Internal Audit Matrix Process Query

[ReworkIT]

Much appreciated!

Lastly, I'll be doing a Process Overview Sheet now for 'Leadership'.

Would anyone happen to have an example of or be able to provide suggestions for 'Process Inputs', 'Process Outputs', Resource Requirements' and 'Control Methods' specific to the 'Leadership' process.

As always, many thanks in advance!

If you are using a template for your audit schedule then the template may be forcing you somplace you don't want to be. My auditor trainer told me you can audit whatever you like. It allows you to decide when it says 'scope" and "criteria" etc., because when you look at the way the quality system operates it's often that the silos work, but what they hand over to another silo isn't any good. I know people on here (long time lurker) talk about "process approach" but that's NOT in the standard in 9.2.2 that I can tell.

 

[Sidney Vianna]

but I can't see where it says I have to audit a process.

If not auditing your processes, what, do you think, should be audited?

 

[ReworkIT]

If not auditing your processes, what, do you think, should be audited?

Maybe I'm wrong here, but I was told that you don't audit to guidance, you audit to requirements. As Mr Howste says, it might also be other things, not processes (if I understand correctly). I have no clue about the ISO document posted and I can't find a reference to it in my copy of ISO 9001:2015, but I may be wrong again. It's really a case of hopefully, not falling into a trap and missing something vital because of reading between the lines, does that make sense?

 

[howste]

If you are using a template for your audit schedule then the template may be forcing you somplace you don't want to be. My auditor trainer told me you can audit whatever you like. It allows you to decide when it says 'scope" and "criteria" etc., because when you look at the way the quality system operates it's often that the silos work, but what they hand over to another silo isn't any good. I know people on here (long time lurker) talk about "process approach" but that's NOT in the standard in 9.2.2 that I can tell.

In the 1990s when I first started auditing, the standard didn't require processes to be defined, and I generally audited based on departments, not necessarily processes. Since then things have changed, and now I find that auditing by process is the most efficient and effective way to conduct most audits. The process approach is in an introductory clause and was intended by the authors of ISO 9001 to apply throughout the standard.

Perkins201 started this thread asking for advice - "Any advice would be greatly appreciated!" Giving advice isn't the same as stating what's required. I often give people advice based on my own experience, trying to give help that will be useful and effective even if it's not required. I could just say "do whatever you want because the standard isn't specific," but that wouldn't be very useful. I find that posting in a thread just to say "that's not required" isn't helpful unless I also give some idea of a better way to do it.

 

[howste]

Much appreciated!

Lastly, I'll be doing a Process Overview Sheet now for 'Leadership'.

Would anyone happen to have an example of or be able to provide suggestions for 'Process Inputs', 'Process Outputs', Resource Requirements' and 'Control Methods' specific to the 'Leadership' process.

As always, many thanks in advance!

I'm not sure what your Process Overview Sheet is, but it sounds like it's probably similar to a turtle diagram. You can search the Post Attachments Files from the button at the top of the page and possibly find one.

A good starting point for inputs and outputs for leadership are found in 9.3.2 and 9.3.3 in ISO 9001:2015.

 

[perkins201]

As always, many thanks to all for your input. Very much appreciated!

I found the other process overview sheets required by our CB fairly straightforward - 'Management' doesn't strike quite as obvious. I've thought of a few examples of resource requirements, control methods, process inputs and process outputs - it just needs fleshing out a bit. I'll be looking through the 'Post Attachment Files' list very shortly for inspiration.

The extremely rational, differences of opinion as to how to apply/measure/audit certain procedures never ceases to amaze. As I mentioned in another thread, I had the 2008 internal audit matrix (no one knew of the existence of the procedures manual until some weeks later) dumped on my desk three years ago and was given six months to pass an external audit. This forum, to a large extent, takes credit for my passing.

I was dismayed by the news of the 2015 version as I'd almost reached 'aspiring amateur' competency in the 2008 version. Having a full-time role in my company already, trying to tutor one's self on how to go about passing the 2015 external audit is quite the challenge and I often sit here mistaking it for ancient Egyptian algebra (thanks for that one, Futurama). It's just heartening to know that even the scholars of the subject can be torn over which way to turn.

 

[Kronos147]

I know people on here (long time lurker) talk about "process approach" but that's NOT in the standard in 9.2.2 that I can tell.

The process approach is now one of the 7 management principles in section 0.2. That's the section right after 0.1 that describes how implementation of a management system is a strategic decision.

It's a system. You define it (clause 4) and audit it (clause 9).

 

[ReworkIT]

The process approach is now one of the 7 management principles in section 0.2. That's the section right after 0.1 that describes how implementation of a management system is a strategic decision.

It's a system. You define it (clause 4) and audit it (clause 9).

I understand your point and it's very true for the actual QMS. I'm still struggling to understand why I can ONLY audit processes? Can't I also audit a customer requirement being implemented "within" a process? Can't I also audit something like a regulation being implemented in our product design group on a new product. My auditor trainer suggested that many options are open to us, under "scope and criteria". Are you tell me the trainer is wrong?

 

[Sidney Vianna]

Can't I also audit a customer requirement being implemented "within" a process? Can't I also audit something like a regulation being implemented in our product design group on a new product.

If you inspect a product, are you auditing the inspection process? Answer is NO.

Don't confuse auditing with verification. Using your first example, if you CHECK that a customer requirement is implemented within a process, that is a component of an audit of that respective process. That exact requirement might be captured but another one might be missed.

Audits, in the context we are talking about here, are meant to verify that the system (via the processes) can consistently achieve results. To that effect, the auditor has to go beyond verifying that something in isolation is being complied with. S/he has to audit the process and it's intrinsic robustness.

 

[Kronos147]

I'm still struggling to understand why I can ONLY audit processes? Can't I also audit a customer requirement being implemented "within" a process?

Your training is not wrong.

Here is another way I think about it. Audit all the processes of the organization. One process may be "contract review". This process will have the customer requirements as one of the 'inputs'. By reviewing the process, you make sure the process correctly identified the customer requirements. Or, if the process is not 'supposed' to determine customer requirements, there is a nonconformance.


Our audit schedule has 'spot audits' and Corrective Action Verification of Effectiveness actions as part of our plan.

As an auditor-in-training, the thing you should be hearing a lot is 'follow the trail'.