Internal Auditor Resources

IThe American National Standards Institute, or ANSI, has an online method of providing information on the latest national and international standards-related activities. Their site address is:

http://web.ansi.org/ 

top of page

Featured Book of the Month:

Title: ISO 9001:2000 for Small and Medium Sized Businesses

Author: Herbert C. Monnich Jr

Publisher: American Society for Quality

Notes: Author Herbert C. Monnich, Jr. has taken readers into a seldom discussed but needed area of the ISO 9000 Standards - applying them to small and medium sized businesses. Monnich gears his book toward those with little or no ISO 9000 experience. Learn how the newly revised standards can be effectively implemented and maintained without spending large sums of money or increasing staff. This book gives the reader a review and explanation of the ISO 9000 series and explains how the quality tools and techniques can be used to implement the requirements of the standards. As Monnich guides readers through each clause, he includes techniques for small businesses to simplify compliance for small and medium sized organizations.

You can order this book from internal-auditor.com at: http://www.internal-auditor.com/books.htm

This Month's Feature Article

Auditor Selection: Who Should Audit?

Selection of Auditors

The first time I taught internal auditor training, it was for one particular client. I developed the materials and presented the class. I thought I did a pretty good job. Several clients later, I was teaching internal auditing for a global organization. The class was far different. Someone else created the materials, and they spent almost one-half day discussing auditor qualifications. The material came right out of ISO 10011-2. Several of the requirements amazed me, looking at them from an internal auditor standpoint. I questioned my superiors about the requirements for 2 years QA experience, 4 audits, and the 3-year evaluation panel. I had worked in industry at several positions, and had never seen these requirements applied to internal auditors. I was informed that I was wrong, and most organizations used 10011 in their auditor selection and evaluation processes. While teaching the class, it became obvious that in the areas of the United States where I taught, 10011 was a foreign concept. Auditors were chosen, and evaluated based on different standards. 

What I found in the subsequent years is there are typically four factors used to determine who will audit. I have placed them in the most common order with the highest priority listed first. They are:· 

• Auditor attributes· 
• Auditor independence· 
• Auditor qualifications· 
• Auditor availability

Auditor Attributes:

The first factor in auditor selection is the attributes of the auditor. Believe it or not, but people in your company, or organization have certain thoughts about you. Management, and co-workers have made value judgments concerning your actions and behavior. When selecting auditors, decision makers generally want people whom they can trust. Fairness, having an even head, and concern with your job are positive influences. Decision makers want auditors who can use their heads and do not carry grudges.

Auditor Independence:

Decision makers also want auditors who have no stake in the audit. That is why in many cases, at least one auditor will be from accounting, payroll and other non-manufacturing activities. They also tend to choose auditors that have no immediate relationship to auditee management. Of course, in smaller organizations, this may be a bit more difficult.

Auditor Qualifications:

Specialized training, previous auditing experience and auditor certifications will tend to place you at the top of the auditor prospect list. In fact, many lead auditors for internal auditing, have special qualifications before they are selected.

Auditor Availability:

We tend to think that this is the most important feature, but usually it is used as the "tie breaker". If several prospective auditors have similar qualifications, then the one who has the most available time will get the nod.

Auditor Selection:

Once the audit team is established, the next part of auditor selection is to determine who will audit each facet of an individual audit. Well, guess what? The same criteria that is outlined to select the audit team can be used to determine who audits what. The standard requires that either auditors must independent (1994), or they don't audit their own work (2000). I think 2000 puts it best when it requires audits be performed objectively, without bias. In order to have an impartial audit, the auditors must be impartial to the process and the auditee. Here is where the criteria listed above comes into play for any particular audit. In this instance, however, the priority is usually different. Auditor independence becomes the first priority, followed by availability, attributes and finally qualifications.

Due to the mandates, we try to ensure our auditors are not in violation of the standard when they audit. We try to avoid auditor bias in our overall auditor selection process, but we still need to choose auditors that are independent of the activity being audited. Typically, someone from quality should not audit quality. We know this, and practice it regularly. We rely too much on it. All to often, it becomes the focus of our internal audit program.

In many cases, auditor selection based on auditor availability actually diminishes the effectiveness of the audit. Basing the auditor selection on who is available to audit, although very common, doesn't allow the best auditor for that activity to audit. We end up with auditors being mismatched with the process being audited. 

I believe it to be unfortunate that auditor attributes will usually be the third priority. Some auditors have the gift of insight that can take auditing from merely compliance to a tool for growth. These are the folks that can do more for the organization through internal auditing, than most senior management can do through management. 

These auditors are born for the continuous improvement process. Almost all organizations have at least one of these types, and usually they are not auditors. Get them into auditing, and turn them loose! Remove all barriers to their performance, and cut the leash! You might not be able to handle the explosion of overall performance improvement!

Typically, all auditors are considered qualified (unless they are newly assigned), so auditor qualifications rarely enter into the picture. However, this could be a major factor in audit performance. Auditors need to be independent, but they also need to have some understanding of the processes they are auditing. When asking questions off the checklist, for example, auditors need to know the correct answer to the questions. If they don't, how will they know the auditee knows the correct procedure or form?

