High Impact Auditing

Internal auditing, the process by which an organization examines its ability to meet internal and external requirements, can be one of the most effective tools for triggering continual improvement. It can also be an expensive waste of time and a source of endless frustration and conflict. Which it becomes for you depends on how your organization plans and manages its audit system.

Auditing is not only a balancing act--identifying positive and negative aspects of a company’s performance--but also a planned activity, with auditors and auditees agreeing on the audit’s time, place and scope. Surprise audits are neither necessary nor desired. Internal audits generally use an organization’s existing personnel for the task, although outsiders are occasionally called in.

Internal audits offer huge benefits, both to the organization’s top management and the auditors. Top managers can:
* Discover what’s really going on within the organization, which allows for more objective decision making
* Learn of potential problems before they explode into issues that pose significant risk to the organization
* Ascertain where failures occur, enabling the containment of these problems and initiation of corrective action
* Identify where resources should be directed
* Determine how effective their training efforts are
* Learn which processes and personnel are particularly effective, which can trigger recognition

For their part, internal auditors:
* Gain exposure to other parts of the organization, which broadens their experience
* Are exposed to best practices they can implement in their own departments
* Learn how they contribute to the organization’s success, which increases motivation and employee retention
* Expand the organization’s competency and knowledge base through their experience

An effective internal audit system must work in concert with other systems, especially corrective and preventive action. An internal audit takes a snapshot of the organization, identifying nonconformities, opportunities for improvement and positive practices. Auditors don’t propose specific actions, fixes, solutions or recommendations. They simply identify where failures and successes occur. By their nature, audits typically identify more failures than successes, and these failures are called audit nonconformities.

Requirements vs. opinions

To identify a nonconformity, a requirement is needed. You might have a concern, remark or opportunity, but it’s not a nonconformity unless it’s clearly tied to a requirement, a fact that’s often overlooked.

Any activity, process or outcome that doesn’t meet requirements is a nonconformity. A number of sources, such as ISO 9001, inspection checklists, purchase orders and product specifications, could introduce specific requirements the organization must implement. The auditor’s opinions, notions, philosophies and personal experiences, however, don’t constitute requirements. When people audit with an eye toward driving continual improvement, requirements are sometimes “invented,” albeit usually with good intentions. One of the best techniques for ensuring audit nonconformities are written correctly is insisting that they’re structured in two parts:

Requirement--Exactly what the organization has committed itself to do

Finding--Exactly what the organization has or hasn’t done that contradicts the requirement

Objective evidence

Objective evidence is a factual recounting of what was seen, heard or experienced during the audit. Gathering this evidence takes the most time and effort.
It is recorded in the “finding” portion of the requirement and describes exactly how the organization failed to fulfill the requirement.
Objective evidence meets a number of criteria. Among other things, it’s:
* Not subject to bias or prejudice. Auditors can’t allow their personal feelings to influence their interpretation of the evidence.
* Traceable. As many identifiers as possible should be recorded (e.g., date, time, function, department, machine, customer, order number and product code).
* Expressed as simply as possible. Sometimes auditors will provide a paragraph or more of detail, thinking that more data will provide more convincing evidence. However, the objective evidence is best streamlined and to the point.

Objective evidence is stated in such a way that the first half of the nonconformity directly contradicts the requirement. Enough detail is provided to facilitate traceability--but not so much that it overwhelms. Auditees expect concise and clearly written findings.

Consider the following correct audit write-up:

* Requirement: The general manager stated that all employees are expected to understand the facility’s key measures and how to contribute to them. (Note that the requirement comes from the general manager’s statements, which function as requirements when he’s talking about something under his control.)
* Finding: Three out of five employees sampled randomly in the shipping department didn’t understand the facility’s key measures or how to contribute to them. (Note that the finding’s language mirrors that of the requirement, stating exactly how the organization failed to meet its commitment. The sample size is defined, and the location is also identified. Employee names, however, are appropriately omitted.)

Now look at this incorrect write-up:
* Requirement: All employees should understand key measures. (Note that it isn’t clear whether this is an opinion or a requirement. Where did this “should” come from?)
* Finding: Employees were ignorant of the organization’s objectives and strategic direction, and they were obviously unprepared to assist in continual improvement. (Note that here, the finding’s tone is subjective and accusatory. Sample size and other identifiers are omitted, which provides insufficient traceability.)
It generally takes a number of audits before an inexperienced auditor can confidently draw conclusions from objective evidence and write nonconformities clearly and concisely. Practicing the audit process with an experienced auditor is time well spent.

The system, not the people

One of the best ways to understand the system and its effectiveness is through people: how they receive and interpret information, carry out instructions, produce goods and deliver services according to requirements, and satisfy customers. Nevertheless, an audit must always focus on the system itself.

Some auditees might suspect that an audit constitutes a personal attack on their jobs, and auditors must be prepared for that reaction. They should calmly explain that the audit process is all about the system, put the auditees at ease and depersonalize the process as much as possible. If people are uneasy about the audit process, they won’t provide objective evidence, and the audit, in turn, won’t trigger continual improvement.

Does this mean people never screw up? Of course not. But when failures are identified during an audit, they’re system failures. Very few nonconformities occur due to willful employee misconduct. If someone makes a mistake or fails to carry out a job step, it’s usually because the system is flawed and error-prone. Fix the system, and people will have less opportunity to screw up.

