Internal Audit Difficulties - Am I headed in the right direction?

[qusys]

Hi! I’ve read a lot of threads, but I didn’t find answers to my questions. Correct me if I missed something.

I’m learning to do an internal audit by doing it, which might be not the best way of doing it. Our company is pretty small and we are planning on getting certified next year.
So, I’ve done my first audit, issued a report and just got a feedback from the president of the company (we Are small ) , which left me absolutely confused. My boss did a lot of prep work of QMS (then he hired me 6 month ago), so he is not incompetent in the question.
I attached main part of the audit report and our comments on the right so you can see what is going on

Questions:
1) What is the down side of me, as an auditor, being a creator of CAPA requests? Why so many people in other posts say that “function of internal auditor is to collect objective evidence…. It is not the job of an auditor to suggest corrective action’, “CA are the responsibility of the process owner”, etc.
2) Just by looking at the report, does it look like we are moving in the right direction?
I will appreciate any input.

Hi Elenka,
I appreciate the job that you are doing.
I do not know if you are also following a training for internal audit on ISO 9001 and also to learn ISO 19011 guidelines. If not, I would suggest to plan it.
Reading the report, I have had the sensation that it is more a gap assessment on the training process vs ISO 9001 and internal procedure.
This could be reasonable given that the organization is quite new to the standard. I am saying this based upon the nature of the non conformity that you raised up as well as the number of the same.
From a superficial analysis, the audited process seems to be not effective.
In my experience, this is the classical situation when the QMS of an organization pursuing certification stands at the beginning. You will find the same situation in other processes you will audit.
Based upon this, I think the role of the Quality team and Quality representative shall be key and crucial at this time to help and assist the organization to fix the gaps and build with them the QMS to improve the organizations's processes and get certification.
I think that process owners shall not be left alone at this moment and shall be assisted side by side, given that probably ( this is an assumption of mine) they do not know deepley ISO standards and its requirement vs which you hold the audit. At the same time, mandatory procedures for ISO 9001 certification should be betetr aligned and embodied in the organization, in the sense that they shall know and applied for conformity.
This is the second step that you can do through successive internal audit.
Hope this helps

 

[JaneB]

Elenka,

It's a bit hard to tell from the report if 'you're moving in the right direction' or not. Who is making the various comments? Because there appears to be quite a lot of pushback and/or ignorance there - eg, at least one person is disputing whether it's necessary to have records of competence, and someoneis saying how could you say 'no records available' and says you saw them.

All of which clearly indicates: be very, very objective and very, very clear about what you looked at and what your conclusions are based upon - eg, how many people did you attempt to verify records of training/competency for? And against what benchmark were you auditing? Again, one of the comments says there's no written requirements... if there aren't any, what are you using to audit against?

I do second the idea of getting some training. 'Just do it and you'll learn' is not to my mind, nor in my experience, an at all effective way of becoming a reasonable auditor, let alone a good one. And can seriously annoy a lot of managers along the way, and make yourself very unpopular, and even more so if you are also raising the corrective actions!

Sorry if this sounds negative, but it isn't a really good way to go about it. It's a bit like making someone a manager of a department, without them having had any managerial experience at all, and telling them they'll figure it out. They may well... but it will at the very least take quite a lot of time and leave some 'collateral damage' along the way.

 

[qusys]

Elenka,

It's a bit hard to tell from the report if 'you're moving in the right direction' or not. Who is making the various comments? Because there appears to be quite a lot of pushback and/or ignorance there - eg, at least one person is disputing whether it's necessary to have records of competence, and someoneis saying how could you say 'no records available' and says you saw them.

All of which clearly indicates: be very, very objective and very, very clear about what you looked at and what your conclusions are based upon - eg, how many people did you attempt to verify records of training/competency for? And against what benchmark were you auditing? Again, one of the comments says there's no written requirements... if there aren't any, what are you using to audit against?

I do second the idea of getting some training. 'Just do it and you'll learn' is not to my mind, nor in my experience, an at all effective way of becoming a reasonable auditor, let alone a good one. And can seriously annoy a lot of managers along the way, and make yourself very unpopular, and even more so if you are also raising the corrective actions!

