As with any change to the international standard ISO 9001, or one of its ‘cousins’, like ISO/TS 16949, AS 9100 there’s an opportunity to review and improve the way an organization implements these requirements.
One important requirement, the internal audits, should be focused on the processes of the quality management system and recurring questions auditors have include; “How do I audit a process?” “Which processes should I start with?” and “How will I know if the process is effective?”
In the coming issues, we’ll be taking a look at practical answers to these questions and more. To start with, we’ll investigate how to get organized when planning and preparing to audit a business process……
A process can be defined as “activities which transform inputs into outputs”. One might add, “under controlled conditions”, since we usually want to be able to predict a (good) result! From this definition, we know a number of things already about any process, they have:
This is helpful, but heading off to do an internal audit with 4 topics on our checklist is unlikely to help us reveal if the process is working as intended. As auditors, we have to develop a better understanding of what an effective process requires to deliver a satisfactory outcome for the organization and its customers.
Most business processes have some form of goal or objective assigned to them, so that performance can be determined. This might be focused externally on customers’ needs or internally to the organization. And it’s usual that these goals and objectives have a measurement associated with them. If the process is working effectively, it’s by these performance criteria that an auditor can tell what’s being achieved.
In addition, it’s desirable to produce a consistent result; therefore, the process must be under control. Most of us know the wailing sound (output) made by a loudspeaker, when the microphone (input) is placed too close to that speaker – it’s called feedback! You can certainly measure the sound level, but the process is out of control! Our business processes need controls to ensure that things don’t get out of hand.
Process controls for the activities are accomplished many ways;
- People – competent, aware and trained
- Equipment – maintained, (calibrated, if necessary for measurement)
- Methods – procedures, work instructions, (as necessary, under document control)
- Materials – approved, available, identified, etc.
In listing these control criteria, our list of audit topics has grown quickly, and we must also consider some other controls which must be in place; – documentation controls, non-conformance, records generated from the process, corrective/preventive actions and improvements.
The challenge of preparing for any audit is the sequence in which to place these, so that we can gather useful information about the process, rather than just a number of facts, since creating a simple list of these topics is not as helpful. There are a number of ‘visual metaphors’ which have been used as tools to assist auditors. One unique approach has proven successful in helping auditors to organize these topics in an appropriate sequence – the ‘Football©’.
The use of this tool to ‘visualize’ the path an internal auditor should take when auditing a process has a number of advantages;
Comprehensive planning – so that all relevant controls are considered, in their correct sequence (the above is an example applicable to a manufacturing process). Structure to audit checklists or questions – they follow the appropriate process flow. This allows information to be gathered and used later to verify performance.
It can assist an audit manager with ensuring the assigned auditor (s) do the relevant research of those requirements and controls, so that they develop better understanding of them, before the audit interviews. The auditor has a ‘bigger picture’ to audit and is therefore more likely to see systematic issues.
Evaluation of actual process performance to the objective(s) as well as compliance of the QMS.
Better time management, adherence to audit scope etc.p>
By populating the various ‘bubbles’ (in the example) with the details of the organization’s management system and/or customer requirements etc., the auditor is able to get a clearer understanding of the expected outcomes. They are better able to identify opportunities within the management systems, as a result.
It is often easy for an internal auditor to be ‘drawn off track’ when evaluating the other criteria and controls (depicted by the football’s ‘laces’) which can affect a process – calibration for example – and the football assists the auditor in defining the ‘boundaries’ at which point they must decide to return to the normal process flow.
In review, conducting process based internal quality management system audits can be an overwhelming task leading only to a report based on compliance only. The use of a planning tool like the football, to map out an auditor’s strategy, leads to far more effective and efficient audits and focuses the auditor on validating the results of the process, to the plan.
In the next edition, we’ll take a look at which processes may be more ‘important’ than others and how to go about scheduling internal audits to consider them.