Poll: Should auditors promote the process approach?

[Stijloor]

Re: Should auditors promote the process approach?

Do you know of any auditor training courses that explain use of an applicability matrix as a key tool to guide audits in a process approach fashion?

I teach the process approach in my internal audit course.
After the processes to be audited have been identified, I explain how the requirements link with the process.
Requirements such as:

• ISO 9001
• Internal
• Customer
• Regulatory
• Statutory
• Other

Not a specific matrix per se, although a CB may require a matrix to show how processes and ISO 9001 (or any other Standard) link.

Stijloor.

 

[ISO 9001 Guy]

Re: Should auditors promote the process approach?

I teach the process approach in my internal audit course.
After the processes to be audited have been identified, I explain how the requirements link with the process.
Requirements such as:

• ISO 9001
• Internal
• Customer
• Regulatory
• Statutory
• Other

Not a specific matrix per se, although a CB may require a matrix to show how processes and ISO 9001 (or any other Standard) link.

Stijloor.

I use one up front in consulting projects to determine which requirements apply to clients' processes, then again upon finishing clients' documents to ensure their resulting procedures meet all applicable requirements in process approach fashion. Such a handy tool. I don't see how good process-based audits are done thoroughly and precisely without them! I notice AS 9101D is including them among auditors' audit tools, as AS9101D appears to be getting serious about the process approach.

 

[ISO 9001 Guy]

Re: Should auditors promote the process approach?

After the processes to be audited have been identified, I explain how the requirements link with the process.
Requirements such as:

• ISO 9001
• Internal
• Customer
• Regulatory
• Statutory
• Other

Yes, the key is to define processes appropriately by writing procedures to really reflect how processes operate. Then--needing to interpret the standard to the processes rather than the other way around (which is night and day easier for organizations to deal with)--we can use a matrix to ensure that "what they do" meets the very basic requirements applying to the process at hand.

That way, when an auditor verifies conformity to a PROCEDURE, s/he is doing two things simultaneously: 1) verifying conformity to management's "planned arrangements," while also 2) verifying conformity to the requirements of the standard. So by (naturally) addressing the treatment of ISO requirements, customer requirements, statutory/regulatory requirements in procedures linking to processes where they pertain, we assure processing complies with those requirements.

That's why it makes sense for quality auditing to be a two-step. (Roughly, it goes like this . . .) Stage 1: review documented arrangements to determine if they demonstrate conformity to the standard. 2: assess working practice to determine if it complies with the documented arrangements. It's kind of like transitivity. If A = B and B = C, then A = C. Similarly, if a procedure meets the applicable requirements of the standard, and working practice meets the requirements of the procedure, then working practice meets the requirements of the standard.

The matrix becomes very useful in identifying precisely which requirements pertain to which processes. Once clear about that, one can focus on a process to determine the degree to which applicable requirements are being met, rather than focusing on the requirements first and finding processes to apply them to.

 

[Randy]

Randy, I agree that what you want as an auditor is irrelevant. As a quality professional, you should have your clients' best interests in mind. Right?

I don't consider myself a quality professional and have never made that claim...I have expertise and I work in the quality field occasionally.

The quality professionals are lots of these other guys here that I learnify me.

 

[JaneB]

The quality professionals are lots of these other guys here that I learnify me.

Aw shucks, hon. Doan' you go putten' yornsef down, now, ya hear?

 

[Richard Pike]

If an organization has not adopted the process approach, is it appropriate and proper for a third-party (registrar) auditor to formally identify "adopting the process approach" as an opportunity for improvement?[/B]

Thanks!

Wow - stepping in here, will be like stepping onto a frozen lake with 5mm (+/- 1mm) of ice. dangerous.

But, i am old enough to live dangerous. I run a training and consulting organization and am also a practicing senior//lead auditor contracting for various Registrars and am also licensed to Train on behalf of 3 National Auditor Certification Bodies. My point is, simply that I get to see a number of different stances.

The Registrars I contract for would withdraw if at initial discussion or at Stage 1 , it was evident that the organization had no concept of a basic Process Approach or who could not adequately justify why such an approach was not suitable for their organization.

Formal recommendation of the Process Approach during Audit would therefore not arise.

 

[Jen Kirley]

Re: Should auditors promote the process approach?

The guidance is to urge auditors to promote the process approach to organizations not using the process approach, isn't it, rather than for auditors to use the process approach to audit?

This infers the auditor is doing something besides auditing.

 

[ISO 9001 Guy]

Wow - stepping in here, will be like stepping onto a frozen lake with 5mm (+/- 1mm) of ice. dangerous.

But, i am old enough to live dangerous. I run a training and consulting organization and am also a practicing senior//lead auditor contracting for various Registrars and am also licensed to Train on behalf of 3 National Auditor Certification Bodies. My point is, simply that I get to see a number of different stances.

The Registrars I contract for would withdraw if at initial discussion or at Stage 1 , it was evident that the organization had no concept of a basic Process Approach or who could not adequately justify why such an approach was not suitable for their organization.

Formal recommendation of the Process Approach during Audit would therefore not arise.

The guidance states that it should be brought to a client's attention at Stage 1, doesn't it? So it appears you are in agreement. ?
When your registrars "would withdraw," would they state why they withdraw? In other words, would it be appropriate for your registrars to refer the client to ISO-approved guidance regarding the process approach? And then come back later when a real QMS is available for assessment?

 

[ISO 9001 Guy]

Re: Should auditors promote the process approach?

This infers the auditor is doing something besides auditing.

Audits are conducted for three reasons: 1) conformity, 2) effectiveness, and 3) to identify opportunities for improvement. Identifying opportunities for improvement IS part of an auditor's job, is it not? According to the guidance, it seems it is also the auditor's job to determine if organizations are effectively "doing it right." Does this seem like such a stretch?

 

[Jen Kirley]

I'm an internal auditor, not a CB.

Nonetheless, I can promote a process approach without anyone but me realizing it. When I ask for evidence of effectiveness in the process, it's asking for metrics, but also how the person can understand how things are working. It's hard to do that when there are simply a jumble of activities.

I can also point to problems and, without coming out and saying the auditees are not approaching the activities as a process, ask for improvements that would fill at least some of the gaps. I do this because if I start taking about a process approach, their eyes would glaze over.

The standard is set up to promote a process approach by requiring certain activities get formal planning, upkeep, reviews for effectiveness, controls and renewals. Connections between groups are established in clauses dealing with design, suppliers, HR and others.

As an auditor I can promote that simply by paying attention to the standard and pointing out disconnects in responsibility and authority, the lack of needed plans/controls, failure to perform required reviews and approvals, and so on. I can do this within the confines of my well defined role, but should go farther only when asked for advice or approving CA plans and activities.

I can go farther when invited, such as helping my customers make turtle diagnrams in preparation for their registration audits. This helps them understand the process approach by identifying what is important to what else (relationships), and why (outputs and outcomes).