Personnel Not Following Procedures - How do you write up an audit finding?

[RoxaneB]

Now, Coury - go wash your mouth out and never, ever write that again!

Children, behave. Don't make me separate you two.

Coury, what Andy is trying to say is what if the issue isn't training? What if the documented procedure was not developed so that it reflects what is truly supposed to happen?

By citing the finding that the practice and the documentation don't match, you leave it to the recipient to determine the issue (i.e., lack of training, poor document, etc.)

Don't assume that it's the operator.

 

[Coury Ferguson]

Hi,If personnel do not follow procedure, its of no use to generate NCs or any records.

Why, would you state this above, based upon your statement below?

The people have to be trained first, followed by strict vigil whether they follow or not. They have to be constantly instructed till they imbibe those requirements. Training should not be superficial but should be given with the intent of convincing the people of the benefits of the procedure.

If this is true, than why wouldn't you want to document the error? Is there some reason that this should not be identified as a training issue?
For example: I was the trainer and I don't want to point out my errors in training.

Its said that "Practise makes a man perfect". The inner meaning of this sentence is that if a man practices certain thing, he will continue doing it in a particular way and hence becomes consistent. Consistency is what makes him Perfect.

Perfection is achieved through perfect practice. Again isn't training part of this?

So to put in simple terms, "Practise makes a man follow the Procedure". If it can not be solved, then resort to warnings, discussion in Management Review Meetings etc.

Aren't findings/observations all part of the information that is discussed during Management Review? Always trying to improve the system.

Main Entry: 1per·fect
Pronunciation: 'p&r-fikt
Function: adjective
Etymology: Middle English parfit, from Anglo-French, from Latin perfectus, from past participle of perficere to carry out, perfect, from per- thoroughly + facere to make, do -- more at DO
1 a : being entirely without fault or defect : FLAWLESS <a perfect diamond> b : satisfying all requirements : ACCURATE c : corresponding to an ideal standard or abstract concept <a perfect gentleman> d : faithfully reproducing the original; specifically : LETTER-PERFECT e : legally valid
2 : EXPERT, PROFICIENT <practice makes perfect>
3 a : PURE, TOTAL b : lacking in no essential detail : COMPLETE c obsolete : SANE d : ABSOLUTE, UNEQUIVOCAL <enjoys perfect happiness> e : of an extreme kind : UNMITIGATED <a perfect brat> <an act of perfect foolishness>
4 obsolete : MATURE
5 : of, relating to, or constituting a verb form or verbal that expresses an action or state completed at the time of speaking or at a time spoken of
6 obsolete a : CERTAIN, SURE b : CONTENTED, SATISFIED
7 of a musical interval : belonging to the consonances unison, fourth, fifth, and octave which retain their character when inverted and when raised or lowered by a half step become augmented or diminished
8 a : sexually mature and fully differentiated <a perfect insect> b : having both stamens and pistils in the same flower <a perfect flower>
- per·fect·ness /-fik(t)-n&s/ noun
synonyms PERFECT, WHOLE, ENTIRE, INTACT mean not lacking or faulty in any particular. PERFECT implies the soundness and the excellence of every part, element, or quality of a thing frequently as an unattainable or theoretical state <a perfect set of teeth>. WHOLE suggests a completeness or perfection that can be sought, gained, or regained <felt like a whole person again after vacation>. ENTIRE implies perfection deriving from integrity, soundness, or completeness of a thing <the entire Beethoven corpus>. INTACT implies retention of perfection of a thing in its natural or original state <the boat survived the storm intact>.

 

[Coury Ferguson]

Children, behave. Don't make me separate you two.

Coury, what Andy is trying to say is what if the issue isn't training? What if the documented procedure was not developed so that it reflects what is truly supposed to happen?

By citing the finding that the practice and the documentation don't match, you leave it to the recipient to determine the issue (i.e., lack of training, poor document, etc.)

Don't assume that it's the operator.

Rox,

What if scenarios I agree. Here is the original posts:

How do you write up an audit finding when you observe that personnel are not following procedures?

In this instance an engineering group did not follow procedure and enter in data after their work was done. They stated that it added no value to them, however, they did not see that other areas needed that data as an input to their work...fairly typical...