Sorry if this sounds negative, but it isn't a really good way to go about it. It's a bit like making someone a manager of a department, without them having had any managerial experience at all, and telling them they'll figure it out. They may well... but it will at the very least take quite a lot of time and leave some 'collateral damage' along the way.

Agree with you , Jane.
This was the same sensation looking at the report of the internal audit.
I have made some assumptions since I do not clearly know the status and which the project is going to achieve certification. Including in the plan, training and awareness for all personnel shall be planned according to the identified needs and professional roles.
Coming back to the internal audit report, I agree too that some item should be improved, just for this I highlighted the chance to follow ISO 19001 guidelines training to get acquainted of how to manage an audit report and the other things related to audit.

 

[ElenKa]

Thank you for your input! That's great to get feedback!!!

It's a bit hard to tell from the report if 'you're moving in the right direction' or not. Who is making the various comments? Because there appears to be quite a lot of pushback and/or ignorance there - eg, at least one person is disputing whether it's necessary to have records of competence, and someoneis saying how could you say 'no records available' and says you saw them.

All of which clearly indicates: be very, very objective and very, very clear about what you looked at and what your conclusions are based upon - eg, how many people did you attempt to verify records of training/competency for? And against what benchmark were you auditing? Again, one of the comments says there's no written requirements... if there aren't any, what are you using to audit against?

You raise the argument we had. Training procedure states that “Department supervisors shall determine the need for retraining according to the requirements established for each process” and my finding is “There is no training requirements established for each process”.
Our department manager says that there is no necessity for requirements to be written and we do have them, he just knows them by heart.
So he claims that trainings happen based on requirements. I’m convinced that people are trained with no system in mind. Is it a finding? How do we know that I am (or he is) wrong?
Also the way things are set up in our company it’s very hard for a quality document to get through approval process. This way we are trying to prevent overproducing paperwork. So I cannot just say that we should create “written training requirements” because that’s the right thing to do, even if I’m absolutely convinced.

As for learning to do audits by doing it, without some basic training, is a concern as well. The concept of someone becoming competent to do something, by doing it repeatedly does not work in many cases.

I have been reading as many things about audits as I can and that’s the only training I’m getting. I hope it will be enough

 

[Geoff Withnell]

I think part of the problem here may be a tendency to call two different entities with the same term -"corrective action". A "corrective action" is an action taken to eliminate the root cause of a nonconformity. This should not be confused with a "Corrective Action Request" or "Nonconformance Report" or some other form created to document the discovery of a nonconformance and to track its resolution with a corrective action. When an auditor discovers a nonconformance, the auditor normally initiates a "Corrective Action Request". The process owner, with or without the aid of a team, depending on the complexity of the issue, is the one who decides what corrective action to take.

BTW, I am in favor of having the "any employee who becomes aware of a nonconformance" empowered to initate a CAR. This tends to help heighten the awareness that we are all responsible for quality, and can lead to discovery of problems well know on the shop floor but unknow in the office. If someone writes up an action that is unfounded through misunderstanding of the requirement, this is a good thing, since then the misunderstanding can be corrected. If someone writes up an unfounded action through malice, well, as a manager, I can deal with that as well.

Geoff Withnell

 

[Sardokar]

The process owner, with or without the aid of a team, depending on the complexity of the issue, is the one who decides what corrective action to take.

But erm ... doesn't the decision on what corrective action need to be taken need to be validated by mutual agreement of all involved parties ?

I mean let's say we have a problem who's REAL root cause is due to a lack of commitment from 2 departments .

Example: lack of customer updating on purchased product expected date of delivery

If the sales manager is the process owner , he can put the blame on the CRL employees , although that even if in some cases it is true the CRL are not providing him updates when requested , in other cases they are providing updates but sales are failing to update customer

If the Sales manager decides what corrective action is to be taken , then he may very well decide that the root cause is only due to CRL ( hiding his department's mistakes)

While if we involve ALL parties in finding real root cause and taking corrective actions we will find that it's a shared responsibility and by fixing both problems we prevent the repetition of the lack of updating

What do you think ?

