up regularly to disk/CD from the computer were it lives and you’re covered.

Hi!
Thanks for the advice, it looks like I have already done everything that you suggested, so I think that I am good to go (yeah!)

I love how MIS can restrict access, it is something that I do quite often and I just LOVE it! It makes my job so much easier.!
Thanks again!

 

[BadgerMan]

We have several Access databases for different QMS/EMS related processes such as C&PA, training, auditing, environmental aspects, etc.

We also use a form number to specify formats like the CAR form although we do not generate hardcopy CAR’s independent of the database.

Yeah, a write protected folder on the network is a great idea and you can also use IT’s backup process (assuming they have one!) for record retention purposes.

Incidentally, Access is also a great reporting tool. We generate many of our monthly/quarterly/annual metrics using Access. Also, we query our Oracle business operating system with Access through an ODBC connection for trend analysis purposes. Access is much more powerful and easier to use than report writers like Crystal or others IMHO.

 

[Don Palmer]

MS Access Database

Yes, Access Database is a great tool for small/medium sized organizations. About five years ago I got hooked on Access out of need to administer/manage nearly 1000 calibrated tools across three repair station facilities. Still working well, with minimum upkeep and of course common sense safeguards as already stated above (in previous responses to this thread).

About a year ago, I built an NCR/CAR database (MS Access) that is performing very well. My Registrars Auditors seem to love it. It's controlled, easy to use, has various data entry screens, querries to bust out different data, forms, and reports to support management review.

Prior to managment review, I'm no frantically searching hard copy paper files like I used to do. I go to the database, print forms/reports make graphs etc., and haven't hit the bottom of the barrel yet as far as potential of this software is concerned.

I will say though that, without proper IT controls, user accounts, passwords, rights, (read only, etc.) and backups; you are living dangerously.

Sounds like you are on your way.

 

[Caster]

Version Number and Software validation

SO..... do I have to put control numbers and such on the intake form in access, the report, and the query reports.

I don't think I need to control the internal audit database. I have a controlled "Internal Audit" form that has even more information that my database, and all the evidence attached, etc.

Michelle

We also had many Access databases for audits, CARs, Quotes, training, basically everything.

We approached “control” from a different point of view, AFTER a very expensive quoting mistake due to a “trivial change” in our quote database. You could say, we finally “got” what control was meant to be for. It just took a lot of lost dollars.

From that point on we just made a revision table within the database, that listed the version number, date, described in painful detail exactly what was changed, named the changer, and named the reviewer/approver.

Every possible output from the database was linked to the current rev number. The Main screen showed the current version number.

THEN…we had several known scenarios that were run to make sure that the changed software still produced a correct result.

The validation part is likely overkill for an audit database, but it is almost too easy to set up bullet proof version control.

We also did similar with Excel spreadsheets (GR&R for example). One worksheet had the version table and list of changes, and every worksheet footer printed the most current version number.

Presto boingo almost painless “control”.

I would definitely run validation of R&R software changes! Just use a textbook example. This caught many spreadsheet errors.

A simple thing to survive any audit - and more important – avoid costly business mistakes.

 

[michelle8075]

Thank you for the great advice.

I am hoping that I learn Access again through trial and error. I did have basic and advanced Access, but like anything if you don't use it..... you loose it.

I am so excited at the possibilities, and yes, it will definatly make my job SO MUCH Easier!

I see what you are saying too, when I can have one sheet that lists the revisions that took place.

Great suggestions and information everyone!