Internal-auditor.com [www.internal-auditor.com]
The only Internet-based periodical serving Quality System Internal Auditors

Brought to you by Ruth Ellen Carey Communications...of course! 

May 2003


Advertisement:  


www.nsf-isr.org


This Month's Newsletter Contents:

Feature Article.................................................................
Featured Book.................................................................
Question and Answers....................................................
Auditing Metrics.............................................................
Monthly Scenario Explained.......................................
Element Understanding.................................................
The Back Page.................................................................
The Small Print................................................................
Auditing Supplier Performance
The Quality Audit for ISO 9001:2000 
Selecting Internal Auditors
Metrics Selection 
July 2002
Out-Sourced Processes
Graduation
Copyright notice

Featured Book of the Month:

Title: The Quality Audit for ISO 9001: 2000 : A Practical Guide

Author: David Wealleans

Publisher: Gower Pub Co

Notes: This book aims to teach the entire process of auditing without any of the dogmatism so common in quality management. I have tried to make it comprehensive yet flexible so that it is of use to novices and beginners. The approach, especially for internal audits, is geared towards improvement and assessing objectives, as I have always taught - this now fits in well with the philosophy of the 2000 version of ISO 9001 and so I have included a chapter explaining what the new standard requires.

 


 

You can order this book from internal-auditor.com at: http://www.internal-auditor.com/books.htm


top of page


This Month's Feature Article

Auditing Supplier Performance

There are two times which internal auditors audit supplier performance. One is when the internal auditor is auditing that portion of the standard, or process. The other is when the auditor actually audits the supplier. As internal auditors, we may very well be called on to do either. In order to accomplish either goal, we must be adequately prepared to audit our supplier performance processes and also to audit the performance of the supplier. 

These audits are usually performed independently of each other, as both have totally different scopes. In auditing the organization's supplier performance process, the audit centers on how well the organization selects and evaluates suppliers. This audit occurs at our organization, looking primarily at organizational records and documents. On the other hand, when we audit supplier performance, we are actually at the vendor's location, and are evaluating their documentation and records.

Supplier Performance Process

The standard says we must select and evaluate our suppliers based on their ability to meet our requirements and evaluate them. There is no set method of doing either of these, but there are a few things that are common. It is important to understand that the size of the organization and the number and type of suppliers drives the formality of supplier selection and evaluation. It is not the internal auditor's responsibility to decide on the method to select and evaluate, only to determine if the method selected is effective and is being followed.

The first step in evaluating the method used to select and evaluate is, of course, to determine what the standard actually says. This gives you the requirement by which we will decide on compliance. Basically, the standard says that you shall; "…evaluate and select suppliers based on their ability to supply products in accordance with the organization's requirements." It further states you shall establish; "Criteria for selection, evaluation, and re-evaluation…" And; "Records of the results of evaluations and any necessary actions arising from the evaluation shall be maintained…"

What this means is that you (the organization) decide on the rules for your suppliers. As auditors we need to look at the parameters given for supplier selection and evaluation. It is important to remember that our job is not necessarily to pass judgment on whether we think the criteria is sufficient. Our job is to determine if those responsible for purchasing are aware of the criteria and are following the plan. We can make recommendations on the merits of the criteria, but should limit our conformance decision to whether the standard is adhered to. 

The second step is to determine the process used to meet the standard. Supplier selection and evaluation may be part of a single process, or may be two distinct processes. It is best audited by the process. That means you must first determine all of the inputs and outputs of the supplier selection and evaluation processes. This is easily done by looking at how your organization describes their processes in the Quality Manual. Process maps can also provide you with much of the needed information. 

A documented procedure is not necessary for this requirement, but would certainly be welcome. A well-written checklist is critical for auditing this process. You should have checklists prepared for all of your processes. The checklist should follow the flow of the process and should, at a minimum, cover these areas:

  • Process inputs

  • Process outputs

  • Process controls

  • Process resources

  • Process measurement

For evidence you would be looking at records and interviewing personnel. It should be noted that although an "Approved Supplier List" is not required, in many cases it is a good method to keep track of who qualified/approved vendors are. The records audited should include:

  • Auditor selection records

  • Auditor performance records

  • Records of supplier evaluation

As auditors we also need to understand that the records listed may be in various forms. You do not need a specific record for evaluating suppliers. Most suppliers are evaluated on a continual on-going basis. Records of this type might not be as obvious, and in some cases, even just the receiving shipper might be the only record available.

Supplier Performance

Auditing supplier performance is a totally different animal. In this case we are actually auditing the supplier, normally at the supplier's premises. In most cases, the internal auditor will have no role to play in auditing suppliers, but larger organizations may use their internal auditors to visit and audit suppliers. In some instances, even small suppliers may audit their suppliers.

The role of the auditor in this mode is similar to the registrar's auditor at your location. You will be auditing the QMS in total, or in part, and rating the supplier as to their conformance with the standard.

When auditing the supplier, the scope of the audit would undoubtedly center on the supplier's QMS. Even if the supplier is not registered to a Quality Management System standard, they still have some form of QMS. 

You can use your internal audit checklist as a base document, from which to audit, but it is not necessary. If you can get a copy of their quality documentation prior to the audit, you can develop a checklist from their own documentation.

Evidence gathering techniques you might be use here are once again records examination, and interviewing. In this case however, we are looking at much more than just one part of the standard, and the amount of evidence will be much greater. Records examined will probably be those related to:

  • Product verification

  • Corrective action

  • Continuous improvement

  • Process performance

This type of audit will involve more auditees than auditing your organization's supplier performance process. What you want to find out is if the auditees know their system, and if they are following it. 

