Internal and external auditor competency to CSR's

[joekirk]

A better way for the auditor to ask this question may be "When a customer updates a CSR, how are these changes communicated to your internal auditors?"
Many organizations document when a CSR is changed and forwards these changes or the new CSR to applicable process owners AND internal auditors for review and keep a record of it.

Many CB's actually do request what your customers are and CSR's you have (revision) as part of the inputs for audit planning.

 

[Golfman25]

A better way for the auditor to ask this question may be "When a customer updates a CSR, how are these changes communicated to your internal auditors?"
Many organizations document when a CSR is changed and forwards these changes or the new CSR to applicable process owners AND internal auditors for review and keep a record of it.

Many CB's actually do request what your customers are and CSR's you have (revision) as part of the inputs for audit planning.

See, to me that is the problem. Sure when a CSR is changed, you review and update your process as needed. However, to "train" your auditors may just be a waste of time. As long as the auditors incorporate the current version of the CSRs into their audit, I think you should be good. The auditor should pick up any changes in the pre-audit review, as opposed to "remembering" them from 8 months ago.

 

[malasuerte]

ask the CB auditor, who wrote you up, how does s/he demonstrate competence to audit against the OEM CSR's....

I guess I have a different take: CSRs are located at: Customer Specific Requirements – International Automotive Task Force Part of our auditor training is the 'competency' to audit for any of these requirements. We show that the auditors understand any CSRs ad what to look for in the areas.

 

[joekirk]

I guess I have a different take: CSRs are located at: Customer Specific Requirements – International Automotive Task Force Part of our auditor training is the 'competency' to audit for any of these requirements. We show that the auditors understand any CSRs ad what to look for in the areas.

Correct. Auditors should be aware of where to find the latest copy of the applicable CSR's and audit records should show that CSR requirements were reviewed during the internal audit process. Key word to it all is competency and your ability to show auditors (internal in this case) are competent to the latest CSR's.

 

[Sidney Vianna]

Correct. Auditors should be aware of where to find the latest copy of the applicable CSR's and audit records should show that CSR requirements were reviewed during the internal audit process.

None of this attests that the internal auditors are competent in assessing CSR's.

 

[John C. Abnet]

None of this attests that the internal auditors are competent in assessing CSR's.

@Sidney Vianna is correct.
Consider it in the example of a football match....
The team watches film and trains in the preseason and prior to the match. They are indeed trained. They lose the match 12-0 . They did not demonstrate competence.
Another...
A potential driver takes a class and test and is awarded a driver's license. She/he is trained and has a license to prove it. She/he has one wreck a week for the next five weeks. She/he did not demonstrate competence.

Think of "competence" as actual performance results (output), NOT the training (input).

Hope this helps.
Be well.

 

[joekirk]

None of this attests that the internal auditors are competent in assessing CSR's.

If an auditor is aware of the CSR's and it can be shown that they have audited to the CSR's, how can you say that this does not demonstrate competency?
They only way that I would right up a finding against internal auditor competency related to CSR's would be if I found something like:
- Internal audit records could not demonstrate that CSR's were audited.
- Internal auditors reviewed did not have a clue as to what a CSR was.
- No CSR matrix / table indicating where within the organization's quality management system their customer-specific requirements are addressed.

Competency can be demonstrated through formal training, informal training, records of work, etc... You don't have to possess a certificate to show competency.

 

[Sidney Vianna]

If an auditor is aware of the CSR's and it can be shown that they have audited to the CSR's, how can you say that this does not demonstrate competency?

I can read a book about brain surgery. I can operate on a brain. That does not make me a competent brain surgeon.

 

[joekirk]

I can read a book about brain surgery. I can operate on a brain. That does not make me a competent brain surgeon.

But that would make your more competent than someone who has not read a book...

Bottomline regarding competency is that the auditee needs to show the auditor how you determine or demonstrate your employee is competent. The standard(s) do not define how you do it.

 

[Sidney Vianna]

But that would make your more competent than someone who has not read a book...

Not really.

Bottomline regarding competency is that the auditee needs to show the auditor how you determine or demonstrate your employee is competent. The standard(s) do not define how you do it.

There is a NORMATIVE definition of competence: ability to apply knowledge and skills to achieve intended results. If you put a document control clerk, with zero knowledge of engineering principles to perform an internal audit of a highly technical process, chances are, that audit will be a fiasco. The process to determine competence, what, by the way, is a variable and not an attribute, has to take into account knowledge and skills. It is NOT whatever do what you say, say what you do.