Summary:  

Not all organizations use these criteria, and some who don't use criteria that only they can understand. The overall goal of auditor selection, be it for who will become auditors or who will audit a particular activity, is to ensure that all QMS internal audits are impartial and effective. We need to move our internal auditing beyond auditing because we "have to". Internal auditing needs to be our most useful tool to advance the company or organization. We need to change how we select internal auditors. We need to think "audit for impact", instead of "audit to keep our flag".

As always...Good Auditing!

top of page

www.mmtc.org

Q – We have heard that ISO 9001:2000 requires us to perform process audits. What are they and how are they performed?

A – One of the goals of ISO 9001 is have organizations develop a process approach to quality management. Sub-clause 8.2.2 Internal Audit does not prescribe what kinds of audits are performed. Generally there two types. System and Process. A system audit is what your registrar performs. It looks at the QMS from a system standpoint. The emphasis is on the system. A process audit is an audit of a particular process, say purchasing. The audit looks at the how all parts of the QMS interact with that process. The focus is on the process. This is a real light skim, but you should get the picture. Realistically, both types are important to a healthy QMS.

top of page

Look for the updated version of ISO 16949 (formally ISO/TS 16949) to be released first quarter of 2002. Sources indicate the final ballot to be in January, with a publication date of perhaps March, later than many expected. There are a lot of changes. We will be outlining them in future issues, but the QS C9 sanctioned interpretation has shown up in the final draft of 16949.

top of page

Internal audits can be stressful on an organization. Part of the stress can be attributed to department managers not knowing the audit process and what auditors are really looking for. One way to overcome this is to send all department managers through internal audit training. Many organizations do this. Take it one step farther. Have department managers act as co-auditors. Each auditor is paired with a department manager. The audits will take on a much more vital role.

top of page

ISO-9001:2000 4.2.1d) General [Documentation requirements]

"documents needed by the organization to ensure the effective planning, operation and control of its processes…"

There are a lot of comments about 9K2K requiring only six procedures. The truth is there are only six places where the standard says a documented procedure is required. But don't overlook 4.2.1d). If something goes wrong, if the QMS fails, if quality issues bite you, then you might be able to come right back to this requirement. This is the "catch all" phrase of 9K2K. If the standard does not require a procedure, but the situation needs a procedure, then a procedure is required! The same goes for work instructions, forms, prints, any form of documentation (paper, electronic, carved in stone, etc.). The excuse "the standard doesn't require it" holds no weight. If you truly want an effective QMS this sub-clause needs to be understood, implemented and utilized.

top of page

February 2001’s question:

You are auditing 4.14, Corrective and Preventive Actions. There are several corrective actions that relate to scrap generated by employees not following procedures or work instructions. The root cause was identified as "language inconsistencies". Your company has a very diverse employee base, with a wide variety of ethnic, cultural and geographic backgrounds. All procedures and work instructions are written in the local language. Many employees have a difficult time understanding the procedures and work instructions. The corrective action entails either moving the employee that made the scrap to another operation, or releasing the employee. When questioned whether the solution is sufficient, the HR director indicates that there is little more that can be done.

The answer:

Moving or releasing an employee for a language problem is not a solution. A root cause of language inconsistencies is insufficient. The goal of corrective actions is to prevent the nonconformances from recurring. Their actions do not prevent recurrence. A permanent solution needs to be discovered. If they cannot hire only employees that speak the local language, then the documentation, training and management processes must react accordingly. Multi-language documentation, improved training, even bi-lingual supervisors could all be used to solve the problem. The issue is not what can be done, but rather something must be done to prevent recurrence. This was nonconforming.

 top of page

I really love my job! Not just as the editor of Internal-Auditor.com, but also as a consultant and trainer. I love to see the lights go on when someone finally "gets it". I love to see the joy in the faces when my client tells me they passed the audit, or when the organization begins to audit for impact. I love it when someone says they took my advice and it worked! (My wife finds that hard to believe at times) I love writing the newsletters. It is a real challenge. Doing, teaching and writing are all different functions and require different skill levels. This newsletter really pushes me to the limit and I have grown tremendously during the past two years. Your comments keep me challenged. Some of you have taken me to task on a few items. I've had to explain myself on more than one occasion. Don't ever stop challenging me. It is the best way for each of us to improve. One area I get challenged a lot over lately is the tardiness of the newsletters. I am guilty. In some cases it is illness. In some cases it is writer's block. In some cases it is sheer laziness. For that I apologize. I also know I have been lazy in sending out invoices. As we go into the Christmas season (where's the snow?) and into the new year, I will try harder to get the newsletters out sooner. If I don't get after me! You have my permission.

Dave

...Good auditing!

Copyright notice: internal-auditor.com is fully protected under US and International copyright laws. Copying, or re-transmitting all, or any part of internal-auditor.com is expressly forbidden without prior written consent from Ruth Ellen Carey Communications.
internal-auditor.com is a publication of Ruth Ellen Carey Communications. 

Because this site uses information from many different sources, it must be pointed out that any advice, tips, information, etc., provided should be regarded as opinion and not fact! What works well for one company may be a disaster for another. Also, what one registrar, or auditor may allow, another may not. As always, reflect on what you read, see if it fits into your own quality system, and if it conflicts with your auditor...you've got to make a decision