internal-auditor.com

Page 1 of 2

January, 2000

This Month's Feature:

Handling Out-of-Scope Issues In our October issue we discussed what objective evidence was, and how to find it. November's issue dealt with audit scope and size, and last month we examined the audit schedule. This month we will try to tie together, all that we have learned and find out how we can use this when faced with an out-of-scope issue. It is not unusual for an auditor encounter an out-of-scope issue during an internal audit. And although individual companies may have procedures for such an occasion, most organizations leave out-of-scope issues to the discretion of the auditor. The first step in deal with out-of-scope issues is to recognize them when they occur. If you'll recall, audit scope and sampling are determined prior to the audit, and determined, in part, by the audit schedule. An out-of-scope issue is one that falls outside of the audit plan. Perhaps the issue pertains to a different element, procedure and/or department. Based on the checklist questions, and the evidence presented, you might discover something you know is noncompliant, but is not covered by the audit scope. This is an out-of-scope issue. So, how do you deal with them? There are roughly five possibilities for dealing with out-of-scope issues. The first is to pretend you did not see it...WRONG! Auditing is about proving the quality system and continuous improvement. Ignoring a noncompliance does neither of these things. But there are some things you can do. Typically you could:

• Change the scope
• Issue an "observation"
• Perform a Supplemental Audit
• Make a note for the next "In-Scope" audit

(Continued on next page)

Featured Book:
Title: ISO 9000 Quality System : Department by Department Implementation for the Certification Audit
Author: Jack Kanholm
Publisher AQA Press
Notes Department by department, this book explains precisely what a company must do to implement the ISO 9000 quality system and pass the certification audit. Every requirement is addressed. There are hundreds of tips and examples of implementation solutions.

You can order this book from internal-auditor.com at: http://www.internal-auditor.com/books.htm.

Tips/Tricks/Laughter:
When you are looking at records. Keep to the sampling plan. If the plan is to check ten purchasing records, check only ten, even if nonconforming records are found! Too often we increase the sample if we find a nonconformance. Part of the auditee's corrective action will be to check all the records, you don't have to! Finding nonconformances, or not, should have no effect on the sampling size. When generating the audit report, make sure you mention how many nonconformances were discovered out of how many records checked. For example, two nonconformances out of ten records. This gives an indication of the severity of the nonconformances.

Observations from the field:

Watch for bear traps. That's the observation that comes our own Ruth Ellen. Being from northern Michigan, she knows a bear trap when she sees one! Of course, we aren't talking about an actual bear trap, but something you might think is just as bad when you're caught. There are two types of traps. The first is where you place limitations in your documentation. One example may be including the color of paper in the procedure. The second is where you get all wrapped up in the definition of a word. It may be too restrictive, or too general. Internal Auditors need to be aware of these traps and be able to clearly mark them when spotted. This will not only lead to solid continuous improvement, but may also help prevent registrar nonconformances.

internal-auditor.com

Page 2 of 2

January, 2000

This Month's Feature continued:
Let's examine each of these factors in some detail:
Change the Scope:
Changing the scope is probably the hardest option. It will change the entire audit schedule, and force the reallocation of auditor resources. The auditee may also not have the appropriate resources to supply adequate objective evidence. This could also amount to a "surprise" audit and hurt relations between the activity and the audit team
Issue an "observation":
An "observation" used in this sense, is a finding that cannot be listed as either conforming or not. In this instance an observation could be useful in allowing the activity being audited something concrete on which to base their investigation. Observations usually carry no mandate, so there is the possibility the auditee might not take any action.
Perform a Supplemental Audit:
We discussed supplemental audits last month, and the rules for audit notification still exist. Many shops feel this is the best alternative, since it gives both the department and the audit team time to prepare. A supplemental audit also formalizes the issue to determine if the issue is truly compliant. If it is not, then a corrective action is required, as per a planned audit.
Make a note for the next "In-Scope" audit:
Of all of the above, this is the least desirable alternative. This decision means that you are allowing a potential noncompliance to continue without an investigation to determine if it is in fact a noncompliance. Even more damaging is the fact that there may be a process out of control that could allow nonconforming product to be shipped.
It must be stressed that most internal auditors will not have the option of choosing which method to use. But as our goal is to prove the quality system and continually improve, then we should provide the options and alternatives that will best achieve the audit, and the quality system goals.

Internal Auditor Resources:
Sometimes understanding the standard and requirements may be difficult. We have found a website that translates ISO into plain English. The name is ISO 9000 Translated into Plain English, and they can be found at:
Now there is hope for the rest of us!
This site, and others can be located on our links page at: http://www.internal-auditor.com

Q-Do corrective actions have to be reported on the audit reports?
A-.The standard requires that management of the area take "timely corrective action", but doesn't dictate how corrective actions are recorded. In fact, if "Follow-up activities verify and record ", then there may not be any 4.17 requirement to record corrective actions. However, in 4.14.2 b) records are required.

Element Understanding:

4.17 Internal Quality Audits [Part 3]

"...and shall be carried out by personnel independent of those having direct responsibility for the activity being audited." This is by far the toughest and most argued clause in Element 4.17. One primary reason is a clear example of the traps mentioned in "Observations from the Field". Depending on if you view "those" as representing the auditors, or the auditees, the clause could have major difference in intent. Most registrars view "those" as auditees. This means that auditors must be independent of the auditees that have direct responsibility for the activity being audited. Independence means more than just supervisory positions, but informal power as well. The intent here is that Internal Auditors be unbiased, period.

Advertisement: