iso 9001 2015 interna audit presentation.pptx

iso 9001 2015 interna audit presentation

1. ISO Internal A ud i tor C omp l i ance Manag e me nt

2. D e scribe the resp o nsi b i l ities of a n Internal Au d itor D e scribe the ro l e of i nternal au d its w i thin a man a gement system i ncl u d i ng the audit man a gement process E x p l a i n, the mod e l of a proces s -bas e d Qual i ty Management System, i n cl u d i ng the p urpose and st r ucture of ISO 90 1:2015 P l an and prepare an i n ternal au d it Gather o bjective evi d ence throu g h observation, i n tervi e w and sampl i ng of d ocuments and records Write factual audit fi n d i ngs and reports that he l p to improve the e f f ectiven e ss of the ma n ag e ment system D e fine and describe w a ys in which the e f f ectiven e s corrective action mig h t b e verifi e d C o urse A i ms and Obje c tives

3. Session 1 Objectives Unde r sta nd the p urpose a n d t y pi c al structure of ma n a g em ent s y s t ems a n d I SO 90 01: 2 1 5 Und ers ta n d the ISO 9 1:2 15 r e q u ire me nts re l at i ng to I nterna l A ud i ts Und ers ta n d the Plan Do C h e c k Act ( PD C A) Cy c le Unde r sta nd what i s a proces s, key terminolo g y, an d t he d i ff e r ent ty p es of p r o c e s ses a n d t h e ir s i g n if i ca n c e for i nte r n a l a u d it ors

4. Purpose of a Quali t y Manag e ment Sy s tem ISO 90 1: 2 1 5 i s u s ed if yo u a re s e ek i ng to e s ta blis h a m a n a g e me n t s y s t em tha t provides confidence in the conformance of y o u r pro d uct to m eet customer and applicable s t a t utory & re g u la t ory re q u ir e ments In a d d i ti on, ISO 90 1: 2 1 5 seek s to e n h a n c e cus t om e r s at i s f a cti o n by imp r ov i ng your Qu a li t y Ma n a g em ent Sys t em

5. 4 A ud it A ct i v it i es 3 2 1 I n trod u ction to A u d it i ng T h e Pro c e s s A p p roa c h and Pro c e s s A u d it i ng Managi n g a n A u d it Progr a m Table of Content 5 A u d it o r Compet e nce and R e s p o nsi b i l it i es 6 Concl u sion

6. Introduction to Auditing

7. Auditing Wh a t i s an audit? S y stemati c , indepe n dent and doc u men t ed p ro c ess f o r obtain i ng a u dit e v ide n ce and e v alu a t ing i t o bject i v ely to determine the ex t ent t o which a u dit c r iteria are ful f illed (IS O 19011: 2002 clau s e 3 . 1) Why audit? Requi r ement of IS O 9001 : 2015 Monitor and me a s u re the manag e ment system Prom o te con t inuous i m prov e me n t o f t h e management system

8. Principles of Auditing Principles relating t o auditor s : E t hical c o ndu c t Fair pre s enta t ion Due profes s ional c a re Principles relating t o audi t : Indepen d en c e Ev idenc e -based approach 4.0 N ote: re f e r e n ce to I S O 1 9 1 1:2002 Cl a u se numb e r

9. B e nefits of Auditing Verifies c o nformity t o requi r ements Inc r ea s es awarene s s and und e r s ta n ding P rovides a measureme n t of ef f ecti v eness of the management system to top manag e ment Redu c es ri s k of ma n a g em e nt system failure Identi f ies improvement opp o rtunities Continuous improvement i f pe r formed regula r ly

10. Types of A udit Registration / Certi f ication Produ c t Cu s to m er contra c t Gap a s s e s s m e nt / Pre-a s s e ss m ent Surveillance Combined audit / joint audit

11. Process Approach Auditing

12. Proc e ss Approa c h The pro c e s s app r oa c h empha s ize the importan c e o f : Unde r stan d ing and mee t ing requi r eme n ts Loo k ing at pro c e s ses i n terms of added value Obtaining res u lts of pro c e s s pe r formance Continual improvement of pro c e s s

13. Y our Pro c ess A c t Do Plan Check PDCA (Pla n -D o -Check-Act) C ontinua l I m p r o v e m ent T he Pl a n - d o- C h e c k - A ct (P DC A) m e t ho d ology applie s t o al l proces s es • De p loy and con f orm w ith plan • • • • • Acti v ities Co n trols Doc um e n t a tion Res o urces O b jecti v es • • • Anal yz e/re v iew Decide/c h ang e I m pro v e e f f e cti v e n e ss M ea s u r e a nd m o n i t or for c o nf o r m ity a n d e ff ecti v e ne ss

14. M a nag e m ent S y s t em Sta nda r ds and the Proc e s s Appro a ch • IS O 9001 : 2015: I s b a s e d up on the PD C A cycle which c a n b e a p plied to pro c esses Applies the PDCA cycle t o implementing, o p er a ting, monit o rin g , exe r ci s ing, maintaining and im p rov i ng t h e ef f e c ti v ene s s of a QMS IS O 1 9 011 : 2 002 d oes not e x plicit l y men t ion p r o c e ss audits, but i s w r it t en for appli c ation t o all manag e ment system audits

15. A p plying the Pr o cess A p pr o ach t o A u dit i ng Audito r s can apply the p roc e ss ap p roa c h t o a uditing by ensuri n g the auditee: Can def i ne the objecti v es, inputs, outpu t s, acti v i t ies, and res o urces for its pro c e s ses Anal y z e s, monitor s , mea s ures, and improves its pro c e s ses Unde r stands the s e que n ce and intera c tion of its pro c e s ses

16. Proc e ss Auditing App r oach e s Individu a l Pro c e ss : Input / Output / Value-add e d Acti v ity P la n -Do-Che c k- Act Res o urc e s R el a tion s hip with other pro c e s se s : Flow / Sequen c e / Lin k age / Combination In t era c t i on / Communication E v iden c e Customer and s u pplier c o ntra c t ( s)

17. Proc e ss Auditing “Turtle Diag r a m ” With w hat? Res o urc e s With w ho? Per s onn e l What re s ults? P erforman c e indi c ators Outpu t s To Wh o m/ Wh e re Inputs From W h om/ Wh e re H o w done? Methods/ Doc u menta t ion Proce s s (specific v alu e - added acti v ities)

18. Proc e ss Auditing Exa m ple With w hat? Ord e r p roce s si n g s y stem With w ho? Customers Compete n t sales and proce s sing s taff What results? O rder proce s sing time Number or o r de r s Va l ue of orde r s Contract accuracy Outpu t s Produ c tion/Serv i ce Del i ve r y Inp u ts Customer requirements Sa l es staff H o w done? IT s y stem Processing s y stem Te r ms and c ond i tions Contract rev i ew procedure Co n tr a c t Rev i ew

19. Managing an Audit Program

20. M a naging an Audit Progr a m Pro c e s s Flow PLAN DO C H ECK ACT A UTH O R I Z E ES T A BL ISH I M P L E M E N T M O N I T O R & R EVIEW I M P R OVE OBJE CT IVES E X T E N T R OLES R ES OURC ES P R O C E DUR ES S CH E DU LE A UD I T S E V AL U A T E A UD I T O R S SELE C T T EA M S D I R E C T A CT IVI T IES M AI N T AIN R E C O RD S M O N I T OR R EVIEW I D E NT I F Y N EED F OR C A/ P A I D E NT I F Y OPPO R TUN I T IES T O I M P R OVE A UD I T OR C O M PE T E NC E & E V A LU Z A T ION SPE C I F IC A UD IT A CT IVI T IES

21. Audit Activities

22. Typical A udit A c tivities Pla n n i ng Preparati o n Preparin g , Appro v i n g, Dist r i b ut i ng Aud i t R e p o rt R e p o rting F o l lo w - up Con d ucti n g for O n -site A c ti v it i es P L AN DO C H ECK ACT 6.1