Auditing strategic processes

Not all organizational processes have the same strategic significance. An internal audit system that’s oriented toward continual improvement will focus on strategic issues. Most management system standards such as ISO 9001 require that organizations schedule audits based on status, importance and prior audit results. This means organizational processes with more strategic importance will be audited more often.
The following audit questions reflect on processes that typically have high strategic importance:
* Customer satisfaction. What methods does the organization use to capture customer perceptions? How are data on customer perceptions reported and analyzed? Has overall customer satisfaction improved?
* Corrective and preventive action. Is there proof that root causes or potential root causes are being identified? Are actions taken to eliminate root causes or potential root causes? Are data on corrective and preventive actions reported and analyzed?
* Leadership. Has the organization determined its mission and strategy? Are organizational performance and direction communicated throughout the organization? Has top management led the review and action on key measures and other important information that indicates organizational success?
* Internal auditing. Do auditing schedules clearly reflect the strategic importance of processes and the results of previous audits? Does the organization’s management take corrective action on nonconformities raised by audits? Are the corrective actions effective, based on the evidence?
* Design and development. Are design inputs and outputs recorded and approved? Is progress against the design plan periodically reviewed? Is the design process’s output validated under conditions of application or use?
* Transformation. How is work planned and scheduled? What information guides work performance in general? How do employees receive feedback on their work? Do employees understand how their efforts affect key measures?
These audit questions are examples and might not be applicable to all organizations. Other processes could have strategic significance, depending on the organization’s nature and competitive environment.

Training auditors

Many audits produce poor results because auditors haven’t received proper instruction or been given opportunities to practice what they’ve learned. The organization must invest the necessary time and effort in making its auditors competent and confident before they’re assigned an audit.

Auditors must be familiar with:
* Practical interpretations of the standard adopted by the organization
* The audit’s purpose and how it drives continual improvement (i.e., by providing a balanced picture of the organization and triggering corrective and/or preventive actions)
* Phases of the audit and various activities within each phase
* Sources of audit requirements (e.g., the standard, procedures or sales orders)
* Methods of gathering objective evidence and drawing valid conclusions
* Diplomacy skills and effective interpersonal communication
* Audit role-playing under controlled conditions
* Writing nonconformities in the prescribed format
* Actual auditing with an experienced auditor

Auditor training doesn’t necessarily need to be formal or even classroom-based. The style and format of training will differ significantly from one organization to the next. However, auditors must have a conceptual understanding of the process and a practical grasp of techniques, both backed up by sufficient practice. When auditors truly understand their roles and responsibilities, the process should result in strategic continual improvement.

A successful audit almost always results when an individual takes personal ownership of the process. He or she must be able to carry out the following five complex and linked activities, which create strategic continual improvement.

Audit scheduling

An audit schedule defines the auditing that will take place during an extended period of time, usually six months or a year. The purpose of the schedule is to communicate when and where the audit team’s services will be needed, when the organization can expect to be audited, and what requirements will be included in the audit.

Audits scheduled far in advance always produce better results. Note, too, that the processes considered more strategically important to the organization are scheduled for audits more often. Processes and functions that have performed poorly in previous audits are also scheduled for frequent audits. Regardless of other considerations, all processes, functions and departments within the scope of the management system must be audited at least once a year.

The schedule can be keyed to organizational processes, departments, functions, facilities, an ISO standard element or something else. However, it must clearly communicate which audits are coming up and when. Audit schedules should provide enough detail to guide the overall process and help with the next step, audit planning.

Audit planning

An audit plan is focused, detailing a single audit’s scope, objectives and agenda. The plan provides a chronology of the audit from start to finish: which processes will be audited, exactly when they’ll be audited, who will do it and which requirements will be audited in each segment. Even details such as meetings, breaks and lunches are shown on the plan in order to clear up any timing conflicts between auditees and auditors and keep the audit on track.

Typically, the audit plan is distributed several days prior to the audit. Auditees often request alterations to the plan based on logical concerns and existing commitments. By all means, modify the plan to accommodate them. The one variable that usually never changes, however, is the audit’s scope.

Audit supervision

The audit’s on-site phase consists primarily of gathering evidence. The lead auditor takes part in this and also manages the overall process. These duties typically include:
* Leading the opening meeting
* Managing and communicating changes to the audit plan
* Ensuring that the audit stays on track
* Insisting that auditors remain objective, consistently evaluating all evidence
* Encouraging auditors to write up their findings during the audit to avoid a time crunch directly before the closing meeting
* Reviewing all nonconformities to ensure that they’re logical, valid and clear
* Providing performance feedback to audit team members so individuals can target areas for their personal improvement
* Resolving all conflicts constructively
* Apprising the auditee of the audit’s progress
* Leading the closing meeting
* Ensuring that the entire audit is conducted professionally and positively

If these duties sound difficult, it’s because they are. Many organizations have ineffective audit processes because the so-called lead auditor doesn’t understand his or her responsibilities. An accredited lead auditor course is a very good investment for individuals who function as lead auditors for their organizations.

