Internal Auditing in a Multi-Site Environment

[Big Jim]

Re: Internal auditing in a multisite environment

Not in my experience... I based my comments on successfully managing a TS 16949 Internal Audit programme - System, Process, Product and LPAs (for Chrysler) and NOT predicting a calendar for the QMS, which worked very well, without making multiple changes as issues were encountered. This practical experience, leading to a successful TS registration (and multiple product launches) was done with the full collaboration and understanding of the plant staff, with a smooth transition to the TS co-ordinator after I moved on to another assignment.

If you can do that, great. I would find it much easier with a calendar just as I find life easier with a watch.

 

[AndyN]

I think you might be missing my point, Jim. Here's my concern about having a calendar based audit programme, so that others reading this may benefit:

Firstly, no-one has a crystal ball to be able to predict which parts of the system, particularly over 12 months away. The result is that auditors could be assigned to parts of the system which are unrelated to any business issue being experienced. The audit/auditor is then perceived as being "useless" other than to maintain ISO compliance (most of the reason audits are done)

Secondly, to commit to such a calendar and then keep on modifying it is making the audit programme owner seem as if they are always changing their mind - with the perception that they may not know what they are doing or can't stick to a plan once published.

Both of these scenarios are a strike against an already poorly understood part of ISO requirements, so not helping to create them is of paramount importance - especially since a calendar is NOT what is required. It's simply a conventional wisdom, clung onto by those who have yet to see an alternate.

 

[JaneB]

Good points, Andy.

In some organisations, where operations are relatively repeatable and static, and not much change occurs, a calendar or schedule is workable. And yes, it certainly keeps the average external auditor satisfied.

But in any kind of dynamic, changing, growing or fast-moving one, the old 'yearly schedule' simply isn't worth the trouble of drawing up. Only to keep modifying it, as you point out.

 

[Big Jim]

I think you might be missing my point, Jim. Here's my concern about having a calendar based audit programme, so that others reading this may benefit:

Firstly, no-one has a crystal ball to be able to predict which parts of the system, particularly over 12 months away. The result is that auditors could be assigned to parts of the system which are unrelated to any business issue being experienced. The audit/auditor is then perceived as being "useless" other than to maintain ISO compliance (most of the reason audits are done)

Secondly, to commit to such a calendar and then keep on modifying it is making the audit programme owner seem as if they are always changing their mind - with the perception that they may not know what they are doing or can't stick to a plan once published.

Both of these scenarios are a strike against an already poorly understood part of ISO requirements, so not helping to create them is of paramount importance - especially since a calendar is NOT what is required. It's simply a conventional wisdom, clung onto by those who have yet to see an alternate.

I didn't miss your point. You missed mine.

From an earlier post on this thread:

"An audit program shall be planned, taking into consideration the importance of the processes and areas to be audited, as well as the results of previous audits. The audit criteria, scope, frequency, and methods shall be defined."

Most of all, the internal audit schedule should be a living document that is modified as frequently as needed to accommodate changing conditions in your QMS.

If you can keep track of all that in your head, more power to you. Not everyone can keep up with the mental gymnastics and having a reference point to work with helps keep it real.

Many people don't have that ability. You say you do. I don't question that. Claiming that no one needs a tool other than their brain just isn't accurate.

An even bigger factor here is that there are different approaches and different tools available to accomplish any task. A well equipped tool box provides flexibility.

Isn't that our job here, to help provide additional tools?

I especially like the tag line that speaks to this: When the only tool you have is a hammer, everything looks like a nail.

 

[JaneB]

Most of all, the internal audit schedule should be a living document ...

Hmm. You are reading things into the Standard that aren't there, I think. Where does it say that there must be an 'internal audit schedule' or 'calendar'? Where does it say this must be a document that is updated as required?
Yes the program must be planned. But as with other requirements, the Standard does not specify the how. I agree with you that a documented schedule/calendar is one way of doing that. I'll even agree that it's a common way of doing it. But it isn't the only single way to do it, let alone prescribed.
One example from a company I work with: the executive management team has audits at 4-monthly intervals, so about 3 times a year. The content and scope of these is determined and planned by the team (yes, they own their system and there's no separate 'quality department'), usually via their regular meetings and according to what they decided should be or needed to be audited.

If you can keep track of all that in your head, more power to you. Not everyone can keep up with the mental gymnastics ...

Ignoring the sarcasm, I didn't or don't see any claim by Andy that all was kept track of 'in his head'.
See the example above for just one example of how it can be done. That isn't 'mental gymnastics', it's management owning their system and driving it, to get what they want.
Surely you'd agree, Jim, that there's always - always- more than one way to meet a requirement, no matter how suitable one thinks the most commonly used method is?

Isn't that our job here, to help provide additional tools?

Job? I don't think of what I do here as a job. Yes I contribute and provide help if and where it's asked for and when I have the time. But a critical point in any healthy online forum is also to discuss and debate with other professionals in the field. And to explore and challenge each other's thinking, assumptions and beliefs, as well as learn from each other. It is - or should be - possible to do that without resorting to digs at the other person.

 

[somashekar]

Re: Internal auditing in a multisite environment

Planned intervals doesn't mean the same as a time based frequency. In fact, the previous version of ISO9004 actually said that audit scheduling should be flexible. Having a calendar and then keep changing it doesn't make sense...

To plan is to decide in advance. So even if I use the outlook express to do it., it is some sort of a calendar. It is time based frequency, only that the time base is decided based on several factors like process importance, result of previous audit and the changes that happens in the organization, both personnel, business.
Just as we talk retraining periodically after training, the same is to auditing.
Jim is simply clear, and not so sure what Andy is clarifying.....

 

[BradM]

Folks....all here should be able to express passion without being personal.

Let's keep it civil.

 

[Greg_F]

Hello contributers,

thank you very much for your input. It definitely increase my perspective regarding this topic.

Greg