Internal Auditor Resources

If you are in the US, then check out the Manufacturing Extension Partnership (MEP). MEP centers are located throughout the United States. They could be a great source for internal auditor training. MEP centers can offer much more than just internal auditing training. Many perform internal audits for you, and most offer a lot of other services; such as lean manufacturing and six sigma. From their website, you can find the MEP center closest to you. The MEP website is:

http://www.mep.nist.gov/

top of page

Featured Book of the Month:

Title:  ISO 9000 Quality System: Department by Department Implementation for the Certification Audit

Author: Jack Kanholm

Publisher: AQA Press

Notes: Department by department, this book explains precisely what a company must do to implement the ISO 9000 quality system and pass the certification audit. Every requirement is addressed. There are hundreds of tips and examples of implementation solutions.

You can order this book from internal-auditor.com at: http://www.internal-auditor.com/books.htm

This Month's Feature Article

Discussing Audit Findings

The audit is progressing well. The audit is keeping to the schedule, and the auditees are being quite cooperative. Your questions are being answered, and there are plenty of records to examine. Overall, you are impressed. Suddenly, from out of nowhere you spot an evil, hideous, disgusting nonconformance! How do you react? Do you exhibit a great gasp of horror? Do you chuckle out loud, or to yourself? Do you let loose with a rather loud "gotcha"?

How do your auditees view your audits? Are nonconformances looked at as negative…or positive? Could a nonconformance be seen as positive? 

Last month, we looked at auditing for impact. The interaction between the auditor and auditee while discussing audit findings can play a major role in auditing for impact. This month we will study audit findings and how to discuss them with the auditee so they might be viewed as a positive step in the continuous improvement process.

Let's begin with some ground rules. First, we must decide on what an audit finding is. Audit finding as defined by ASQ Quality Audit Division's The Quality Audit Handbook:

"A conclusion of importance based on observation(s)."

An alternate definition could be:

"Conclusions drawn from the objective evidence obtained."

As we look at these definitions, one thing should stand out. A finding can be either positive, or negative. Objective Evidence, by nature is neutral. It is nothing more than reporting of facts. The word "conclusion", however, indicates we are placing some form judgment on the evidence obtained. Comparing the conclusion with our requirements determines if the finding is positive, or negative. In order to have all of our findings and even nonconformances viewed as a good thing, we must change our attitude towards auditing and nonconformances. Until that day, let's see if we can find ways of discussing findings in a manner that will meet our needs and allow the auditee to gain acceptance of the findings.

We are interested in two things, audit:

• Preparation
• Performance

Let's look at each in detail.

Preparation:

The first step in proper discussing of audit findings begins prior to the audit. Proper audit preparation is a key ingredient to a successful audit. In our Monthly Scenario Explained, we witnessed a scenario where proper audit preparation would have revealed that there were some major changes in the department to audited, which warranted postponement of the audit. The better prepared the auditor, the greater chance the auditee will accept the findings of the auditor. Proper preparation includes understanding the requirements of the organization. This includes all requirements, internal and external alike. Proper preparation also includes some knowledge of the process of the audited function. What does the function do, and how do they do it? What equipment, if any is used? How can an operator know the difference between acceptable and unacceptable process output? All these questions must be answered prior to the beginning of the audit. 

Here is a tip: during the audit, when the auditor asks an interview question, the auditor should already know the answer before asking the question! Or else, how can the auditor know if the auditee's answer is acceptable or not. It is important that I clarify that by acceptable, I mean conforms to the audit criteria. This level of knowledge can only come from proper preparation. This level of knowledge will also lend credence and credibility to the auditor and the audit!

Another part of preparation is organization. When the audit begins, the auditor should not be fumbling around for the checklist, the standard, the procedures and some form of writing instrument. Organization also includes a clear audit plan. Know ahead of time how many records are to be checked, or how many people are to be interviewed.

Performance:

When performing the audit, the auditor needs to minimize small talk. Be careful not to go too far and avoid casual conversation either. The smaller the organization, the more difficult this may be. Smaller organizations tend to be more personal and chances are the auditor and the auditee know each other quite well. Try to be yourself, but stay focused on the audit.

As you audit you will have ample opportunity to collect objective evidence. You will also have ample opportunity to discuss what you find. This is the heart of the matter. The auditee will be somewhat anxious to discover how "well" they performed. If you do find something you suspect, or even know to be nonconforming, do not hide it from the auditee. There is probably nothing worse then when the auditee believes the audit is going well, only to be blindsided by several nonconformances during the closing meeting. No one wants to be the bearer of bad news and we all want to avoid confrontation. But it serves no purpose to mislead the auditee, intentionally or not.

 In July's feature, I mentioned nonconformances must have the following three characteristics:

1. They must be understandable
2. They must be actionable
3. They must be indisputable (actually I said unarguable)

The concept is simple; the auditee must be truly convinced that the nonconformance is valid before they will accept it. The three listed characteristics make acceptance much easier. But sometimes we need to go even further. When discussing findings (either good or bad) we might have to educate the auditee on the intent of the requirement, something we cannot do without proper preparation. We also must not come off as though we are belittling the auditee. Credibility is a major factor here. 

When discussing findings, follow the same steps you take in the audit. Begin with the objective evidence, explaining to the auditee what evidence you discovered. Follow that with the requirement, indicating the exact requirement (point out the "shall"). Let the auditee draw the conclusion. If you were thorough in the first two steps, this should fall naturally into place. This might be an opportune moment to discuss possible remedies. Also remember the real purpose of the audit is to make sure the QMS is effective. Remember the goal of the auditor is to report on the status, not report on the auditee. A nonconformance indicates the system is not working properly. 