Sometimes, audit of suppliers might have a very narrow scope. You might be auditing a single quality issue, or the supplier's corrective action to a complaint. Although the scope is narrower, you would audit it much like any other audit. 

Please remember, the focus of any audit is to determine compliance to the standard. This should not be a "witch hunt", and you should not be attempting to "get" the supplier. The focus needs to be on how well the QMS performs, not pointing the finger at the supplier.

Summary: 

Supplier performance is a key ingredient in our ability to meet our customer's requirements and expectations. Auditing supplier performance is an integral part of an effective Quality Management System. It ensures we, and our suppliers know the rules and are both reading off the same sheet of music. As auditors we must continually strive to improve the QMS. One method of doing so is to also act as a teacher of the requirements to the auditees, regardless of whether they are employees of our organization, or a vendor.

As always...Good Auditing!

top of page

 
Advertisement:


www.mmtc.org 


Question and Answers:

Q –What is the best method of selecting internal auditors?

A – There are many factors that can be used to select internal auditors. There are two characteristics of internal auditors that probably need to be met more than others. 

First, internal auditors must have the ability to audit without bias. Impartiality in internal auditors is an absolute must. Auditors must be able to look at situations objectively.

Secondly, they must have an ability to identify potential noncompliances and make improvement suggestions. In order to accomplish this, internal auditors must be able to understand the processes they audit. 

top of page


Auditing Metrics

When developing and maintaining your internal audit program, it is important to choose several key measurables to determine if your internal audit program is performing as planned. Such items to consider are things like: turn around time on audits/corrective actions, audits performed to schedule, the cost of auditing and number and type of suggestions implemented through internal auditing

top of page


Element Understanding:

ISO 9001:2000 Clause 4.1 General Requirements

"Where an organization chooses to outsource any process that affects product conformity…the organization shall ensure control over such processes"

Many organizations have processes (usually secondary) that are out-sourced. The most common of these are plating, tumbling, heat-treating and painting. There are others that we don't think about nearly as often. Things such as calibration, inspection /sorting and transportation. Also consider processes that you sub-contract in house. It doesn't matter whether the process is done at home or away.

The standard requires that all out-sourced processes that affect product conformity be controlled. This does not mean that they must be directly controlled by you. They can be controlled by the outsourcer, but you must ensure the necessary level of control. 

The control begins with the selection of the vendor who will perform the out-sourced service. It continues with the type of information that the vendor is given and the level of validation you have over the process. It ends with the any follow-up and evaluation of the vendor.

top of page


Monthly Scenario Explained:

July 2002’s question:

The procedure for the review of quotes specify that the Quality Manager will be consulted to determine adequacy of the Quality Department's resources on any new order. While auditing quote review records, you notice that only one record shows direct input from the Quality Manager

The answer:

The question here is whether the organization is following their own procedure. As an auditor, we might quickly jump to the conclusion that they are not, however that might not be the case. It is possible that the Quality Manager is being consulted, but there was only one instance where the Quality Manager gave direct input. It is possible the other times either didn't warrant input, or there was no direct input, or no evidence of such input. This changes the question slightly. Now the question becomes: "What evidence would show that the Quality Manager was, in fact, consulted?"

As an auditor, you need to determine if the Quality Manager had been consulted in each review. If not, then a nonconformance would be written. If the consultation had occurred, then a continuous improvement suggestion could be made suggesting either a sign-off by the Quality Manager, or some other evidence that would show the Quality Manager was consulted about their resources.

 top of page


The Back Page:  

Graduation

My daughter is graduating from High School next month. This is my first child to graduate, so it is a time of mixed emotions. On one hand I am happy for this achievement, knowing full well that she will be starting college in the fall. On the other hand, it is just one more sign that my little girl is not so little any more. She is maturing into a wonderful young lady. I can no longer relate to her as my little girl, and now relate to her as my adult child. All because of graduation.

I have come to understand that this same thing holds true in many aspects of our lives. We celebrate many "graduations" throughout our lives. Some are personal, like when I "graduated" to become a consultant. Some are impersonal, like when the QMS I was working on was finally "ready" for registration. I have also discovered that we must be ready to recognize "graduation" when it arrives. It very rarely will have formal announcements, senior pictures and class rings. Because graduations are typically stealthy things, we must decide when to let go. Just like a painter, we must be able to reach a point where we put down our brush and say: "It is finished." But like my daughter, once we reach that level, we need to begin looking for our next graduation opportunity.

Dave

...Good auditing!

top of page


Copyright notice: internal-auditor.com is fully protected under US and International copyright laws. Copying, or re-transmitting all, or any part of internal-auditor.com is expressly forbidden without prior written consent from Ruth Ellen Carey Communications.
internal-auditor.com is a publication of Ruth Ellen Carey Communications

Comments suggestions, complements and complaints should be directed to:
David Bradley, Industrial Communicator
Ruth Ellen Carey Communications
3698 Heathwood, E.
White Lake, MI 48383 USA

brad@rec-communications.com 
For subscription information, contact:
Subscribe
Ruth Ellen Carey Communications
3698 Heathwood, E.
White Lake, MI 48383 USA

Because this site uses information from many different sources, it must be pointed out that any advice, tips, information, etc., provided should be regarded as opinion and not fact! What works well for one company may be a disaster for another. Also, what one registrar, or auditor may allow, another may not. As always, reflect on what you read, see if it fits into your own quality system, and if it conflicts with your auditor...you've got to make a decision

top of page