23. Audit Prog r am Top m an a g e ment should aut h o ri z e re s p o n s ibili t y for p ro g ram manag e ment t o: E stablish, imple m ent, review, and impro v e the audit prog r am Identi f y the nece s sary r e s o urc e s a n d ens u re t h ey ar e provided Or g ani z ation s h ould develop audit prog r am pro c e s ses P rog r am should be managed by a me m ber of the organi z at i on Keep a p p ro pr iate a u dit re c or d s t o m o nitor and rev i ew the a u dit prog r am

24. Audit Prog r am Re s ponsibi l ities Top m an a g e ment should aut h o ri z e re s p o n s ibili t y for p ro g ram manag e ment Those as s igned re s ponsibili t y should: Establish, implement, rev i ew, and improve the audit prog r am Identi f y the nece s sary r e s o urc e s a n d ens u re t h ey ar e provided

25. In i tiating the Audit Ini t iating the audit in c lu d e s : Appointing the audit team leader Defining audit objecti v es, s c ope, c r i t eria Determining feasibility of the audit Selecting the audit team Establishing initial c o ntact with the auditee 6.2

26. Defining Audit Objective s , Scope, Cri t eria Audit Obje c ti v es may includ e : Det e rmining of the ex t ent of con fo rmity of audit e e`s QMS with audit c r i t eria E v aluation of c a p a b ili t y o f QMS t o e n s u re complian c e with statutory, regulatory, and c o ntra c tual requi r emen t s E v aluation of ef f e c ti v ene s s of the QMS t o meet its obje c ti v es Identi f ication of areas of improvement 6.2.2

27. Sele c ting the Audit Te a m For Team si z e and c o mpetence, c o n s ide r : Audit obje c ti v e s , s c ope, c r iteria, and du r ation Whether audit i s combined or joint Competence of team t o meet obje c ti v es S t atu to ry, r e g ulatory, c o n t r a c t u al and a ccredi t ation / certi f ica t ion requi r ements Indepen d en c e of the team 6.2.4

28. Auditor Competence and Responsibilities

29. Auditor Co m pet e nce Audi t or c o mpetence i s ba s ed on: Per s onal at t rib u tes A pplication of kno w ledge and s k ills Competence i s t o be developed, maintained, and improved Competence is the demonstrated ability to perform a task 7.1

30. Pe r sonal Attributes Ethi c al Dipl om a tic Ope n - minded Auditor Co m pet e nce Personal A t t r ib u t es Obse r v ant Percepti v e 7.2 V ersatile T ena c io u s Decisi v e Self-reliant

31. Auditor Co m pet e nce Ge n eric Kno w led g e and skills Auditor s k ills and c o mpetence c o uld in c lu d e : Audit principle s , pro c edure s , and tec h ni q u e s Management system and reference documen t s Or g ani z ational situ a tions La w s, regulation s , and other requi r eme n ts 7.3.1

32. Auditor Co m pet e nce Speci f ic Kno w led g e and skills Specific k n owledge and s k ills for quality auditors c o uld in c lu d e: Quality methods and techniques Quali t y term i nology Quality manag e ment tools and their appli c ation Proce s ses a nd p rod u cts / serv i ces s p e cific t o the sect o r being audited 7.3.3

33. Auditor R e sponsibil i ties Arrive on ti m e Maintain c o nfidentiali t y B e objecti v e and eth i cal Suppo r t the audit team and team le a d e r Plan and prepa r e work do c uments In f orm auditees of the audit pro c e s s Do c ument and s u pp o rt all f i ndings Keep auditee informed Sa f egu a rd all do c uments Prepa r e the audit repo r t

34. Audit Activities (C o ntin u ed)

35. Audit Planning Determine the obje c ti v e of the audit Identi f y s p e c if i ed requi r ements Determine audit duration and re s ources needed Select the team Contact the auditee – ag r ee the date( s ) D r aw up audit plan B rief the team Prepa r e work do c uments

