Remote auditing (for disaster, disease, disturbance etc...) during the Neo Coronavirus Pandemic and Social Distancing

[Randy]

Are any of you folks that are actively engaged in the 3rd party auditing world like me having to do a fast catch up and refresher on "IAF MD4 Mandatory Document for the Use of Information and Communication Technology (ICT) for Auditing/Assessment Purposes" because of Corona Virus (Covid19)? I've received about half a dozen procedure/policy updates today myself.

 

[Sidney Vianna]

Are any of you folks that are actively engaged in the 3rd party auditing world like me having to do a fast catch up and refresher on "IAF MD4 Mandatory Document for the Use of Information and Communication Technology (ICT) for Auditing/Assessment Purposes" because of Corona Virus (Covid19)? I've received about half a dozen procedure/policy updates today myself.

So, tell us: how would you plan to perform a REMOTE management system audit when the auditee's workforce is working from home, practicing social (and professional ) distancing? It is quite obvious that a lot of audit evidence won't be available for review.

One thing is to perform a remote audit when the only remote person is the auditor. It is a TOTALLY different thing to plan an audit when, pretty much, everyone is working remotely from their kitchen tables. It is time for the Accreditation Bodies to realize that and release some common sense guidance. However, they tend to react with the speed of an elderly snail, stuck in first gear, with the parking brake engaged.

 

[Randy]

Taking a break

Doing one right now using Skype and phone, showing the organization dashboard, documents and everything else as well as limited interview and verification with some email taking place, onsite needs are deferred until 2021 and requires extending the duration appropriately. This one schedule to be 2.5 days onsite but remote 1.5 days and next year going from 2.5 to 3.5 days that will include all the production line visits, warehousing and all that.

 

[Randy]

So, tell us: how would you plan to perform a REMOTE management system audit when the auditee's workforce is working from home, practicing social (and professional ) distancing? It is quite obvious that a lot of audit evidence won't be available for review.

One thing is to perform a remote audit when the only remote person is the auditor. It is a TOTALLY different thing to plan an audit when, pretty much, everyone is working remotely from their kitchen tables. It is time for the Accreditation Bodies to realize that and release some common sense guidance. However, they tend to react with the speed of an elderly snail, stuck in first gear, with the parking brake engaged.

You're right about people working remote so we're doing a 9-10 hour conference call and conference Skype that people enter and leave as necessary.

"It is quite obvious that a lot of audit evidence won't be available for review." It's also quite obvious that a lot of evidence is available for review as well especially when an entity like this one is almost paper free and subjected to numerous external audits and inspections throughout the year (These folks are currently on the front line making disinfectant wipes). Example, I'm able to follow a customer order from receipt, to delivery, receiving inspection, to analytical and microbial lab analysis, through production and shipping.....All electronically. The only thing missing is actually watching it (we'll do that next year). Following up today I'll be verifying equipment maintenance, instrument calibration and employee competence/training involving the materials/order I selected...........All electronically (the only things missing are observing a screwdriver being turned, cal sticker being placed, or someone doing CBT for a work instruction)

The workforce isn't at home, in fact they've added some people and increased production on a couple lines while reducing production on less health & safety critical products.

If organizations had their heads in the right places this would be nothing more than a contingency plan in a Business Continuity Program (part of the QMS here and another MOC issue)

 

[Sidney Vianna]

If organizations had their heads in the right places this would be nothing more than a contingency plan in a Business Continuity Program (part of the QMS here and another MOC issue)

Do you have ANY EVIDENCE that shows that organizations compliant and certified to ISO 22301:2019 are not facing any disruption during this pandemic crisis? BC plans are, in the overwhelming part, paper exercises that don't survive 10 seconds of reality.

Yesterday, I saw the following in LinkedIn. Even the colors remind me of ambulance chasing marketing.

​

 

[msnavyautomotivequality]

You're right about people working remote so we're doing a 9-10 hour conference call and conference Skype that people enter and leave as necessary.

"It is quite obvious that a lot of audit evidence won't be available for review." It's also quite obvious that a lot of evidence is available for review as well especially when an entity like this one is almost paper free and subjected to numerous external audits and inspections throughout the year (These folks are currently on the front line making disinfectant wipes). Example, I'm able to follow a customer order from receipt, to delivery, receiving inspection, to analytical and microbial lab analysis, through production and shipping.....All electronically. The only thing missing is actually watching it (we'll do that next year). Following up today I'll be verifying equipment maintenance, instrument calibration and employee competence/training involving the materials/order I selected...........All electronically (the only things missing are observing a screwdriver being turned, cal sticker being placed, or someone doing CBT for a work instruction)

The workforce isn't at home, in fact they've added some people and increased production on a couple lines while reducing production on less health & safety critical products.

If organizations had their heads in the right places this would be nothing more than a contingency plan in a Business Continuity Program (part of the QMS here and another MOC issue)

Hello Randy, How do I get more information about auditing through Skype. Virtual?

 

[Miner]

My company has had several external audits using Microsoft Teams on a tablet or handheld device. Our company rep would take the device on the floor so the auditor could directly view and interview the auditee in the work environment as well as see the workspace. Recently, we added the use of Vuforia Chalk, so the auditor could circle areas of interest for a closer examination. So far, it has worked out very well for all parties involved.

As mentioned in an earlier post, while most of our salaried workforce works remote, our manufacturing associates and supervisory workforce cannot.

 

[Randy]

Hello Randy, How do I get more information about auditing through Skype. Virtual?

The norm for me and recommended by my CB for a variety of reasons including security is for the client (auditee) to set virtual meetings using whatever platform they desire to use (there are 1 or 2 that are asked to be avoided, but in the end it's the client's decision) and for us to be invited as a "Guest". By their setting the meetings up and selecting the platform they maintain control of the connection and not us (me). The best and easiest is for a single meeting per day to be set and participants can join and leave as need be (during breaks, lunch, etc, we normally just mute the mic's and turn off or block the camera's). The most common platforms I've experience are MS Teams, Skype, and WebEx. I have done some Zoom, Google and one or two others. For virtual Tours/Observations Skype and MS Teams seem to be the easiest for the folks on the other end to manage while I observe (Virtual Tour/Observation are time consuming and require really good communication/coordination). I did have a client who's CCTV covered almost 100% inside and out, in color, with quite a few camera's that had zoom in lenses..........Almost as good as being there!

So far, since March, I've done 60-70 days Remote and from this time forward with only one or two exceptions I have Remote work every week and some weeks I'm doing 2 or more clients and/or two or more locations for a single client in a single week (11 days this month and 16 total days in October........... I just did 4 days onsite this week and it seemed weird). A downside for me with remote is loss of that personal touch and the ability to shift focus rapidly as the audit progresses, plus on a virtual observation/tour you've got a 2 dimensional flat view that is very narrow.