If your organization classifies internal audit nonconformances as either major or minors, you may want to indicate the classification to the auditee. The auditee might offer his/her opinion on the matter as well. Historically, this seems to be the area of greatest contention during an audit, which is why I recommend not using majors and minors in internal auditing. After all, all nonconformances must be successfully corrected. 

Should the auditee correct the problem during the audit, it does not change the finding. At the time the finding occurred, there was a nonconformance. The speed at which the corrective action occurs is not of concern. What is of concern is whether the finding is valid. Making a record of the finding and the corrective action helps prove the internal audit system works. A nonconformance that cannot be corrected prior to the close of the audit achieves the same thing. It shows the system works. Most auditees can recognize this concept. All you are trying to do is to prove the system works.

Summary:  

When discussing audit findings you must remember the audit integrity is critical. The auditor is just reporting the facts. The auditee might not like what the auditor found, but the auditor should leave no room for argument. If the auditor is not sure of a nonconformance, the auditee will never be convinced. Through proper preparation and skillful execution, the internal audit should prove that the QMS is working … of discover places where it is not.

As always...Good Auditing!

top of page

www.nsf-isr.org

Q – We are a QS-9000 company that produces a product, which we warranty. We have been registered for about 4 years. We were recently assigned a new auditor. He states that our warranty process is really Servicing, and that Element 4.19 applies. Our previous lead auditor did not require 4.19, and our Quality Manual says it doesn’t apply. Is warranty work Servicing?

A – Normally, unless the warranty is contractual, and is a separate line on the invoice, warranty work is not considered Servicing. More logically, considering your registrar accepted your contention that it is not, and it has not been an issue in the past, I think 4.19 does not apply to you. Now the good news. I think you should consider including it. Most operations that provide warranty work could save themselves a lot of headache if they would include it. It is a business decision you really should consider.

top of page

Look for the updated version of ISO 16949 (formally ISO/TS 16949) to be released first quarter of 2002. Sources indicate the final ballot to be in January, with a publication date of perhaps March, later than many expected. There are a lot of changes. We will be outlining them in future issues, but the QS C9 sanctioned interpretation has shown up in the final draft of 16949.

top of page

ISO 9001:2000 requires organizations to track how their customers feel about them. A racing engine builder monitors racing websites and periodicals to determine what the drivers think about the engines. If the driver complains that the engines are a little underpowered coming out of turns, the company can react. In many cases, this information would not have come from the driver, directly to the company. Their customers will tell the press things they wouldn't tell their engine supplier.

top of page

ISO-9001:2000 8.2.1 Customer Satisfaction

"…the organization shall monitor information relating to customer perception as whether the organization has met customer requirements…"

Monitoring the customer perception of whether you meet their requirements is not necessarily an easy thing. We can send out tons of surveys (which I personally detest), you can hold customer conferences and still not have a true picture of the customer perception. In many cases, you might have to use atypical means of determining customer perception. It is not satisfactory to limit your information to re-orders. This is more than an ISO 9001 requirements question. This should be a business fundamentals question! There are countless leading businesses that failed to understand their customer's perception of them. As a result they are now followers, rather than leaders - if they are still around. So, what information is indicative of your customer's perception?

top of page

February 2001’s question:

You are auditing purchasing. Their procedure has a revision date that is just over a month old. You add questions on the checklist from the procedure. When you arrive at the purchasing department, you find they are not using the new procedure. The department is unified in their reason. the new procedure had some provisions that they could not perform. That is what happens when someone writes a procedure who does not work in the department. The department, as a group decided to revert back to the older revision, and work to resolve the discrepancies. The department manager shows you an email from the Management Rep, copied to the Document Controller, which authorizes purchasing's decision. The email was from the day before. It is apparent that the Document Controller has not updated the master list yet.

The answer:

This is a rather complicated matter, but not too uncommon. In this case, the audit should have been postponed until the matter was resolved. But it was not. It is clear that the department is not following the procedure that is outlined. Element 4.5.2 a) [This was based on the 1994 version] states that "the pertinent issues of appropriate documents are available…" 4.5.2 b) requires "invalid and/or obsolete documents are promptly removed…" The purchasing department evidently decided that the new procedure was not pertinent and invalid. They promptly removed it. The Document Controller realistically did not have enough time to update and distribute a new master list. In this instance, no nonconformance was written. A preventive action was written to amend the procedure for generation of documentation that would include input from the departments affected by proposed changes to documentation.

 top of page

There has been a firestorm of controversy over the Sanctioned Interpretations of QS-9000 set of requirements by the IASG (http://www.qs-9000.org). Many have been waiting for the second edition of 16949 as a means of relief. Looking through the final draft of ISO 16949, it appears that the controversy will not end anytime soon. The language there is almost as prescriptive as the Sanctioned Interpretations. But there is more bad news. I will be reporting some of the other curves that 16949 will be brining the automotive supply base in the months ahead. Until then…

Dave

...Good auditing!

Copyright notice: internal-auditor.com is fully protected under US and International copyright laws. Copying, or re-transmitting all, or any part of internal-auditor.com is expressly forbidden without prior written consent from Ruth Ellen Carey Communications.
internal-auditor.com is a publication of Ruth Ellen Carey Communications. 

Because this site uses information from many different sources, it must be pointed out that any advice, tips, information, etc., provided should be regarded as opinion and not fact! What works well for one company may be a disaster for another. Also, what one registrar, or auditor may allow, another may not. As always, reflect on what you read, see if it fits into your own quality system, and if it conflicts with your auditor...you've got to make a decision