Audit reporting

The first formal reporting that takes place during an audit is the closing meeting. The lead auditor presents a verbal summary of the audit, including positives and negatives. Depending on the audit’s size and duration, the closing meeting might last from 15 minutes to more than an hour. The meeting allows for back-and-forth dialogue between auditors and auditees. During the closing meeting, auditee management is presented with the written audit observations and/or corrective action requests, and these form the basis for discussion of the audit results.

Subsequent to the closing meeting (and occasionally during the closing meeting), an audit report is presented to the auditee management. This summarizes the audit’s overall themes and trends. Usually it’s written by the lead auditor, based on evidence gathered by the entire audit team. The report doesn’t belabor every audit observation because these should have already been addressed during the closing meeting. Audit reports should be as concise and streamlined as possible. Graphics such as matrices and Pareto diagrams are helpful.

Verification and closure

The auditee management is usually asked to respond to audit nonconformities by an agreed date. The response should include investigation into the root cause, proposed corrective action and a date when the action should be completed.

The lead auditor reviews the responses to determine whether the investigation and proposed corrective actions are adequate. This is the first stage of verification.
One of the most important jobs the lead auditor and auditing team can perform is a careful scrutiny of auditee responses. Accepting weak investigations and/or corrective actions does nobody any favors and certainly doesn’t trigger continual improvement. If a response doesn’t identify a plausible root cause or propose a corrective action related to it, the lead auditor must diplomatically reject the response and explain to the auditee why it’s adequate. The auditee is the audit process’s customer and should be treated with the same respect that any other customer would receive.

The second stage of verification occurs when the auditee notifies the lead auditor that corrective action has been implemented. At this stage, the lead auditor or a team member will verify that the corrective action has been fully implemented and the root cause of the original nonconformity has been eliminated.
Verification is sometimes performed by reviewing records or documents submitted by the auditee; alternatively, an on-site visit is made to review evidence in person. The nonconformity’s nature and significance will determine whether on-site verification is necessary.

Once all audit nonconformities have been addressed with effective corrective action, the audit is considered closed. However, this doesn’t mean it’s forgotten. A high-level discussion of audit results is an important input to the business review process, and audit trends influence resource allocation and strategic decision making.

Five Keys to Successful Internal Auditing

Internal auditing is one of the most routine improvement tools available to organizations. In fact, it’s so ordinary that auditors sometimes forget the underlying principles of auditing. Auditors must be periodically reminded of these underlying truths or the entire audit process can begin to backfire. Keep these in mind as you audit and you’ll nearly always be successful.

Principle 1: The customer of the internal audit is the one being audited

That’s right; the people you’re auditing are your customers. Internal auditing is a service you perform to help make your organization more successful and identify problems before they spiral out of control. The quality of your product depends on how well the audit is planned, the type of training provided to auditors, the level of engagement of top management and the way auditors behave during the audit, among other factors. You must conduct the audit with the same level of professionalism and diplomacy as if you were being paid by an outside party.

Little things that indicate the auditors have forgotten who the customer is include:

*** Treating the audit as a “Gotcha!” exercise. Auditors should never express satisfaction or glee when nonconformities are found. Focus on the facts and keep things as impersonal as possible. Failures revealed by the audit are opportunities for the future.

*** Failing to adjust the audit plan to meet the needs of the auditee. Unexpected events can occur during an audit: accidents happen, lines shut down, rush orders must be processed. The audit plan should be flexible enough to handle changes on the fly.

*** Holding surprises until the very end. The auditee should be apprised of audit results throughout the entire process. Don’t make the mistake of holding a “bombshell” until the closing meeting for maximum impact. Auditor should communicate their concern, along with all supporting evidence, when they think they might have found a problem.

*** Focusing on insignificant details at the expense of critical issues. Auditing is a detailed activity, but don’t forget to examine the effectiveness of the overall system. When faced with an issue, auditors should ask themselves, “What effect does this really have on the organization and its customers?” The answer will usually indicate if the issue is one worth delving into in great detail.


Principle 2: Planning is the key to success

Audits don’t create improvements by accident. It takes a great deal of planning and coordination. I’ve often said that a well planned audit almost runs itself. On the other hand, a poorly planned audit runs itself into the ground, and planning often gets shortchanged in the rush to get audits done.

Audit planning involves a significant amount of dialogue between the auditors and auditees. It’s a dynamic process that begins well in advance of the audit itself. Planning typically provides details around the following issues:
*** Date: When will the audit take place?
*** Location: What’s the audit’s location?
*** Scope: What are the official boundaries of the audit?
*** Objective: What is the point of performing the audit?
*** Auditors: Who will perform the audit?
*** Areas to be audited: What functions, departments or processes will be evaluated during the audit? Sometimes this is clear from the scope, but often not.
*** Topics to be audited: What subjects will be audited in the given departments? Should the auditee expect questions about document control or management commitment? This not only gives the auditee a heads-up, but it also helps guide the auditors.
*** Timing of the audit: When exactly will each department be audited? When will the opening and closing meetings take place?

The audit plan may also address other issues, but the ones mentioned above are the most common. The purpose of the audit plan is two-fold: To help the auditors understand exactly what they’ll be doing during the audit and to allow the auditees to know what to expect. It isn’t uncommon for the auditee to propose changes to the audit plan, usually minor alterations in the timing (“Instead of auditing sales at 9 a.m., can you come at 10 a.m.? We already have something scheduled for 9 a.m.”). Changes of this sort are entirely reasonable and should be accommodated to the extent possible. Remember, the customer of the audit is the auditee.