36. Conduc t ing Do c ument Re v iew A rev i ew of do c umentation: Should be cond u ct e d p rior t o o n- site audit a ctiv i ti e s u nless def e r ring r e v iew i s not d e t rime n tal t o t h e ef fe cti v en e ss o f the audit May include relevant QM S do c u m en t s, rec o rds, a n d pre v ious audit repo r ts May include a preliminary site v i sit 6.3

37. Pr e pare Work D ocum e nts Prepa r e work do c uments Us e as a referen c e and for rec o rding audit pro c eedings Inclu d e c he c klists, s a mpling pla n s a n d fo r m s , IS O 9001 : 20 1 5 standard, etc. Keep che c kli s ts fle x ible t o allow chang e s res u lt i ng information c o llected du r ing the audit Sa f egu a rd any c o nfidential and prop r ieta r y information Retain work do c uments and rec o rds fr o m

38. Ch e cklists Pr e par a tion One Appro a ch i s t o: Identi f y audit s c ope and pro c e s s( e s) within s c ope Iden t i f y a p p licable f a c t o r s (in p ut s , ou t pu t s, res o urce s , etc . ) Us e these points and other requi r ements (ISO 9001-2015, system do c umentation, etc . ) t o: me a s u r e s, Plan what t o look at Plan what t o look for (audit evidence) Prepa r e c h e c kli s t

39. Ch e cklists St r uctu r e Audit c h e c kli s t str u ctu r e : Pro cess / A c t i v i t y A u d ited: R e q u ir e me n t S o urce Evi d e n ce N o tes ISO 9 1 :2 15 C l a u se # o r oth e r re q u i rem e nt What to “l o ok at” What to “l o ok for” N o tes

40. Conduct o n -Site Audit A ctivities Condu c t ope n ing meeting Communic a te du r ing the audit Ex plain roles and re s ponsibili t ies of participants Collect and verify information Generate audit findin g s Prepa r e audit c o n c lusions Condu c t clo s ing mee t ing 6.5

41. Opening Me e ting Hold ope n ing meeting with auditee top manag e ment and those res p on s ible for pro c e s ses audited Mee t ing may be in f ormal Chair e d by team leader Audit team pre s ent Purpo s e i s t o c o nfirm all prior arrangem e nts 6.5.1

42. Re v i e w Sources of information C o llect by appro p ri a te sampling & v erifi c ation E v aluate against audit criteria Collecting and Verif y ing Inf o rmation A udi t Conclusions

43. Auditing Pro c e s s Collect & Ve r ify info r m ation Collect information relevant t o: Audit obje c ti v e s , s c ope, and c r iteria in t erfaces between funct i ons, a c t iv i t ies and pro c es s es Collect a udit evidence by ap p ro p riate sampling a nd verify a n d rec o rd it B e aware o n sampling limi t ations, i f a c ting o n the c o n c lusion Us e only information that i s verif i able as audit evidence a u dit 6.5.4

44. Auditing Pro c e s s Te c hniques to Obt a in Audit Evid e nce In t erv i e w : Per s onn e l that manag e , pe r for m , and verify a c ti v it i es  A lso en s u r e they a r e r es p o n sible audited Listen c a refully t o res p onses for t he a cti v i t y being Ob s erve: Identi t y, s t at u s, condi t ion, pr o ce s ses, e quipmen t , ac t i v ities, environme n t, and peo p le Listen: Information from relevant authority and that it is verifiable 6.5.4

45. Auditing Pro c e s s Audit Evid e nce Rev i ew do c uments that de s c r ib e : Acti v it i es P lans Controls S t rategies E x erci s es tes t s Rev i ew rec o rds for evidence of c o nformity t o do c uments Rev i ew rec or d s , st a te m en t s of f ac t , o r oth e r inf o r ma tion which are relevant t o the audit c r iteria and verif i able Audit evidence may be qualitati v e or qua n ti t ati v e

