How do I create a FMEA for the Internal Audit process?

Elsmar Forum Sponsor

edgedirk

Starting to get Involved
#3
My external auditor said that all processes need KPIs and FMEAs.
Internal Audit is a process and with his input, I need a FMEA and KPI.
KPI I have down and figured out.
 
#4
My external auditor said that all processes need KPIs and FMEAs.
Internal Audit is a process and with his input, I need a FMEA and KPI.
KPI I have down and figured out.
Wouldn't waste my time. Surely there are bigger fish to fry. In 30+ years of auditing I've yet to find a meaningful KPI, frankly. The fact that IA is in the "performance Measurement" section of the standard gives you a clue to the fact that it's a pert of performance evaluation, not a core process for the customer or business. IMHO - find something management want to get benefit from measuring...

BTW - your external auditor is plain wrong!
 

Big Jim

Super Moderator
#7
Wouldn't waste my time. Surely there are bigger fish to fry. In 30+ years of auditing I've yet to find a meaningful KPI, frankly. The fact that IA is in the "performance Measurement" section of the standard gives you a clue to the fact that it's a pert of performance evaluation, not a core process for the customer or business. IMHO - find something management want to get benefit from measuring...

BTW - your external auditor is plain wrong!
He is not just wrong, he's nuts. FEMAs were developed to resolve PRODUCT problems, not processes.
 
#8
He is not just wrong, he's nuts. FEMAs were developed to resolve PRODUCT problems, not processes.
Er, not as far as industry is aware. They are not there to "resolve" anything, but prevent design and process (ing) issues. DFMEA and PFMEA use is quite common in the automotive industry as a preventive measure...

You could apply a "FMEA" (not FEMA, that's a federal department) to the internal audit process, but really..?
 

Jen Kirley

Quality and Auditing Expert
Staff member
Admin
#9
No CB auditor has the right to tell you FMEAs are required for all processes. Such specific advice crosses the line into consulting, which is forbidden under ISO 17021 and accreditation rules. In fact, guidance for registrars from the International Accreditation Forum includes a list of evidence types that could be used as appropriate for that process. When told you must have FMEAs for everything, please ask "Where in the standard is that required?" and if you receive a nonconformance for not having FMEAs for all processes, please dispute it as is your right under accreditation rules.

We are required to (6.1.1)
...determine the risks and opportunities that need to be addressed to:
a) give assurance that the quality management system can achieve its intended result(s);
b) enhance desirable effects;
c) prevent, or reduce, undesired effects; achieve improvement.
What are risks in internal audits? How will they be managed? Remember risk is defined as "the effect of uncertainty." There is always a risk of not completely covering the standard in the three year registration period. Planning and audit program management techniques can help address that. It is enough to state the identified risk, as verbal responses to questions are also audit evidence. Showing how your planning is designed to address the risk is demonstration. After enough time, showing that complete coverage has, in fact been achieved, is also demonstration.


ISO 9001:2015 does say (6.2.1)
The organization shall establish quality objectives at relevant functions, levels and processes needed for the quality management system.
Is Internal Audit a relevant function/process? Try convincing a CB auditor it is not, since its activities assess effectiveness of the management system.

Andy and I agree there are few meaningful performance metrics for the internal audit process. Mostly I see "Number of audits completed/number of audits scheduled", which is an easy, arguably simplistic approach.

I have, however seen cases where that metric could be appropriate. I have seen cases in which the auditors are assigned audits as collateral duties, but their managers pressure them to complete primary duties so audits do not get done as planned. When that happens, is it an indication of inadequate resource management and management support, which is another requirement (5.1.1).

So, make the objective/target/KPI reflect what success looks like in the process. If that seems difficult, as yourself "What would failure look like?" and decide how that would be measured. What is the process expected to achieve? How would you know if that did not happen?

I hope this helps!
 
Last edited:

Big Jim

Super Moderator
#10
Er, not as far as industry is aware. They are not there to "resolve" anything, but prevent design and process (ing) issues. DFMEA and PFMEA use is quite common in the automotive industry as a preventive measure...

You could apply a "FMEA" (not FEMA, that's a federal department) to the internal audit process, but really..?
Pardon my typo on FEMA instead of FMEA.

As far as them being inappropriate I wish to cite John J Guzik article "Prove It, How to demonstrate risk-based thinking for auditors" as published in Standards Outlook. This article was recently linked to another thread here at Elsmar Cove. The writer is a principal of Impact Management in Hanover, PA. He is a participating member of the U.S. Technical Advisory Group in ISO Technical Committee 176.


"There have been much written and said about this 'new' ISO 9001 requirement on risk. Many have pointed to risk management programs, insisting that the standard now formally requires them. Tools such as failure mode and effects analysis (FMEA), a production parts approval process (PPAP) and a plethora of new whiz-bang software programs have been introduced as tools that can do the task.

The difficulty with using these tools is that most of them were designed for risk management programs that address requirements of a product or service. Using these tools may help with product integrity, but they could leave you hanging in the breeze when it comes to demonstrating risk-based thinking per ISO 9001's requirements."

It would be best to read the entire article where he points out the risks of depending on such programs and goes on to show how if you are already living to specific clauses of the standard you are already practicing risk-based thinking.
 