The audit plan is documented as concisely and clearly as possible. The exact format is usually dictated by the magnitude of the audit. A plan for an audit of an hour or two could take the form of an e-mail. A plan for a full day or multiday audit will often take the form of a matrix, indicating hour-by-hour blocks of activities. Whatever the format, the plan should be communicated far enough in advance of the audit for all parties to digest it and understand its effect on operations.

Principle 3: Opinions never constitute nonconformities

Everybody has opinions. As people become wiser and more experienced, they tend to develop even more opinions. Many auditors consider themselves to be wise and experienced, meaning they have loads of opinions. Sometimes these opinions become the basis for nonconformities, which is a huge mistake. Facts are the only legitimate basis for nonconformities. Opinions have no role in the process.
A child could write a good nonconformity. The problem is that children don’t write them, wise and experienced auditors do. Consider the following:

- The company committed itself to doing XYZ. The commitment is a fact, evidenced by its presence in a procedure, plan, policy, specification, contract, work instruction, standard or statement.

- The company failed to do XYZ. The failure is a fact, based on evidence such as records, observations, documents or interviews.

No opinions are present in the nonconformity, just cold, hard facts. It’s hard to argue with facts. It also makes the audit go much smoother. Sure, facts may remove a degree of creativity that auditors exercised, but creativity is better expressed in other ways.

Nonconformities aren’t the only kind of audit findings. Because the audit is a balanced process, positives are also highlighted. These may be recorded individually, summarized in an audit report, or presented orally during the closing meeting. Every organization will have at least one or two positives that can be recognized. The auditors just have to remember to look for these in the course of their auditing.

Some organizations also include another category of finding called observations, remarks, comments, opportunities, recommendations, or any number of other names. These fall into a gray area that doesn’t quite constitute nonconformity, but is still an issue worthy of investigation. Sometimes these will include specific recommendations for taking action based on past experience, established best practices or regulatory requirements. These types of findings give auditors a chance to express opinions. Audits are a great place for benchmarking and sharing best practices, as long as all parties to the audit understand and agree to how this will happen.

Principle #4: Don’t burn out your auditors

It’s human nature to utilize your best resources. If you have a patch of ground that produces great tomatoes, it’s tempting to keep planting tomatoes there, year after year. The only problem is that the soil eventually becomes exhausted. This is the case with an internal audit program, too. Experienced and well-trained auditors produce effective results, so they frequently get called on to perform audits. As a result, the organization fails to develop new auditors, and they end up with no auditors when the experienced auditors run out of gas and scream, “No more!”

One of the best strategies is to make each auditor’s ‘tour of duty’ a year and a half. Annually, train a new group of auditors, and then use the remaining six months for the experienced auditors to mentor the new group. Schedule auditors in teams of two, one new auditor and one experienced. That way, the new auditors get the benefit of observing the seasoned auditors in action, and the seasoned auditors can learn from the new perspectives and unburdened approaches employed by the new auditors.

After a few years of rotating in new groups of auditors, you’ll have utilized a significant chunk of your employees. The benefits of doing this are clear:
 Broad exposure of personnel to other functions in the organizations
 Deeper understanding of the management system and its processes
 Stronger communication and analysis skills, as a result of auditing experience
 Varied perspectives and viewpoints that come from using a wide range of personnel as auditors
 Less likelihood that the audit process will fall victim to groupthink, which happens when the same people always involved
 You will an informal ‘alumni association’ of ex-auditors who can be called on to perform audits periodically if you get into a pinch

Take the time and effort to develop new teams of auditors on a regular basis. You’ll find that the overall effectiveness of your audit process will increase significantly over time.

Principle #5: Audits should focus on critical success factors

Critical success factors are the things that keep you in business and help build customer loyalty. They will be different from industry to industry and from company to company, but there are certain critical success factors that apply to nearly all organizations. The internal audit should probe these areas in detail and dedicate significant effort to analyzing their effectiveness:

 Management review: This is the top management reviewing performance, analyzing data, making decisions, and initiating actions for improvement. It is one of the most important functions in your organization, so auditors will need to apply some effort to examining it.

 Corrective and preventive actions: Few issues have as much bearing on an organization’s success as problem solving and problem prevention. These processes should be scrutinized nearly every time an internal audit is performed.

 Customer satisfaction: The primary reason that organizations exist is to satisfy their customers. How well an organization listens to its customers and takes action on what it learns is definitely a critical success factor.

 Internal audits: If internal auditing wasn’t important, you wouldn’t be reading these words right now. Auditing is one of your primary processes for evaluating process effectiveness and driving improvements, so you will definitely want to audit it on a regular basis. Some people find the notion of auditing the audit process unusual, but it must be examined just like any other key function.

 Product realization: Whether your organization produces a good or service, it certainly has product realization. It could involve manufacturing activities (e.g., cutting, stamping, welding, and assembly) or service activities (e.g., scheduling, repair, trouble shooting, instruction). No matter what kind of activities are in place, this is your core transformation process that has the most direct impact on your customers.