46. Communication and interpersonal ski l ls Put auditee at ea s e Ask s h ort que s tions and listen Reflect rig h t at t i t ude, to n e of v oice, b o dy langua g e, and f acial expre s sions Sm i le and s h ow eye c o ntact A v oid interruptions A v oid of f -c u ff and c o nde s cending r e ma r ks Give praise when app r op r iate

47. Communication and interpersonal ski l ls Show intere s t B e tact f ul and polite S how pat i ence and under s t a nding Remember t o s a y plea s e and thank you Ask the rig h t pe r s o n Don`t s a y you und e r s tand when you do not

48. Questioning Techniques Open que s tion U s ing why, who, w hat, wher e , whe n , o r how ge t s m o re t h a n a y es or no an s w e r E x pan s i v e que s tion Further elaborates the c u r r ent p o int Opinion que s tion As k s opinion about c u r r ent point Non-verbal U s e s body l a n g u a g e, f o r example: rai s e ey e - b row t o elicit further information

49. Questioning Techniques Repeti t i v e que s tion Repeats ba c k res p onse i n form of a que s tion Hypo t het i cal quest i on U s es what if, s u ppo s e tha t , etc. Clo s ed que s tion Gets yes or no an s wer Av oid using too of t en U s ed for c o nfirmation Si l en c e D r aws more information

50. Note Taking Notes c o uld be u s ed as referen c e for: I m mediate investigation In v estiga t ion la t er Us e by a c o lleague Subseque n t audits Notes taken du r ing an audit are a r e c o rd o f : The audit sample taken Wh a t was repo r ted Wh a t was ob s erved Notes may be referenced by s u b s equ e nt auditor

51. Sa m pl i ng Samples sh o uld test the e f fecti v en e ss of the sys t em a nd s h o uld be: Rep r esent a t iv e S t ructu r ed Indepen d ently s e lected Sample si z e s h ould be ba s ed on: Ri s k I m po r tance S t atus Findings from the previous/c u rre n t audit

52. Cont r ol of the Audit Che c kli s t i s an ai d , not a requi r ement I f potential audit trails app e ar, de c ide t o: Disrega r d Note for later Follow up immediately Following audit trails may ef f e c t : S ample si z e Audit plan

53. EXAMP L ES Cannot find d o cument U n cooper a ti v e N o i s y en v ironm e nt Long tel e pho n e calls U n prepared C o nstant interrup t ions Pro v ocation Long- w inded auditees Interdepartmental or personality con f licts Di v ersionary tactics Language B o ast f ul Call e d a w ay V olun t eered information Handling Difficult Situations

54. Es t ab l i s h the Fa c ts Judgm ent in t he Audit Pro c e s s Audit foc u s must be on con fo rmity a n d ef fe ctiven e ss, N OT on finding non c onformities The a u di t ee mu s t be gi v en the be n ef i t of any d oubt w h e re t h e re i s insuf f icie n t audit evidence

55. Est a bl i sh t he Fac t s Di s c u ss c o n c erns Verify the findings Re c ord all the e v idenc e : E x a c t ob s erva t ion Wh e re, what, etc. Establish why a non c onfor m ity or oth e r w ise S ta t e who (if relevan t ) – preferably by job t i t l e Obtain ag r eement with the facts

56. Gene r ate Audit Find i ngs 6.5.5 E v aluate aud i t evide n ce ag ain s t audit cri t eria t o g en er ate a udit findings Ind i ca t e i f f i ndings a re con f o r mi t ies, n o n c onf o rmi t ies or opp o rtunities for improvement Meet (audit team) t o rev i ew findings Specify ( w ith s u p p o rting e v iden c e ) or s u mm a ri z e con f or m ity by location, function, or pro c e s ses, as requi r ed by audit plan

57. Noncon f or m ity 6.5.5 Non-ful f illment of a s p e c if i ed requi r eme n t: Not doing it P artially doing it Doing i t the w r ong way Specified requi r emen t : Conditions of the c u stomer c o ntra c t Quali t y standard (I S O 9001 : 2015) Quality manag e ment system S t atu t ory or r e g u lato r y requi r eme n ts

