Internal Auditor Resources

Membership in the American Society for Quality (ASQ) should be mandatory for all QMS internal auditors. Even if you decide not to join, you should check out their website and look around. The amount of resources they have available is impressive. The ASQ website is www.asq.org. From there you will have access to just some of the resources that ASQ has to offer. You can also begin the membership process there as well. If you are a member, search out all the benefits of ASQ membership.

top of page

Featured Book of the Month:

Title: : ISO 9000 at the Front Line

Author: William A. Levinson

Publisher: American Society for Quality

Notes: Training your frontline workers in the basic principles of any quality management system standard has never been easier than with ISO 9000 at the Front Line

You can order this book from internal-auditor.com at: http://www.internal-auditor.com/books.htm

This Month's Feature Article

Auditing for Impact

Why do we do internal audits? Is it because we have to? Is it to make sure your QMS is compliant? Or is it much deeper? Typically, we perform internal audits for three reasons:

1. To ensure the QMS conforms to requirements
2. To ensure the QMS is maintained
3. To ensure the QMS is effective

But what if we could go much farther? What if we could add something to ensure the maximum positive impact on the organization? We can. We should. But, in order to do so, we need to understand how we can audit for impact. Auditing for impact goes much farther than auditing for compliance. It goes beyond auditing for continuous (continual) improvement. It is re-defining the internal auditing process. It may require changing auditors. It may require greater management, especially upper management, involvement. The results may be nothing more than spectacular!

What a scenario! It may appear to be pie-in-the-sky to some, but to others it could be the start of a whole new way of thinking. Back in February, I mentioned the need to have valid measurables to demonstrate the value of internal auditing. We then proceeded to give some examples of what measurables an organization might choose. This month, we want to look at a different way to demonstrate the value of internal auditing. Let's take a look at: Auditing for Impact.

The concept for auditing for impact is really quite simple. Internal auditors seek out opportunities for process, product and facilities improvement. The idea is to intentionally look for situations that, if left uncorrected, could cost the organization time and money. In order to achieve auditing for impact, the organization must undergo a shift in the way it perceives the internal auditor program. Here are the changes:

Management Integration

The first major change that many organizations must go through is the integration of management, especially upper management, into the audit process. The larger the organization, the greater the need will be to integrate management into the audit process. The standard already requires upper management commitment, and participation. Management integration requires much more involvement at all levels of auditing activity. Please note: we are not talking about micro-managing the system. What we are talking about is the proper level of management participation. In some organizations it might entail the use of management, including upper management to actually perform some audits. As an absolute minimum, it would require that all management take an active role in the auditing process - even if only as auditees. This means no more vacation days, dentist appointments or business trips on days of internal audits.

Management should also be involved in the establishment of goals and measurables for the internal audit program. This also means that the required management review needs to occur quite frequently. A truly effective auditing for impact system, with proper management integration, will probably require auditing monthly, at a minimum, and have formal management review following each audit. The greater management involvement, the more importance auditing will have, and it will be taken more seriously. 

Business Systems Integration

The organization's Quality Management System, and the internal audit process must be fully integrated with the organization's overall business system. Auditing for impact requires that the "ISO stuff" not be thought of as a separate thing. The "ISO stuff" needs to be just one part of an overall business strategy and operation. It should get the same level of attention and be of the same priority as marketing, product development, and other business activities. 

One way to achieve this is to audit for impact. Audits and auditors should be looking for ways to improve the other business management areas, while maintaining a vigilant eye for the QMS conformance and effectiveness. In order to accomplish this, internal auditors must be trained. Auditing for impact is a blend of internal auditing, lean manufacturing and six-sigma. Auditors need to know the basics of each to understand the impacts that might be achieved. They need to know what to look for, and where to look for it.

Removal of "Us vs. Them"

Many internal auditors fine it difficult to do their regular jobs and be internal auditors. There are organizations out there that have applied a stigma to the internal auditors that follow the internal auditors when they are not auditing. They end up having a much harder time doing their regular job. Auditing for impact requires organizations to move past this "us vs. them" mentality. 

Internal auditors need to become intimate with the process they are auditing. To do this they will need the support of management and co-workers alike. Auditees need to view internal auditors as assistors, rather than interrogators. Internal auditors need to act accordingly as well.

How is it done?

Auditing for impact does not require any additional paperwork. How it works is like this; you are performing an audit. You see something that is not necessarily related to the QMS, but would be in the best interest of the organization if it were to be changed. You note it, report it in the closing meeting, and in the audit report. A couple of examples might help; you notice something really unsafe, or something that might cause an environmental legal issue. This is something you would bring up anyway, I hope. But what if you think you see a better way to present a production part for processing? By the way, once production employees find out that you are looking for better ways to do things, they will undoubtedly give you a lot more information.

I mentioned training earlier. Here is where it comes to play. The internal auditors need to be able to know what to look for. They need to know where to look. They also need to know how to discern what is valuable and what is not. Some of that comes in training, some through experience. The key is to unlock the handcuffs and give auditors a free reign to discover how they can have a positive impact on the organization. 

Caveat

One caveat however, must be mentioned. Do not allow auditing for impact to overshadow the requirements. Your audit must still meet the goals of internal auditing, which are stated at the beginning of this article. Internal auditors must not lose their focus. It is easy to get carried away and use the audit as nothing more than an extension of the continuous improvement process. It takes discipline to keep the original focus and still be able to add those impact auditing nuggets that lead to real improvement in the organization.