Decide which processes in your organization are the most important to its success, and make sure these processes are audited in-depth and often. The results of the audit will speak for themselves.

The 10 Biggest Quality Mistakes

One of the most effective ways to improve is to learn from other people’s mistakes. Experience has taught me that there are plenty of mistakes out there to learn from. The trick is to recognize them and understand what to do instead. Unfortunately, I keep seeing the same mistakes over and over. They aren’t mistakes because they violate a standard such as ISO 9001; they’re mistakes because they violate good sense. Let’s examine the 10 most common quality mistakes and see how they can be corrected.

1. Limiting quality objectives to traditional quality topics

The term “quality objective” is an unfortunate one. It introduces subjectivity (i.e., quality) into a subject that should be quite clear (objectives). A much better term would simply be “measurable objectives” because that requires less interpretation. The word “quality” clouds the issue and makes many people want to narrow the focus of what a quality objective can be.

The truth is that quality is reflected in everything an organization does, and a quality objective can be anything measurable that relates to the organization’s success. A quality objective might relate to finances, customer feedback, safety, efficiency, speed or innovation. All these attributes relate to quality in one way or another. When selecting quality objectives, organizations should examine what matters most to their success. Whether the resulting measure is tied to traditional quality control or quality assurance is irrelevant.

2. Holding infrequent management reviews

Management review is the process used by top management to analyze data, make decisions and take action. Ideally, it’s a preventive process because data should indicate threats before they blossom into full-blown problems. If top managers are unable to analyze data proactively and prevent problems, then they’re not doing their jobs. Holding management reviews once or twice a year ensures that actions taken won’t be preventive. Only through timely and frequent data review can actions be preventive. Once or twice a year won’t cut it.
Many people argue that their organizations already review data on a weekly and monthly basis. This means that management review is still after the fact; the decisions have already been made. Management review must be included in existing meetings. Instead of a twice-yearly dog-and-pony show, cover the inputs and outputs of management review as they occur naturally during existing meetings. After a month or two, you’ll have addressed all the required inputs and outputs. Using this approach, you’ll have information that’s timely and resulting actions that are preventive. Another advantage is that you dispense with the need for long, laborious management reviews. They happen in a smooth and effective manner that’s much more likely to drive improvements.

3. Sending out long, complex customer surveys

The days of the long and complicated customer survey are over. People don’t have time to complete them. Even when organizations design shorter surveys, the questions are often confusing and fraught with interpretation problems. The scales that accompany the questions are often unbalanced and illogical. As a result, organizations end up with a small amount of valid data. Better to have no data at all than data that could lead you in the wrong direction.

Instead of a survey, why not simply ask your customers what they like and dislike? Don’t limit their responses to survey topics. Let your customers dictate the content of their feedback in response to open-ended questions. Few are more powerful than the following: What do you like? What don’t you like? What would you like to see different in the future? Open-ended feedback is also much easier to understand and take action on. A customer- satisfaction index of 3.8 is hard to interpret. On the other hand, seven out of 10 customers telling you that your Web site is confusing is very easy to interpret.

4. Assuming everyone knows what “nonconforming” looks like

When I visit organizations, one of my favorite questions is, “Where do you put the nonconforming products?” Control of nonconforming products is one of the most basic kinds of controls, and it speaks volumes about the rest of the controls embraced by the organization. Unfortunately, where I often find nonconforming products is wherever someone decided to leave them. They’re not uniquely identified, either. In other words, nonconforming products are treated no differently than any other products. When I ask why this is happening, the most common answer I get is, “Because everyone knows that’s nonconforming.” No, they don’t. No matter how nonconforming a product is, there will be someone who won’t recognize it as such. The stories of bent, broken and blown-up products that somehow got used anyway aren’t urban legends. They’re true.

Smart organizations positively identify all nonconforming products, and really smart organizations segregate them to remove all chance of accidental use. Error-proof your control of the nonconforming product process so that nobody has to assume anything.

5. Failing to use the corrective action process

Corrective action is the systematic way to investigate problems, identify their causes and keep the problems from happening again. Nobody wants problems, but it’s essential to have a way of dealing with them when they come up. The more the corrective action process is used, the better the organization gets at addressing its risks and problems. That’s why I’m astounded when I hear about organizations that avoid using their corrective action processes. Of course, I always ask why they’re doing this, and I often get one of these answers:
• Corrective action isn’t effective for large problems.
• Corrective action isn’t effective for small problems.
• Nobody understands root cause.
• Our problem-solving tools are confusing.
• Our procedure requires too much paperwork.
• Corrective action takes too long.
• I hate our corrective action form.
• Top management frowns on corrective action because it means that someone screwed up.

These aren’t corrective action problems but problems with the organization’s approach to corrective action. An effective corrective action process is typically seamless, simple and intuitive. The whole point is to add a little structure to problem solving, not to create additional bureaucracy.

