Auditing to me is fun! It is my opportunity to
to put my skills to work while making a worthwhile contribution to
the organization. My goal is simple. I want to have a QMS
that works, and works well. One of the methods to track the
performance of the QMS is to look at the effectiveness of
corrective actions. When we audit, we often find things. These
things regularly require fixing. If the entire system is expected
to function properly, then the fix if vital. How we, as auditors
handle the fix (corrective actions) is also vital.
Corrective actions are generated as result of
nonconformances found during an audit. The auditor may have a
couple of different roles to play in the corrective action
process. Neither of the roles involve assuming the responsibility
for the corrective action. Corrective actions are the
responsibility of management of the area or activity being
audited. The two potential roles for internal auditors are:
-
Assisting in the corrective action plan
-
Verifying the corrective action
Assisting in the corrective action plan
I often say that nonconformances must be
understandable, actionable, and indisputable. The clearer the
nonconformance, the less the auditee will need our assistance. If
the auditee doesn't understand the requirements, however, an
effective corrective action may not be possible. The auditee will
then look to our expertise to guide the corrective action planning
process. We, as auditors can assist in the corrective action plan
in a couple of different ways.
First, we can suggest methods of
meeting the criteria that led to the nonconformance. This is
normally accomplished by explaining why the requirement exists,
and what evidence of compliance could look like. From there we
offer may suggestions on actions that will achieve conformance.
Secondly, we can
review the corrective action plan that is submitted by management
to determine if it will satisfy the nonconformance. Review the
proposed action and the timeline presented to determine if the action plan
is achievable. If you have any questions, or if the timeline or
action plan is unrealistic, then work with the auditee to find a
more realistic solution.
A couple of additional things I need to point
out. Should an auditee request assistance, bear in mind these
things. First, the auditee not obligated to follow your
recommendations. Even if you offer detailed instructions, they can
still find their own solutions. The important thing is to have
effective corrective actions. Secondly, The more input you have in
the solution, the greater chance you will have of
"owning" the corrective action. Should the corrective
action be ineffective, for whatever reason, you undoubtedly be
blamed.
Verifying the corrective action
Verifying the corrective action may take
several different forms. Which method(s) used will be based on the
severity of the nonconformance, your relationship with the auditee
and the resources available. The selected method should be part of
the corrective action plan. The auditee must know up front which
method of verification will be used, and why it was selected. The
timetable for the corrective action verification needs to part of
the action plan as well. As with any plan, you need the
flexibility to amend the plan should the circumstances warrant
it. The three most common methods of follow-up activities are:
-
Reviewing submitted evidence
-
Scheduling a follow-up audit
-
Verification during the next internal audit
Reviewing submitted evidence
In some instances, the manager of the audited
area may provide you with evidence, which you can review for
completeness and adequacy. If the corrective action is
accomplished within the planned timeline, and the evidence
indicates the corrective action works, then the corrective action
can be closed. This works only for minor nonconformances, or where
the performance meets requirements, but the documentation may not
match the performance. This method of corrective action
verification does not require much of the auditor's time. It tends
to work well in smaller organizations.
Scheduling a follow-up audit
If the nonconformance was a major, or if the
corrective action was complicated, a follow-up audit may be
warranted. In this case, the auditor will schedule a audit of the
corrective action a couple months after the corrective action has
been implemented. The audit will typically consist of only the
corrective action(s).
Verification during the next internal audit
One of the most simple verification follow-up
activities is to add details of the nonconformance to the
checklist for the next audit. In some organizations the follow-up
is conducted during the very next audit, even if that particular
activity was not scheduled to be audited. An alternative would be
to wait until the next time that activity is audited. Be very
careful here. If the nonconformance was substantial, you will not
want to wait very long for verification! Some
organizations prefer to leave the corrective action open until the
audit is complete. Others close the corrective action when it
is reported, and placed on the audit schedule.
If you are using this method, you need to have
some safeguards built in to prevent incomplete corrective actions
from dragging on. This is normally accomplished by having the
auditee submit evidence, as suggested above.
Summary:
The object is to have effective corrective
actions. As auditors we cannot allow ourselves to fall into the
trap of believing that once the nonconformance is written, our job
is over. Our job is never over. Only after the auditor is
satisfied that the corrective action has met the requirements and
is effectively implemented, will the corrective action be
closed.
After closure, the auditor should update all
records showing the closed corrective action, and make any
necessary adjustments to the schedule. Make sure you report
the corrective action effectiveness as required.