Process vs. System Audits

"We love auditing, and we are good at it. After all, we've been doing it for years. We have perfect checklists. We ask perfect questions, and we rarely get any nonconformances from our registrar. So what's wrong with the way we've been doing it? Why should we change? Do we need to change?"

ISO 9001:1994 was a "system"-based standard, and the system was the standard. ISO 9001:2000 is a "process"-based standard, and the processes are the processes you use. The '94 version focused on the product you made, the '00 version is on the process you use to make the product. 

Auditors audited the older version by generating checklists based on the elements. Even QS-9000's QSA questions were centered around the elements. Now the entire focus of the standard is on your processes. This also applies to auditing. As auditors we must also shift our focus on the organization's processes in order to conduct an effective process-based audit.

In order to effectively audit ISO 9001:2000, the auditor must first understand ISO's "process approach" This can be found in beginning of the standard (.02). A process is a managed activity that uses resources to transform inputs into outputs. In most organizations each process is linked, either directly, or indirectly to another process. This linkage could be product, people, equipment, information, or any other common attribute. This linkage could be sequential or concurrent. 

Organizations have many processes. As we look at the overall business cycle, processes just sort of jump out. Marketing is a process, as is sales. Purchasing is also a process. It uses inputs such as supplier information and matches it up to the product/service specifications to determine what we will buy from whom. The output is the purchase order and received goods/services.

The standard requires us to:

• Identify the processes (4.1 a)

• Identify the application of the processes (4.1 a)

• Determine the sequence of the processes (4.1 b)

• Determine the interaction of the processes (4.1 b)

• Determine the criteria and methods needed to operate and control the processes (4.1c)

• Ensure the availability of resources and information to support and monitor the processes (4.1 d)

• Monitor, measure and analyze these processes (4.1 e)

• Implement actions to achieve planned results of these processes (4.1 f)

• Control outsourced processes (4.1)

• Describe the interaction of these processes in the quality manual (4.2.2 c)

As auditors, it is our responsibility to ensure those "shalls" are being met. In order to do this, we must first understand our processes and their interactions/interrelationships. Then we must understand how to audit the processes for maximum effectiveness.

Understanding our processes:

The first step in understanding the processes is to go to the quality manual and look for the description of the processes. Does the description make sense to you? If not, then they might not be adequately described. The Management Representative should be able to assist you. The description should also show how the processes interact. That means how they relate. For example how does the sales process affect purchasing, or material handling?

How does manufacturing know when to start production? All of these questions indicate the interaction of the processes and need to be addressed during the audit. 

The quality manual information should also give some indication of the process inputs and outputs. As auditors, we need to understand the process inputs and outputs to enable us to determine if the process is properly described, controlled and evaluated. The better we understand the processes, the better job we can do during the audit. 

Auditing our processes:

Many of us have audited on a semi-process basis for years. We have followed the flow of work through a department to ensure the procedure was being followed. That was a real good step. But process-based auditing goes much farther. 

Auditing the process begins much like auditing the system, preparation. However, in this case, the auditor needs to have a greater understanding of the process being audited. Developing a checklist, based on the process is much different than developing a checklist based on a standard, or even a procedure. The checklist must include questions on the inputs, outputs, controls, measurements, analysis, information and monitoring of our processes The audit checklist and plan must include all of the processes, the documentation and records of all of the above.

How far do we go with this? As far as we need to. And the good thing is we can continue to dig deeper as time progresses.

All processes have procedures, but not all procedures need to be documented. Process management and even process auditing should not be an exercise in paper accumulation. Auditing the process should be less about paper and more about understanding. Interviewing will take on a much greater role in the new audit scheme. Auditing a process will take longer than auditing a department under the old audit practice. 

Auditors need to be able to ask questions relating to how the process in managed. Auditees need to know that the process inputs and outputs are. They need to know how the process is monitored and measured. They need to know environmental influences and possibly environmental aspects and impacts. Auditees also need to know how they impact the process and how the process impacts customer requirements and satisfaction. More now than ever, auditees need to know where, and how, they fit into the big picture.

Auditing the process involve comparing the inputs and outputs stated in the quality manual with what you find during the audit. It involves look at the quality objectives and the quality policy and determining if and how they are translated to the process. Do the process inputs, management and output match the policy and objectives? Do the process operators know how the process interacts with the policy and objectives? Finding objective evidence might be more difficult, articulating the findings and the evidence might also be difficult. But in the end the process will improve, as will the auditing process.