What If: With the underlined issues in the above post does this not say that they may have not understood their procedures (Training)?

What If: It is a lack of documented procedures. But I don't think I see that scenario here.

What If: The personnel just don't want to complete the required entry? This What if scenario is very possible.

I don't totally disagree with AndyN on his statement in the following post:

Sure, all auditors can 'expect' management to take them seriously, but since when did we do something serious that management could recognize? Certainly not referencing an element of ISO! Heck, most management secretly wish the durned ISO thing would go away...........

The mananagement mantra has always been "don't bring me a problem, bring me a solution". So, when we deliver an audit finding and we omit the 'effectiveness' part, we aren't doing anything to help out! Why do you think that most corrective action databases are full of issues management isn't really trying to work on? Do you think that an organization's management team is losing sleep at night over that kind of issue?

Perhaps this is one reason 6 Sigma has more kudos than anything else. The folks actually identify the issue and work on solutions.

Of course 2nd/3rd party auditors have to cite ISO requirements, it's their job, but my guess is that it's less relevant to an internal auditor (tho' the audit manager/mgt rep. should know).

Oh, and another thing - why does everything have to have a corrective action? Why constrain yourself to using a sledgehammer, when sometimes things just require 'correction' which is also very legitimate?

I know that most upper management don't want to be bothered with these types of findings. But the point here is that there should be a NC written, based uopn the finding "of not following the procedures." If management wishes not to take any action then fine, but at least it has been documented.

 

[Ajit Basrur]

Hi Coury,

I am not undermining the importance of TRAINING. This is the most important to make them aware but if you are going to come up with NCs and subsequently Corr Actions and Prev Actions etc, its not always a good solution.

I tell you the example of my previous organisation which was a Pharmaceutical company and as a site, we had about 500 procedures. Since the proocedure had to detailed, step wise instructions used to be mentioned. I give you the example of Water sampling. The procedure would mention a sequence and ideally, anyone would say that every sampler should carry the procedure and follow it. Do you expect that the sampler would always read step by step and do sampling ??? There would be a stage when he will feel that he has mastered a technique and shall not refer the procedure. When he doesnot refer, may be he misses one step (may not be crucial) BUT THEORETICALLY HE HAS NOT FOLLOWED THE PROCEDURE.

NCs, discussion in Management Review Meetings etc are not always good solution to address the Human Pyschology. Another thing I have seen the more you try to be transparent, people will try to hide things and not following procedure is a classic example of this.

 

[Jen Kirley]

Sounds to me like the people in the example don't feel they are part of a controlled system. The engineers might not feel like they are much a part of the QMS as shop floor personnel. I've seen this elsewhere as well.

In the case of regulated industries like pharma, if procedures are clear and understood, appropriate and easily available then personnel discipline might be called for. There are some proceses and industries one just can't fool around with or go soft on.

 

[AndyN]

I know that most upper management don't want to be bothered with these types of findings. But the point here is that there should be a NC written in violation of the procedures. If management wishes not to take any action then fine, but at least it has been documented.

Coury, I can tell it's a frustration.

So, you say that the data wasn't entered but others use it, so what does not having the data available cause the folks who use it as an input? Do they have the wait, or spend time chasing it down someplace? - What I'm looking for is an inefficiency caused by the Engineering folks not 'following procedure'. That can be evaluated in terms of $$$ and since your accounting system probably doesn't capture that, no-one will argue if you calculate what it costs over a year! Well, they will, but they won't have more credible info. An internal auditor I worked with found $8M savings due to this kind of thing!:mg: It wasn't written as an nc or 'finding', but in the verbal and written audit summary report it was clearly identified.

Oh - one other thing. Can I (respectfully) suggest that you stop calling them 'violations'.........for those folks who already have a dislike for audits such a word confirms that it's about being "policed" against "stupid laws"........ I know a rose by any other name, but it doesn't help your case
Andy

 

[Coury Ferguson]

Coury, I can tell it's a frustration.