Here are some hints to make your corrective action process more user friendly and effective:
• Strip it down to the essentials. A corrective action must clearly describe the problem, how it’s caused, actions taken to remove the causes, results of actions taken and how the actions were effective. Only include additional elements when you can prove that they add value.
• Remove all jargon from the process. Strange words only discourage people from using the process.
• Don’t insist on a raft of signatures . It’s not necessary for half the management staff to sign off on every corrective action.
• Remove paper from the process as much as possible. Use electronic media to track corrective actions.
• Communicate corrective actions widely. When people see that corrective actions accomplish something, they’re much more likely to participate in the process.
• Provide problem-solving tools, but give people some discretion in their use . If your procedure requires a failure mode and effects analysis to be completed for every corrective action, it will probably discourage people from starting corrective actions.
• Use teams for corrective actions whenever possible. This gives people experience in the process and also increases the effectiveness of most solutions.

6. Applying document control only to official documents

Most organizations do a decent job of controlling “official” documents, the procedures and work instructions that form the core of the quality management system (QMS). These are often written, approved and issued according to very specific guidelines. What organizations don’t do very well is control unofficial documents, many of which are more important than the official ones. What am I talking about? Here are some examples that are often found in production areas:
• Post-it notes with special requirements written on them
• Memos that include procedural steps
• E-mails with customer specifications
• Photographs showing what a product should look like
• Drawings indicating how product components fit together
• Samples of product showing defect limits

These informal resources become documents when they’re shared for people to
use, and they’re some of the most important documents within an organization. They’re distributed and posted in a hurry--usually without control--because the information they communicate is considered critical. Nobody can quibble with the speed of distribution, but the lack of control guarantees problems later. I’ve seen 10-year-old memos posted in organizations that exhorted personnel to perform obsolete job steps. When documents aren’t controlled, mistakes and nonconformities are inevitable. Apply document control to all documents, and scrutinize your document control process to keep it streamlined and effective.

7. Focusing audits on petty, nonstrategic details

Auditing is the process of comparing actual operations against commitments the organization has made. It’s a simple, fact-driven process that can generate huge improvements. However, these can occur only if auditors focus on the right things. Too often, internal auditors become preoccupied with petty details and neglect the big issues. They’re uncomfortable examining the big, strategic issues. It’s much easier just to nitpick. Organizations rarely provide enough training and skill-building to their internal auditors, so it’s no wonder that they aren’t prepared to carry out their duties to the fullest.

A robust internal auditing process examines make-or-break issues. Here are just a few of the items that internal auditors should probe in detail:
• Customer satisfaction. Is the organization capturing and analyzing customer satisfaction data? How is it acting on the data? Do trends show improvements in customer satisfaction?
• Management review. Does management review happen as planned? Does the necessary information and data get reviewed? What actions result?
• Corrective action. Is corrective action applied to existing nonconformities? Is it timely? Does evidence indicate that causes are removed to prevent recurrence?
• Preventive action. Does the organization take preventive action based on data and information? Is it effective?
• Internal audits. Are audits scheduled and carried out based on status, importance and prior audit results? Do audit nonconformities become corrective actions? Is the entire scope of the management system audited?
• Objectives. Are objectives established and communicated? Do employees understand them?
• Control of nonconforming products. Are all nonconformities positively identified? Are dispositions carried out as required? Are trends analyzed for improvement?

There are, of course, many other important issues an audit process could examine. The point is that internal auditors should go after the items that really affect the organization’s success. Focusing on petty details serves no purpose but to confuse everyone about the purpose of audits.

8. Training some personnel, but not all

Most organizations provide significant training to hourly production personnel. Salaried and managerial personnel are often neglected, however. Why? Because there’s a perception that salaried workers don’t affect product conformity. This is a serious error.

All personnel must be included in the training process. Salaried and managerial personnel need more--not less--training because their decisions and actions have more lasting effects. When an hourly employee makes a mistake, it could cost money. When a top manager makes a mistake, it could put you out of business. Doesn’t it make sense to train these people? Do it early and often.

9. Doing anything just because an external auditor told you to

External auditors wield great influence. Their statements and judgments can have a lasting effect on the way an organization conducts business. This can be good or bad. Usually, it’s bad. Most external auditors working for a registrar are removed from the realities of running a business. They travel from organization to organization, gradually collecting paradigms about the way a QMS should be implemented, maintained and improved. These paradigms are sometimes reflected back to the organization in the form of recommendations or nonconformities.

In my travels to companies, I often ask people why they’re carrying out a process the way they are. I always raise this question when the process seems unwieldy or illogical. In a surprising number of cases, the answer will be, “Because the external auditor said we should do it that way.” What a waste. Do a reality check on the auditor’s recommendations. Never do anything just because an auditor would like it done that way. A certificate on the wall isn’t worth it.

10. Employing someone who only oversees the QMS

Having a person who does nothing but oversee the ISO 9001 (or any other) QMS is one of the worst ideas in the history of quality. Why? Because it guarantees two things:
First, the QMS coordinator will become isolated from the rest of the organization. Because the person does nothing but serve the QMS, he or she loses touch with why the organization exists in the first place. The system becomes paramount over the organization’s business concerns. Second, the QMS will become bloated and bureaucratic because it must expand to completely fill someone’s time. Procedures become more complicated, methods more cumbersome and the benefits more ambiguous.

A QMS is nothing more than a guiding structure of methods, and it shouldn’t take a huge dedication of time and effort to maintain. Yes, someone should keep the system on track, but that person should have other responsibilities as well. Pair the ISO 9001 coordinator job with other responsibilities that focus on understanding what the organization does, especially responsibilities related to the product, customers and improvement. If the QMS is so bureaucratic that it requires the time of an entire person (or, heaven forbid, an entire staff), then the system needs to be streamlined. An effective QMS should make an organization more competitive, not weigh it down.