Summary:

The new processes thinking model for auditing is going to cause us auditors to go back to the drawing board and re-think of how we look at auditing. We need to analyze our auditing skills and improve those that are weak. If we understand the processes we are auditing, and understand how the auditee fits into that picture, we will be a lot closer to having a truly effective audit.

As always...Good Auditing!

How do you show your support of your QMS? Where can you find little tokens of appreciation for all the work folks do to obtain and maintain registration? Visit SearchManufacturing.com's ISO resources page for links to banners, flags, etc. You can find them at:

http://www.searchmanufacturing.com/Manufacturing/Quality/iso.htm

Q - What is the difference between a process map and a flowchart?

A - Excellent question, many people assume they are one and the same, but they are not. A flowchart is a graphic description of the steps in a process. Some advanced flowcharts might show some of the inputs, but rarely take into account all of the process information.

Process maps, on the other hand, provide all of the process information. Process maps consider information, time, methods, personnel, material, equipment, environment, outputs, etc. If you really wanted a full understanding of the process, combine the two. For each step in the flow chart add the process map information. Then you would have a real understanding of the process.

top of page

www.mmtc.org

ISO 9001:2000 Clause 4.2.2 Quality manual

"The organization shall establish and maintain a quality manual that includes
c) a description of the interaction between the processes of the quality management system.

A lot of folks seem to think this means you must "map" your processes. There is no such requirement. Mapping may the be easiest way to graphically depict the interaction, but it is clearly not the only method you can use. I have seen many excellent narrative descriptions of process. I've also seen flowcharts and even org charts modified to include the information. Also, if you plan on mapping, don't get tied into any one map style. There are countless ways to describe the interaction. See what works best for you.

top of page

January 2002's question: 

As part of the audit, you must determine if the quality policy is understood through out the organization. To determine this, you decide a random sample of persons exiting the break area. The next five people leaving the break area will be questioned. The first two go quite well. The third person is someone you know that has a reputation of being anti-company. You decide to ask anyway and the response is that he is sure the company doesn't have a quality policy. He has never heard of one, and has never been trained on a quality policy. You record his response and continue. The last two are also positive.

The answer: 

This is always a good question to ask. It goes along with what do you do statistically with outliers and special cause variation. The answer is more political than practical. As I ask this question around I get no consensus. But here is point. How do you know he does know the policy? Can you be sure his answer is just more anti-company rhetoric? The person's answer should be noted and if required a nonconformance should be generated. I would anticipate that this nonconformance might be overruled, but I would still write it.

 top of page

I have found that most organizations really don't have a handle on their processes. They have never really considered the processes. They have difficulty explaining how the processes interact and have little concept of the interrelationship of the processes. None of this surprises me. Process thinking is new to most of us. It is kinda like holistic thinking, which we don't do well. The lean manufacturing folks have a better handle on process thinking, but they often see it through the myopic eyes of process improvement. They typically never attempt to see the processes from the customer satisfaction standpoint. 

ISO 9K2K's insistence on process thinking can bring a lot of this together. For years I have been saying there must be some method of merging lean principles and quality principles. I think this might be the tool that gives us that beautiful blend of quality, lean and even environmental safety and health. Let's not forget the financial aspects. Understanding our processes, and I mean REALLY understanding our processes is the key, in my opinion to unlocking the door to unrealized potential. Analyzing our processes can show us waste, points of customer dissatisfaction, unexplored and missed opportunities. Oh, the things we can learn if we could only fully understand our processes.

There may be hope for us yet!

Dave

...Good auditing!

Copyright notice: internal-auditor.com is fully protected under US and International copyright laws. Copying, or re-transmitting all, or any part of internal-auditor.com is expressly forbidden without prior written consent from Ruth Ellen Carey Communications.
internal-auditor.com is a publication of Ruth Ellen Carey Communications. 

Because this site uses information from many different sources, it must be pointed out that any advice, tips, information, etc., provided should be regarded as opinion and not fact! What works well for one company may be a disaster for another. Also, what one registrar, or auditor may allow, another may not. As always, reflect on what you read, see if it fits into your own quality system, and if it conflicts with your auditor...you've got to make a decision