Thread starter Similar threads Forum Replies Date
J Environmental FMEA - Is it possible to create an environmental FMEA? FMEA and Control Plans 12
W Medical Device FMEA vs. ISO 14971 to create our Hazard Analysis ISO 14971 - Medical Device Risk Management 2
D ISO 13485 - 7.3.6 Design and development verification - Do most folks create a separate SOP? ISO 13485:2016 - Medical Device Quality Management Systems 4
J Question: How to create an IMDS RoHS, REACH, ELV, IMDS and Restricted Substances 3
M Do we need to create a new CER or can we just update the existing CER EU Medical Device Regulations 3
J Create your own symbol? Other Medical Device Related Standards 7
D How to create IQ, OQ, PQ protocol for existing equipment Other Medical Device Related Standards 2
O How to create robustness checklist from p diagram FMEA and Control Plans 9
T Change control and configuration management - When to create a new model/part number? Other Medical Device and Orthopedic Related Topics 0
R How to create a Work Breakdown Structure? Registrars and Notified Bodies 2
H IMDS for material - Can my Customer create one for my material? RoHS, REACH, ELV, IMDS and Restricted Substances 4
A How do I create a 3^k factorial design with factors be treated as continuous where I Using Minitab Software 0
S Response Surface Method to create design matrix in Minitab Using Minitab Software 5
S Cannot create Rejects for TMV on a medical instrument with an LCD Other Medical Device and Orthopedic Related Topics 10
RoxaneB Carte Blanche to Create an Audit Programme General Auditing Discussions 5
O Is it "legit" to create IMDS before Part Production? RoHS, REACH, ELV, IMDS and Restricted Substances 4
G How to create a mixed OAs in Minitab Using Minitab Software 1
S How to create an Audit Checklist using a Turtle Diagram Internal Auditing 9
A Could I create company specific Employee Records? Records and Data - Quality, Legal and Other Evidence 5
A How to create a Maintenance procedure based on TS 16949 Requirements IATF 16949 - Automotive Quality Systems Standard 5
Ajit Basrur How do I create two different columns in Excel spreadsheet ? Excel .xls Spreadsheet Templates and Tools 5
J Inspection Software to Balloon Drawings and Create First Article Reports Inspection, Prints (Drawings), Testing, Sampling and Related Topics 2
T Microsoft Access Database to create a Simple Calibration Certificate General Measurement Device and Calibration Topics 6
J Should a company create different SOPs for ISO14971? ISO 14971 - Medical Device Risk Management 1
J How do you Create SOPs for Multiple Authorities? EU Medical Device Regulations 8
R How to create a pop-up message in Excel Excel .xls Spreadsheet Templates and Tools 18
M What is the formula to create a bell curve? Excel .xls Spreadsheet Templates and Tools 8
M ISO/TS 16949:2009 Follow-up Audit Visits to create more Revenue IATF 16949 - Automotive Quality Systems Standard 12
Q Medical Device with Lead (Pb) - Do I need to create an MSDS sheet? Other US Medical Device Regulations 1
B How to use Minitab to create this Fractional Factorial Design Matrix Using Minitab Software 2
C Document Control using Wiki - Cannot Create all Documents as Wiki Pages Document Control Systems, Procedures, Forms and Templates 10
M How to create the Policy for determining criteria for Risk Acceptability ISO 14971 - Medical Device Risk Management 11
T How create a Fractional Factorial Design with Minitab Using Minitab Software 3
A How to create a Multiple Operations Specifications Comparison Spreadsheet? Excel .xls Spreadsheet Templates and Tools 3
K When to create a new Control Chart? Quick question Statistical Analysis Tools, Techniques and SPC 4
A How to create Drop Down Box in Excel 2007 Excel .xls Spreadsheet Templates and Tools 2
N Asked to create a baseline survey on emails that come in and out of our Office Document Control Systems, Procedures, Forms and Templates 1
J How Do Processes Create Value? Article by Paul Harmon Book, Video, Blog and Web Site Reviews and Recommendations 2
W Requirements Traceability Database - Have one? Help create one? Document Control Systems, Procedures, Forms and Templates 1
S HR Manager refusing to create Quality Objectives - Is this a Non-Conformity? Quality Manager and Management Related Issues 11
S How do I create a Technical File for a Class IIa Medical Device EU Medical Device Regulations 4
C SOP (Standard Operating Procedure) on how to create an SOP Document Control Systems, Procedures, Forms and Templates 6
O Need to Create Macros so that it can copy data to the next row.... Excel .xls Spreadsheet Templates and Tools 5
B Who should create training associated with changes to the procedures? Document Control Systems, Procedures, Forms and Templates 7
C Need help to create tracking tool Excel .xls Spreadsheet Templates and Tools 4
L Customer requirement to create a Guide for defining Control Methods FMEA and Control Plans 9
H How to create Stoplight Control charts with excel? Excel .xls Spreadsheet Templates and Tools 16
B How Can I Create a Bell curve in Excel 2007 Excel .xls Spreadsheet Templates and Tools 7
H How to create a flow for APQP including design and no including design APQP and PPAP 5
V How to create a CAPA (Corrective Action Preventive Action) Database Nonconformance and Corrective Action 3

Similar threads

Top Bottom