Summary:  

It sure sounds like auditing for impact is a lot of work; and it is. But it takes no more work than management by reaction. The things discovered during auditing for impact will eventually be discovered anyway, but the longer the wait the more costly they become. The discovery and correction will then require even more work. Auditing for impact may seem to be a bit of an aggravation, but the alternatives are worse. It is not for everyone. If all you want is a flag, then it isn't for you (but then again, you probably would not subscribe to this newsletter).

There are a lot of management programs out there: lean manufacturing and six-sigma, just to name a couple. Auditing for impact neatly fits in with both initiatives. Only the more advanced management would have thought of QMS internal auditing as a lean manufacturing, or six-sigma tool, but that is the exact level of performance we desire. The organization benefits, management is happier, as is the over worked, under appreciated internal auditors.

As always...Good Auditing!

top of page

Q – We are a small tooling and equipment supplier to one of the Big-3. I’ve read the Sanctioned Interpretations and believe we must mandate ISO 9001 to our vendors. My boss disagrees. Who is right?

top of page

To get ideas of what ISO 9001 means, research guidance documents, such as ISO 9004. These implementation guides often give some insight into what the framers were interpreting the requirements, as they assembled the document. You might also find examples of what evidence you might expect to find to show compliance to a particular standards requirements. It might also show you where your company’s definition of a word (or phrase) differs from what the writer’s intended. As always, you remember these are just guidance documents, and cannot be used to determine conformance. Also, be careful if there is a discrepancy between your documentation and the guidance documents. It might just be possible that your documentation is the best interpretation for your organization.

top of page

We’ve noticed that sometimes a closed corrective action can be improved. There are several ways to address this issue. One way to accomplish this is to write a continuous improvement against the original corrective action. A copy should be attached to the corrective action showing the corrective action was updated. This, then becomes evidence that your entire system is functioning effectively, and anyone who is following up on the corrective action is able to see the corrective action was improved!

top of page

QS-9000 C9 Supplier Development (4.6.2.1) (07/01/01) [Sanctioned Interpretation]

“Goal of subcontractor compliance” requires subcontractors to achieve compliance within a defined period of time not to exceed 18 months from the effective date of this sanctioned interpretation. Minimum subcontractor compliance shall be certification by an accredited certification body to a current version of the ISO 9000 Quality Management Series of Standards, excluding ISO 9003; plus any requirements specified by the customer. Assessment by an OEM or an OEM approved second party will be recognized as meeting subcontractor compliance requirements to 4.6.2.1."

top of page

November 2000’s question:

While auditing Element 4.4 Design Control. You ask the Design Engineer to see the evidence of the formal documented reviews required in Clause 4.4.6. She responds that she is the only person involved in design because product design is straightforward, and the only changes are modification to the base design. Because this does concern her, she maintains a checklist to ensure nothing is left out. She completes the checklist as she goes, so a formal review is not necessary. Why have a formal review when she would be the only person there? She states the checklist meets all of the requirements, and intent of the review, as well as serves as the required review record. She adds that she has done it this way for over eight years without any problems.

 The answer:

In this case, the auditor wrote a non-conformance against 4.4.6. The Design Engineer challenged the non-conformance with the President. The President felt that even though he was not trained as an auditor, it appeared to him that the requirements were in fact being met. The auditor persuaded the Design Engineer to revise the design procedures to clearly show that the checklist is the formal design review process. During a subsequent surveillance audit, the auditor noticed the record of the overturned non-conformance. As she reviewed the situation, she noted that not only was the checklist conforming, but also this was a good example of how an internal audit should work when there is a question.

 top of page

This month's feature has been the toughest one I've written yet. Trying to flesh out these original thoughts was much more daunting than I thought when I scheduled them a year ago. Before this month, they were thoughts with no real form, just idea that internal auditing had to have a higher level. Yes, there were bits and pieces, things I picked up along the way, but this is the first time I tried to put them all together to form a harmonized plan of action. I recently attended my official, required ISO 9000:2000 transition training. Although I know the standard quite well, Instructor Norman Williams from the Eagle Group (www.eaglegroupusa.com), said some things that brought much of this together. I must officially acknowledge and thank him for his inspiration. 

This month was one of the most hectic month's I've had separate from the writing the issue. Things were happening on a personal level that distracted me and made coming up with a difficult article even more difficult. I've answered more email, and even a few phone calls than normal. It has been, what last year I would have called, a tough month.

But I truly can't say it has been tough. After the events of 9/11, all of my personal problems seem insignificant. My largest crisis for the month, year and even for my life are nothing compared to what this nation, New York and Washington DC have gone through (and are still going through). The best thing to do now is to pick our selves up, dust our selves off, and carry on. And that I intend to do. For my personal perspective on the activities visit one of my other sites: Christians Working in of Supporting Manufacturing at www.cwsm.org.

Dave

...Good auditing!

Copyright notice: internal-auditor.com is fully protected under US and International copyright laws. Copying, or re-transmitting all, or any part of internal-auditor.com is expressly forbidden without prior written consent from Ruth Ellen Carey Communications.
internal-auditor.com is a publication of Ruth Ellen Carey Communications. 

Because this site uses information from many different sources, it must be pointed out that any advice, tips, information, etc., provided should be regarded as opinion and not fact! What works well for one company may be a disaster for another. Also, what one registrar, or auditor may allow, another may not. As always, reflect on what you read, see if it fits into your own quality system, and if it conflicts with your auditor...you've got to make a decision