 

[Sidney Vianna]

BTW, I am in favor of having the "any employee who becomes aware of a nonconformance" empowered to initate a CAR. This tends to help heighten the awareness that we are all responsible for quality, and can lead to discovery of problems well know on the shop floor but unknow in the office. If someone writes up an action that is unfounded through misunderstanding of the requirement, this is a good thing, since then the misunderstanding can be corrected. If someone writes up an unfounded action through malice, well, as a manager, I can deal with that as well.

I am also in favor of allowing anyone in the organization to TRIGGER a corrective action request, PROVIDED two aspects are covered:

1. the whole workforce is educated in the concept of corrective actions, the purpose, the high level process, who is involved, etc.
2. there is a filtering mechanism in the front end, where someone "validates" the issue to be treated via the CA process. Failure to filter the requests for corrective actions tends to lead to spurious issues (such as the quality of the food available in the vending machines needing improvement) flogging the process and detracting resources from real issues that lead to customer satisfaction and product conformity improvement.

Having a robust corrective action process with the whole workforce involved lends itself to an easier integration with other disciplines, such as environmental and occupational health & safety management, which also require corrective action processes in place.

 

[Geoff Withnell]

But erm ... doesn't the decision on what corrective action need to be taken need to be validated by mutual agreement of all involved parties ?

I mean let's say we have a problem who's REAL root cause is due to a lack of commitment from 2 departments .

Example: lack of customer updating on purchased product expected date of delivery

If the sales manager is the process owner , he can put the blame on the CRL employees , although that even if in some cases it is true the CRL are not providing him updates when requested , in other cases they are providing updates but sales are failing to update customer

If the Sales manager decides what corrective action is to be taken , then he may very well decide that the root cause is only due to CRL ( hiding his department's mistakes)

While if we involve ALL parties in finding real root cause and taking corrective actions we will find that it's a shared responsibility and by fixing both problems we prevent the repetition of the lack of updating

What do you think ?

I am assuming (yes, I know I know) that it is the process owner who is responsible (read judged by) the process end result metric. Then not addressing the correct root cause will come back to bite the process owner, as the CA will be ineffective. The metric in your example would be customer
complaints based on actual ship dates not meeting expected ship dates, or something on this order. To fix the problem, get an effective CA, and drive process metrics in the right direction, the process owner has to deal with reality, not appearances. Which means acting on ALL the available information. Which of course explains why so many processes go uncorrected, and so many CAs are found to be ineffective.

Geoff Withnell

 

[Golfman25]

Thank you for your input! That's great to get feedback!!!



You raise the argument we had. Training procedure states that “Department supervisors shall determine the need for retraining according to the requirements established for each process” and my finding is “There is no training requirements established for each process”.
Our department manager says that there is no necessity for requirements to be written and we do have them, he just knows them by heart.
So he claims that trainings happen based on requirements. I’m convinced that people are trained with no system in mind. Is it a finding? How do we know that I am (or he is) wrong?
Also the way things are set up in our company it’s very hard for a quality document to get through approval process. This way we are trying to prevent overproducing paperwork. So I cannot just say that we should create “written training requirements” because that’s the right thing to do, even if I’m absolutely convinced.



I have been reading as many things about audits as I can and that’s the only training I’m getting. I hope it will be enough

I think you may have missed something here. I think your finding is wrong and can see why you are having an issue. Your requirement is that the Dept. manager determines the need for retraining -- based on the requirements established for each process. In other words, I read it as each process has established reqirements -- written or unwritten, it doesn't matter. Dept. managers review those requirements and their employees and determine if an employee needs training to meet the process requirements. So if a process requires A, B & C, the Manager determines if the employee can to A, B & C. If he can do A, but not B & C, then the employee is trained to do B & C. You should be looking to see that the employee's ability was reviewed and any training necessary documented appropriately. Good luck.

 

[Jason PCSwitches]

Agree with Golfman25, you should audit the effectiveness of the training. No requirement exists (from what you have stated in your procedures) for a DOCUMENTED statement of training requirements. If the process owner can demonstrate effectiveness, move on; otherwise your splitting hairs. If they can't then you have a valid justification for a CA & perhaps documented requirements could be part of the corrective action.

Regardless it's not for you to decide. Let them handle it and provide guidance along the way - if they seek such.