ISO 9001:2008 – How it will Impact your Auditing

By Craig Cochran
(Originally published in The Auditor, Jan-Feb 2008)

Auditing is all about comparing evidence to requirements. That’s why changing requirements always grab the attention of auditors. As most of you know, ISO 9001 is undergoing a revision that is scheduled to be published in 2008. The new standard, ISO 9001:2008, includes mainly editorial amendments: re-arranged words but few significant changes. There are a few things that auditors should take note of, though. Let’s take a look at the Draft International Standard of ISO 9001:2008 and discuss how it might impact your auditing.

Statutory requirements

The word statutory will be inserted in a couple of places within the introductory part of the standard. This is primarily to make the language consistent with section 7.2.1—determination of requirements related to the product—which has always required that the organization determine statutory and regulatory requirements for its products. Even though the concept is not new, the requirement reminds all auditors that they need to understand the legal requirements of the products they’re auditing. Statutory and regulatory requirements are often taken for granted by auditors, with the assumption that the organization knows what applies to its products. This is not always the case. During the planning phase, auditors must research the statutory and regulatory requirements on the product produced by the organization, and make sure they able to effectively evaluate this.

Technically, there is a difference between statutory and regulatory requirements. It’s a very fine difference, though. We’ll cover it briefly for the sake of completeness. Statutes are laws. They say what you can and can’t do in broad terms. Regulations are usually specific guidelines published and enforced by regulatory bodies. The bottom line is that statutes and regulations are both enforced by authorities that can make your life difficult. Understand what statutes and regulations apply to your products, and make sure you’re able to meet them. Satisfaction of this clause is typically achieved in a two part manner:

• Developing a process for understanding and staying up-to-date with statutes and regulations
• Compiling an index or listing of statutes and regulations applicable to your products
  

These processes are not specifically required by ISO 9001, but they would represent an effective way of meeting the requirement.

It’s worth noting that statutes and regulations can come from the country in which you are based, and they can originate from countries in which you’re selling your products. Multinational organizations have to consider statutory and regulatory requirements everywhere they operate in the world. Understanding and staying current with statutes and regulations can become somebody’s full time job for companies that operate around the globe.

This clause is also very significant for companies that produce highly-regulated products. Examples of highly regulated products include:
* Drugs and pharmaceuticals
* Medical devices
* Food
* Aircrafts and aircraft parts
* Explosives and firearms

Management representative

ISO 9001:2008 will clarify who can act as the management representative. That role must be held by a member of the organization’s management. This makes 2 things clear:
The management representative is an employee of the organization (not a consultant)
The management representative is someone with the responsibility and authority to make decisions, assign resources, and get things done.

In the past, the decision of who was assigned as management representative was usually unchallenged by auditors. This will need to receive some new scrutiny by auditors to ensure that the assignment meets the full intent of ISO 9001:2008. Besides being a member of the organization’s management, there are 3 responsibilities that must be carried out by the management representative and which auditors must verify:

1. The management representative will ensure that the processes of the quality management system are established, implemented, and maintained. This is the project management aspect of being a management representative. Establishing, implementing, and maintaining a QMS requires that the management representative must coordinate many different efforts and continually sell the benefits of the system. It bears repeating that the management representative does not own the system, though. Everybody owns the management system, led by top management.

2. The management representative will report to top management on the effectiveness of the management system. This happens during management review, possibly the most important process of the entire standard. The management rep does not need to personally collect and present the data on effectiveness, but they make sure it happens. The most effective management reviews involve a wide range of organizational managers and influencers, with the management representative coordinating their input.

3. This basically means that the management representative must help promote a customer focus throughout the organization. There is nothing more important to the organization’s success than the customer, and the management representative must continually remind everyone of this fact. Promotion of awareness can be accomplished in many ways, and here are a few simple ways that come to mind:
* Posting data on customer feedback trends
* Publishing product specifications
* Holding meetings that address customer issues
* Serving as a liaison between the organization and the customer
* Distributing memos and emails that clarify customer requirements

Competence

The competence and training requirements of ISO 9001 have long been some of the most confusing. The reason is that the standard specifies some broad requirements and gives the organization total discretion for how they will be applied. This discretion has been tightened a bit through the requirement that the organization “ensure the necessary competence has been achieved.” This replaces the previous requirements for evaluating the effectiveness of training.

Ensuring that competence has been achieved can take place in a number of manners, but the most obvious is a demonstration of the newly developed skills or abilities. This works especially well for competency building aimed at skills and training. “Okay, we’ve talked about the task, and we’ve demonstrated how it should be performed. Now you give it a try.” If the trainee is able to effectively perform the task over the period of observation, then they could be reasonably considered competent. Keep in mind that the period of observation could be an hour, day, week, or month. It all depends on the complexity of the skill being demonstrated. Most “on-the-job training” programs focus on this kind of evaluation. The trainee starts out as an apprentice and then gradually begins performing many of the tasks themselves. The training culminates in the trainee being able to demonstrate the full range of skills involved with the job.

