Can the Process Approach be used to audit Management Commitment and how?

[somerqc]

Jane,

I did not mean it as an insult, more as a probe as to the origin of the question. Why is he asking the question?

Is it for personal knowledge and understanding OR as is very common is he trying to help management or others understand the requirements of the standard?

Our approach would change if we are helping him gain a better understanding than if he is trying to assist others to understand. The root of the answers probably wouldn't change much; however, the terminology and approach would.

Randy - I don't think many would disagree that 5.1 is definitely part of (and likely most important) the process of a quality system. Where I disagree is that I don't see 5.1 as a process on its own (re: Input Action AND Output). I see it a part of an overall management process.



John

 

[RoxaneB]

I'm with Randy on this...Management Committment can be a process. After all, without it, the Management System will go nowhere.

The issue comes about when we try to audit the concept of Management Committment by itself. That won't work.

Typically, I start off by meeting with senior management who walks me through things like:

• How they developed their policy and review it for ongoing suitability
• How they developed their objectives, review them, communicate them, ensure that they're appropriate at the various levels
• Ditto for metrics
• Data analysis and what they do with the results of said data analysis
• Management Review and what they get out of it, what they do with it, etc.
• Provision of resources - how this is aligned with plans, processes, etc.
• Customer satisfaction
• Andn so on...

From there, when the audit progresses out to the other processes, I look for consistency in the message that management wishes to communicate and that people feel there is transparency within the management system...plus the other usual stuff like records, etc.

 

[Alexander Keith]

Thank you Everyone,

I'm just a NEWBIE and the reason why I asked is to get a better overall comprehension of the process approach to auditing.

I see so far that 5.1 is kind of a part of a bigger "management process" which could also include 5.3, 5.4.1, 5.6, 8.4, 8.5.1, 8.5.2 and 8.5.3. Those are my selections but you may have different ones.

Also; I see that certain requirements such as 5.4.1 and 5.6 (and others) could be audited on a stand-alone basis.

But I'm still not clear on what the "process approach" to auditing actually looks like... Is it the "people, methods, environment, material, equipment" approach? I'm used to seeing a procedure(s), evaluating it and verifying compliance.

Thank you!

 

[qualityboi]

Re: Process audit approach ...

Process....Input - Action/Activity - Output

Management committment (Process)

4.1 The organization shall... (Input)

5.1 Top management shall...(Action/Activity)

Documented policy, management review, resources, objectives, relevant communication, etc...(Output)

Every clause of 9001 can be considered a "process" within itself if one opens their mind, steps back, and takes an objective look at what they really say.

Get out of "Tunopia" and break away from "Tunoptic thinking"!

Sure Randy is right those are processes in ISO 9001, but not necessarily realized processes in your company. Randy's former post regarding process audits better it is a little clearer.

Are you going to ask your management to assess and improve the "effectiveness and efficiency" of the "management commitment" process? Are you auditing the ISO 9001 standard or your company? Have fun applying 8.2.3 Montoring and Measurement of Process to it!

 

[qualityboi]

But I'm still not clear on what the "process approach" to auditing actually looks like... Is it the "people, methods, environment, material, equipment" approach? I'm used to seeing a procedure(s), evaluating it and verifying compliance.

Thank you!

Do you have a process map of how your company works? Interview the process owners, ask and verify evidence to what they are saying. Analyze if the processes comply with the "applicable" requirements of the standard. Knowing the application takes training and experience as some folks try to apply every bit of a system standard to every process. Then you fall into interpretation of the standards which gets uglier. There are whole threads in here regarding interpretation, read them. You should also have attended an internal or lead auditor class.

 

[Randy]

Every company and every management system works basically like the attached....just fill in the the areas and add whatever other linkages there are.

 

[JaneB]

Somerqc: thanks for clarifying - I didn't quite get that from your original post at all! (And as you can see, there are some very diverging views on the topic

The issue comes about when we try to audit the concept of Management Committment by itself. That won't work.

Yup, that is and remains my viewpoint also. Of course there is/are management processes - and my approach would be similar to theone you outline.

Keith: thanks for explaining further - this helps me and no doubt others much more to understand the background & context to the question.

I'm just a NEWBIE and the reason why I asked is to get a better overall comprehension of the process approach to auditing....

But I'm still not clear on what the "process approach" to auditing actually looks like... Is it the "people, methods, environment, material, equipment" approach? I'm used to seeing a procedure(s), evaluating it and verifying compliance.

This sounds like a fundamental point - evaluating and verifying a procedure is just that - auditing compliance with a procedure. But a procedure is often simply a part of a larger process. They aren't the same thing at all. A process can exist without a procedure. Some people dispute this and think that 'every' process 'must' be documented. Not so. It has to be identified and defined, but it may not need to be documented. But a procedure cannot exist alone - it is always part of a process.

If I were trying to understand process, I think I would be inclined (if possible!) to pick something easier in the first place than management commitment!!

I would do some searches in here on process and process audits - I'm sure there's lots of useful info here on that.

As a simple example, consider a process such as 'Recruiting'. The ultimate aim of such a process is to get a suitably qualified person on board, with all the required records (eg, copy of resume, signed letter of offer etc). Inputs would or should include a position description or similar, and the criteria the ideal candidate would have.

Now, imagine that you are in the HR department and simply do a compliance audit on their procedure, which only involves (say) receiving a request from a manager, posting the ad, screening candidates, and taking part in the first interview. Nothing more.

Yet the overall process itself is bigger, it stretches further - to final selection & appointment, even perhaps to the first 3 months in some cases. You might audit the HR procedure & find they comply with it perfectly. But there could still be problems in the process, which you won't find unless you look at the overall process, perhaps to ask questions such as: is this process effective? Is it working well for all participants? Could it work better? Is the customer (manager? new employee?) satisfied with how it works? etc.

 

[AndyN]

I'm not convinced that 'Management Commitment' is a process, in and of it's own right. If it were intended to be that way, wouldn't TC 176 have made it a requirement to define and demonstrate a process, as it does in other places?

I believe that management can easily demonstrate commitment in other more practical ways - the setting of policy and management review is all well and good, but it has little to do with the fundamentals of what management are really interested in - Business Process Performance

As a past implementation and training consultant I followed these principles to have management show their commitment. They had to 'know' (like it says in the Bible) the following:-

The Requirements (Company - policy, objectives etc., Customer, Regulatory etc.)
The Process (Inputs, Activities, Outputs, Controls)
The Performance (Metrics, Results etc)
The Actions (Corrective, Preventive and Improvement, depending on results)

If they can effectively 'talk' to these items, I'd say they were committed. But it comes from auditing a process that they're responsible for, not from 'force fitting' a requirement of the standard into a process, just because you can.....

 

[JaneB]

Excellent post, Andy.

 

[JaneB]

Alexander,

As another illustration of process vs. procedure, check out the article that Sidney included in this post.

For example, if auditing billing procedures, you might find that they had followed their own procedure/s just fine. But the overall process is flawed, as evidenced by the appalling outcome for the customer (and this is just the one we know about). A process audit would (or should have) looked at the end to end process, and asked the question: what happens if this process is changed? What is the outcome for the customer? Are there any risks here?