Oh - one other thing. Can I (respectfully) suggest that you stop calling them 'violations'.........for those folks who already have a dislike for audits such a word confirms that it's about being "policed" against "stupid laws"........ I know a rose by any other name, but it doesn't help your case
Andy

Frustration: No I have been in this business for along time and I have seen a lot of this. This isn't my first Rodeo.

Violations: What would you like me to call them? Findings-ok

 

[E Wall]

How do you write up an audit finding when you observe that personnel are not following procedures?

Without getting into the specifics of what procedure isn't being followed ask yourself these questions:
What is/are the goal/s of the affected process?
What is the purpose of this 'procedure' and the impact of not follwoing it?
NOTE: Remember you can have standardized procedures that are not documented

Lets provide an example:
Process - paying bills by snail mail
part of the standard procedure requires postage to be applied to the envelope. If the norm is 'lick the stamp and apply' yet someone 'wipes with a damp sponge and applies' is there an impact? Don't go bogging example down with just how wet is too wet - agree for argument sake both methods apply just enough moisture to activate glue and provide good adhesion of stamp to envelope.

Does it matter the procedure wasn't followed - NO
Should there be a NC - NO
Should there be an 'Opportunity For Improvement' written - Sure, alternate methods can be used - give your process enough flexibility. Just be sure to evaluate the potential negative consequences and plan accordingly.​

If in your situation there is a negative impact, you will get more buy-in if its possible to show an impact to the process goal(s).

Something to remember is that short of 'sabotage' - Something in your system allows for individuals to make errors, if you cannot error-proof (feasibility, cost, time, whatever...) do what you can to catch the error before an escape occurs to the next process. IF there is enough value to it - collect data to improve within the process and also provide feedback loop from direct customer (next process - not actual end user) to work on any issues if you do have escapes. Bolster your training so individuals all know the potential impact of not following procedure.

Hope this helps, E

 

[Coury Ferguson]

Without getting into the specifics of what procedure isn't being followed ask yourself these questions:
What is/are the goal/s of the affected process?
What is the purpose of this 'procedure' and the impact of not follwoing it?
NOTE: Remember you can have standardized procedures that are not documented

Lets provide an example:
Process - paying bills by snail mail
part of the standard procedure requires postage to be applied to the envelope. If the norm is 'lick the stamp and apply' yet someone 'wipes with a damp sponge and applies' is there an impact? Don't go bogging example down with just how wet is too wet - agree for argument sake both methods apply just enough moisture to activate glue and provide good adhesion of stamp to envelope.

Does it matter the procedure wasn't followed - NO
Should there be a NC - NO
Should there be an 'Opportunity For Improvement' written - Sure, alternate methods can be used - give your process enough flexibility. Just be sure to evaluate the potential negative consequences and plan accordingly.​

If in your situation there is a negative impact, you will get more buy-in if its possible to show an impact to the process goal(s).

With this scenario a finding would not be considered. But the OP states that the personnel just didn't want to enter the data because they felt that it wasn't cost effective. See OP below:

In this instance an engineering group did not follow procedure and enter in data after their work was done. They stated that it added no value to them, however, they did not see that other areas needed that data as an input to their work...fairly typical...

Something to remember is that short of 'sabotage' - Something in your system allows for individuals to make errors, if you cannot error-proof (feasibility, cost, time, whatever...) do what you can to catch the error before an escape occurs to the next process. IF there is enough value to it - collect data to improve within the process and also provide feedback loop from direct customer (next process - not actual end user) to work on any issues if you do have escapes. Bolster your training so individuals all know the potential impact of not following procedure.

I agree with you on this issue.

 

[qualityboi]

Wow. I am impressed on how much thought goes into writing up or not writing "not following procedures." Let me clarify my particular situation. 1. The procedure is documented. 2. Without the procedure being followed there is a potential impact to safety. Other groups and personnel that work with the equipment would not know what exhaust lines were being altered that connect to a piece of equipment.
I think there was some failure on our part, not that we needed to necessarily train the engineers (because they know how to do the data entry) but to communicate to the engineers the importance of entering in the data. You could call communication training I guess its semantical.

I should have clarified some important assumptions... which is that procedures in a company are not frivolous...they impact the businiess/product/customer, or safety and the procedure is a documented procedure.