The inspection of an employee's work or product can verify that competence has been achieved. For employees who produce a tangible good or deliver a service, this is often a reasonable indicator of whether training has had the desired effect. Many organizations already have existing systems for inspecting their products, and these systems can be channeled into the training program. But this will only work if the product's inspection is traceable back to individual employees.

Tests and examinations can be used to ensure that competence has been achieved, especially when the competence is related to knowledge and facts. Be aware that many individuals simply don't perform well on formal tests or examinations, regardless of the quality of the instruction and training materials, so this may not be an ideal gauge of effectiveness. Another drawback is that tests are heavy on administration, requiring someone to spend a great deal of time creating the tests, making sure that all learning objectives are addressed, creating answer keys, creating a grading scale, taking time to grade the tests, dealing with test anxiety and disappointment, and so on. Tests and examinations do have the advantage of resulting in a numerical score, which is easy to quantify and track over time.

Finally, some organizations use performance reviews to draw judgments on whether employees have achieved competency. Most organizations already use performance reviews of some sort. As long as a logical connection can be made between the training and the job performance, the system will work. One caution, however: Make sure to separate the record of performance review from the record of training effectiveness evaluation, as every organization seeking to keep or gain ISO 9001 registration will be required to provide evidence of the evaluation to its third-party auditor. Showing performance review records to outside parties will create ethical (as well as legal) problems, so you're far better off maintaining separate files.

Auditors will need to probe the issue of competence deeper than they have in the past. What was once accepted as meeting requirements may not meet the requirements of ISO 9001:2008.

Work environment

ISO 9001:2000 will add a note in order to clarify the scope of work environment. Notes are not auditable, of course, but they provide insights on how to interpret the requirements that are auditable. The note states that work environment includes physical, environmental, and other factors needed to produce the products in question. Consider the following examples:

Candy manufacturer: Raw materials are received into the facility and are immediately moved into a climate controlled storage area. The cleanliness of the storage area is immaculate, far different than most other warehouses. A weekly inspection is conducted to look for any evidence of pests. The raw materials are transported into manufacturing by personnel wearing white gloves and smocks, and all manufacturing is tightly controlled under Good Manufacturing Practices. All outside doors and windows are kept closed and the housekeeping is very strict; even the garbage cans are clean and spotless. Nobody with any kind of illness is permitted inside the facility, and no jewelry is permitted to be worn. Once manufacturing is complete, the finished product is stored in an area that is maintained at 40 degrees F, plus or minus 4 degrees, and the gauge used to monitor the temperature is calibrated. A weekly audit is conduced to evaluate the condition of finished product in inventory.

Insurance company: People are stationed at desks and perform work on computers and telephones. The office temperature is maintained at “typical office conditions,” which is usually a compromise between the women who like the office warmer and the men who like it cooler. Dress codes are enforced so personnel are not distracted in their work and to maintain a professional environment in the event customers visit. Personnel are not allowed to play music from their radios or computers, as the sound disturbs people in their work, even when played at low volume. Hot food items are restricted to the break rooms, as some employees were offended by the smells of certain foods that were consumed at desks. Personnel photographs are decorations are permitted in cubicles, but nothing that could constitute a threatening work environment are allowed. Everything about the office is maintained is a pleasant yet bland manner because this is the environment that was found to result in the highest productivity, lowest service defects, and fewest personnel problems.

Paper mill: The inside of the plant is very damp, and a half inch of water is on most of the floors. Additionally, the nature of the production process is very hot in some areas, and the ambient temperature in the summer can reach over 110 degrees. During winter months, temperatures in the warehouses are just a few degrees above freezing. For many years, the harsh environmental conditions were simply accepted as a given. The conditions didn’t negatively affect the product, so management felt no need to change anything. Recently it became clear that employees were becoming ill at a higher than normal rate, however. The increased illnesses affected the mill’s attendance rate, which in turn impacted its ability to produce paper on schedule. Work conditions are being improved now that the link between the environment and product conformity was recognized.

In all these cases, the work environment is focused on what is needed for the product in question. Sometimes organizations discover connections between the work environment and product conformity that they didn’t know existed, as in the paper mill example. ISO 9001 simply says that you will determine the environmental conditions that you require. Whatever you require is what you will be expected to provide and maintain.

Here are some typical controls related to specific work environment variables:

* Temperature and humidity: Gauges for monitoring, records of conditions, records of gauge calibration, investigation of affected product when conditions fail to meet environmental requirements

* Safety hazards: Identification of hazards, prioritization of risks, procedures for job safety, monitoring of compliance, records of monitoring, corrective action on accidents and near misses, regular meetings to discuss safety issues

* Lighting, noise, vibration: Specifications for characteristic, procedures for maintaining specifications, ongoing measurement of characteristic, records of measurement, calibration of gauges, records of calibration

* Housekeeping: Procedures for housekeeping, defined responsibilities, training of personnel, periodic audits of housekeeping, corrective action on nonconformities, signage to remind personnel of guidelines

* Personal hygiene & behavior: Documented policies for personnel, recurring training, monitoring by supervision, counseling for employees

ISO 9001 does not require documented procedures or records related to work environment, though it often makes sense to have such things. In cases where the organization establishes requirements for work environment, then the only way to verify that the environmental conditions were met would be through records. Documentation would also be required to consistently communicate the work environment requirements and controls.