internal-auditor.com

Page 1 of 2

June, 2000

This Month's Feature:

Audit Reports

The requirement in the standard is that "The results of the audit shall be recorded and brought to the attention of the personnel having responsibility in the area audited". The standard does not dictate what form either the recording or the reporting is to take. How our recording occurs, and what it looks like is strictly up to us, as long as does not conflict with 4.16, and it works! Likewise, the method we use to bring the audit results to the appropriate persons can be any method we choose, provided it works.

NCR:

There are two basic methods generally used for recording and reporting audits results. One is to use a form, often called a Non-Conforming Report. You might have another name for these. They may also be known to you only by initial; NCR, CAR, and ICAR are just a few examples. The major advantage of NCRs are they enable the auditor to not only identify and categorize the nonconformance, but also provide a clear follow-up trail for corrective actions as well.

The major drawback to the NCR is they normally do not provide for any positive feedback. This creates an audit report that is essentially negative in nature, and will not give a clear indication of the health of the overall system.

Narrative Report:

A narrative report is similar to a memo (and in fact could be). It explains in detail what was examined and in some cases, what was not. It usually outlines both conforming and nonconforming observations. The best reason for the narrative report is it tends to give a much more accurate picture of the overall performance of the quality system.

The drawback of the narrative report is it does not provide a mechanism for corrective actions follow-up. Narrative reports are also time consuming to produce.

(Continued on next page)

Featured Book:
Title: Virtual Leadership and the IS0 9000 Imperative
Author: Tom Taormina
Publisher: Prentice Hall
Notes: Provides the most concise presentation of what ISO9000 really is.

You can order this book from internal-auditor.com at: http://www.internal-
auditor.com/books.htm

Tips/Tricks/Laughter:
Auditors are frequently frustrated by lower and mid-management's foot dragging on responding to audit findings. One way to improve the timeliness of audit finding responses is to issue reminder notifications. Our audit finding response due dates are normally two weeks from the issue date of the finding. I typically issue two "Reminder of Approaching due date" notifications, one at 50% of allotted response time and the other at 75%. This method can be modified to fit your particular system, i.e. issuing only one notice for lessor response time allotments. This documentation can be in the form of a manual memorandum/form or the more efficient e-mailed memorandum/form. Issuing reminder notifications demonstrates a monitored system and can also prove useful if elevation of the finding becomes necessary. 

David A. Wimer 
BAE SYSTEMS

Observations from the field:

I had the privilege of meeting with a registrar and several of their auditors, both lead and other. The purpose of this meeting was to discuss the changes for ISO 9000:2000. Specifically, their view and interpretation of the new requirements. One key revelation was that this registrar's official position was that neither new registrations, nor updates required the Quality Manual to mirror the new standard. All the required "shalls" have to be met, but the layout could be whatever the supplier (now called the organization) uses that work for the supplier. The key here, is you need to check with your registrar to determine their stance on this issue. Why re-write your Quality Manual unless it makes sense to you. And no, I cannot tell you who that particular registrar was

internal-auditor.com

Page 2 of 2

June, 2000

This Month's Feature continued:

One of the drawbacks to the NCR and the narrative report is that neither does a good job at verifying the audit. They might verify the activity being audited, but not the audit itself. One of the reasons to report audits is to ensure the audit system is working. The next two methods can also be a balance check to ensure the thoroughness of the audit. They become evidence that the audit was completed with nothing overlooked.

Other options:

Checklist:

There are other options as well as NCRs and narrative reports. One possibility is to provide a copy of the checklist(s) used during the audit to the auditee. This enables the auditee to see the audit basically from the auditor's view. The checklist provides the auditee the background questions that point to compliance evidence. Checklists also help ensure audits are objective in nature. 

Auditor Notes:

Providing a copy of the auditor notes, particularly if the auditor notes are not on the checklist is another option. In December's issue we answered whether the auditor should keep this/her own notes. Often these notes become part of the official record. If generated properly, they could become invaluable to the auditee in determining the true state of the activity. This is a real advantage because it depicts the audit from the auditor's eyes. It also provides information on audit sample sizes and specifically what evidence was observed by the auditor. The caveat here is that the auditor must have very clear handwriting and be skilled note taker. Also, personal comments need to be avoided.

 Summary:

Regardless of which method you chose, you must ensure the report becomes a quality record and is included in the Management Review. Any and all of the above can be modified to allow for follow-up feedback, closing the loop on corrective actions. There is no prescribed method for reporting, and you could use all four methods, if you so desire.

Good Auditing!

Internal Auditor Resources:
The International Automotive Oversight Bureau (IAOB) was established to administer and implement ISO/TS 16949. This is the place to go for official information concerning ISO/TS 16949. Visit them at: http://www.iaob.org/

This site, and others can be located on our links page at: http://www.internal-auditor.com

Questions and Answers:

Q - Is the use of ISO 10011 required in the development of an internal audit program?
A - The ISO 10011 series give valuable guidelines in the development and execution of an effective internal audit program. Although I strongly encourage referencing ISO 10011, ISO 900x does not require using the ISO 10011 series guidelines. 

Q -I don't meet the requirements of ISO 10011. Does that mean I'm not qualified as an Internal Auditor?
A - Clause 4.1.2.3 requires using "trained personnel" to conduct internal audits. Element 4.18 states personnel are "qualified on the basis of appropriate education, training and/or experience". If your QMS requires you to meet the ISO 10011 requirements then you can't be qualified. That should be the only stipulation. The rules are yours.

Element Understanding:

4.17 Internal Audits [Part 8]

This is our last segment on Element 4.17. The standard requires "Follow-up audit activities shall…record…" This is the second requirement for maintaining records in Element 4.17. The question is how to "record" follow-up activities. This month we discuss audit reporting. Your reporting structure could include the reporting of follow-up activities, enabling you to provide one reporting structure for both the audit and the corrective action. Separate recording methods may be used as well. The key here is to have a system that not only verifies the corrective action, but also generates a record. This record is useful in management reviews as a gauge for determining effectiveness of the audit program.