Informational Internal Audits - Wear multiple hats what can and can't I audit (so I'm not auditing my own work)

[ranjit3219]

I work at a small company where I wear many hats. I'm new to quality and putting together an internal audit plan for the first time. I started off with our key processes(sales, D&D, purchasing/inventory, and production), and for each key process listed the process document(each key process has multiple process documents and process owners) and corresponding process owners. My problem is when I look at the four key processes and process owners my name is showing up as a process owner for one of the process documents in 3 of the 4 key processes. Does that mean I can't audit these areas?

Hi,
I can understand your situation.
The purpose of any audit is find out objective evidences by impartial perspective towards compliance to standard or directive or even SOP.
For gathering and understanding the objective evidences the auditor must be competent (which you are definitely).
Now coming to impartiality part there is a reason that standard states auditor shall not audit his own work because over the years we get habituated with things that we only either find faults or overlook them. This becomes a problem in your case to prove to the auditor of certification body of how you maintained impartiality.
Thus one thing is for sure you cannot audit your own work wherin the responsibility is directly associated to you and not the authority (thats the reason why organizations used to have Management representative, till everyone decided it is the job of MR to manage QMS).
Short but sweet get a third party auditor for internal audit this time, create a cross functional team for next audit.
Hope it helps.

 

[embedded]

Wow, I think I understand the requirement now and based on this discussion the requirement seems to be unclear.... I have another question related to internal audits, not sure if I should start a new thread, but here goes....

In my personal experiences with external auditors, audits are very subjective. What I mean by this is when a smooth talking sales type person is in an audit I'm amazed to watch them consistently talk there way out of findings - I know what the issue is, the auditor notices it, then the person just talks and talks and talks until the auditor gives up and decides it's not a finding. I want to avoid this at all costs with our internal audits, as our goal is to improve. We recently got internal auditor training, and I liked the fact that they trained us it's all about the records, and we should talk to multiple people. This approach would seem to avoid the fast talking people, as interviews with others would show conflicting information. So here is where I'm torn, I don't want to bias other internal auditors but I do want to give them direction to not talk to the fast talking manager or to ensure they talk to the people actually doing the work. Is this OK to do? I'm a little nervous about this as I think I may piss off this fast talking manager, and another goal we have is to not alienate people, we want them to understand we're all on the same team and internal audits are a good thing.

If helpful what I observe from external audits is if we're in production then the auditor talks to lots of people and looks at lots of records from different people, but for any other department they only talk to the person we guide them to - the manager. To be fair the auditor may not know if it's just the manager that does this job, or if there are other people. This seems like a flawed audit approach to me(only talking to one person, the same person for multiple audits)...

 

[Mike S.]

So here is where I'm torn, I don't want to bias other internal auditors but I do want to give them direction to not talk to the fast talking manager or to ensure they talk to the people actually doing the work. Is this OK to do?

IMO it is not only okay, if the goal is truly improvement then to "ensure they talk to the people actually doing the work" is essential.

 

[Mike S.]

Nope, as a 3rd party I've seen it, validated the objectivity and impartiality of the process and all the gobblety goo that goes with it, said nice job, and moved on to more serious stuff

Now this little dose of applied common sense sounds like it is meeting the intent of the requirement, IMO.

 

[AndyN]

We recently got internal auditor training, and I liked the fact that they trained us it's all about the records, and we should talk to multiple people.

I'm not sure you got the right direction here. It isn't ONLY about records. It may not be possible to talk to multiple people. It sounds to me that you got internal auditor training, delivered through the optics of an external auditor.

When you find a person "talking themselves out of" a finding, I'd suggest that what the auditor has found isn't relevant to their process, or is something like an ISO requirement they don't understand or similar. If it's about their process, affects their performance or similar, they will try to dodge the bullet. As with many things, when you point at something, three fingers are point back at the pointer...

 

[Coury Ferguson]

I agree with Mike. As an Internal Auditor part of the interview process technique is to talk to the people actually performing the work. How could you get a fair understanding that the people actually responsible for the product understand and know where to get the information needed to perform their job. I specifically tell the Manager, that their place is an observer not the interviewee. The only time I allow a Manager to talk is when I ask them a specific question. I also, tell them that can't give the "silent dialog" when talking with the interviewee. If I see it, I ask the Manager and even their boss to leave during this audit. If they wish to challenge any observations/NC they can during the daily out-brief that I usually have.

Just my opinion and how I perform Internal Audits.

 

[AndyN]

If I see it, I ask the Manager and even their boss to leave during this audit. If they wish to challenge any observations/NC they can during the daily out-brief that I usually have.

I'm really worried by this! As internal auditors, our job is to ENGAGE management in taking ownership of their process(es) and understand if it's working as planned, and, where it isn't why that's so. When you don't engage them, they WILL push back. I'd offer that until you engage them at all stages and use audit criteria they buy into - process performance - you are doing them, and the internal audit process/benefits a disservice.

 

[Coury Ferguson]

I'm really worried by this! As internal auditors, our job is to ENGAGE management in taking ownership of their process(es) and understand if it's working as planned, and, where it isn't why that's so. When you don't engage them, they WILL push back. I'd offer that until you engage them at all stages and use audit criteria they buy into - process performance - you are doing them, and the internal audit process/benefits a disservice.

Andy,

My concern is that the Manager tries to answer for the interviewee. That is not what I am looking for during the internal audits. I am looking for knowledge, competence, understanding and more from the Interviewee, not the manager. Managers are interviewed during Leadership process.

 

[embedded]

My concern is we have processes documented, but if you talked to >75% of the people in the department they'd have no idea where the processes are defined or what they are. Although, if you talk to the manager they are familiar with the processes and where they are documented. If we try to attack this from a training record standpoint I'll be told we don't have any training records since all the employees have been here longer than we have been ISO certified. So how do you expose this elephant in the room, unless we talk to the people doing the work(I'm clearly biased and I am not auditing this department as a result)?

 

[Golfman25]

My concern is we have processes documented, but if you talked to >75% of the people in the department they'd have no idea where the processes are defined or what they are. Although, if you talk to the manager they are familiar with the processes and where they are documented. If we try to attack this from a training record standpoint I'll be told we don't have any training records since all the employees have been here longer than we have been ISO certified. So how do you expose this elephant in the room, unless we talk to the people doing the work(I'm clearly biased and I am not auditing this department as a result)?

I wouldn't do it that way. It's really unfair to use "ISO lingo" for shop floor type personnel (worker bees). If you go down and talk about "process" I am sure their eyes glaze over and they have no clue (or even care) what you're talking about. If you go down and say "show me what you do" you'll have more success. Let them show you what they do and how they do it, what instructions they use, what records they keep, etc. Then match that to the defined process. I find more success the less "ISO" there is.