58. Gene r ate Audit Find i ngs Rec o rd non c onformity findings and s u ppo r ting evidence • Ob t ain audi t ee a ckno w l edge m ent of ac c uracy and under s tanda b ili t y Try and res o l v e dif f e r e n c e s of opinion Keep a rec o rd of un r e s olved is s ues N o n c o n f o r mi t ies f o r 6.5.5

59. Noncon f or m ity - Min o r Failure t o comply with a r equi r e m e nt w hich ( b a s e d o n judgm e nt and experienc e ) i s not likely t o res u lt i n QMS failure S ingle observed lapse or isolated incide n t Minimal ri s k of non c onforming produ c t or s e rvice E x ample s :  A two month lap s e i n the internal audit prog r am  A training rec o rd not available  N o a ctio n s t a k e n t o im p r ove s y st e m based on res u lt findings pre v io u s

60. Noncon f or m ity - Major Absence or to t al brea k do w n of a system t o meet a requi r ement A number of minors related t o the s a me clau s e or requi r eme n t A no n con f o r mi t y that e x perie n ce a nd judg m ent indicate will likely res u lt i n Q MS failu r e or signific a ntly red u ce i t s ability to a s s u re c o ntrolled pro c e s ses and produ c ts

61. Noncon f or m ity - Major E x am p les: N o docum e n ted p roced ur e for a re qu ired d o cum e nted ISO 9001 : 2015 pro c es s / a c t i v i t y Doc u ment c h ang e s routinely made without authorization N o awarene s s prog r am for the quality manag e ment system N o fu t ure planned internal audits Insuff i cient s c ope Num e rous minor no n con fo rmities f o und i n the pr o d u ction pro c e s s

62. Nonconfo r mi t y Cla s sif y ing the Nonconfo r mi t y C o n si d er the s e rio u s n es s : Wh a t could go wrong i f the nonconf o r mi t y re m ai n s uncor r e c t e d? I s i t likely the sys t em wo uld det e ct i t bef o re t he cust o m e r is af f e c ted? I f you are not c e rtain i t i s a non c onfo r mi t y, i t i s no t . You must hav e : A requi r ement that has been bro k en Proof that i t has been bro k en

63. Nonconfo r mi t y Good Repo rt Ex a mpl e s Q M S Non c on f o rmity R e po rt I n ci d e n t Nu m b er : 1 C o m pany under audit: X Y Z , Inc. Are a under R e v ie w : Purchasing C ategor y : M ajor M inor R equire m ent: ISO 9001 C lause nu m ber 7.4 C lause 7.4.1 of ISO 9001:20 1 5 requires that the organiza t ion establi s h cri t eria for e v aluation and r e -e v aluation of suppliers. N onconfo r m ity F indings: U pon speaking w ith the purcha s ing M anage r , it w as found that no e v aluation of ABC supplier had taken place since the contra c t w as signed and business begin w ith ABC supplier

64. Nonconfo r mi t y Poor Repo rt Ex a mpl e s The no n con f or m ity stat e men t s below are in a de qu ate d u e t o t he la c k of s p e c if i ed requi r ements and detailed evidence: S teering Group meeting minu t es are not adequate The aut h ori t y level for t he Eme r ge n cy Con t roller must be do c umented for clarify pu r po s es

65. Pr e paring Audit C onclusions Audit team c o nfer p r ior t o the closing me e tin g : Scheduling of the audit plan T o plan for clo s ing mee t ing Purpo s e i s t o: Rev i ew audit findings and other information Agree on audit c o n c lusions T o prepa r e the au d it repo r t and re c om m e n dat i ons I f included i n audit plan, t o disc u ss audit follow-up 6.5.6

66. Audit Repo rt Pre pa r e, Appro v e & Dis tr ibute Audit reference Client and Audi t ee details A udit team detai l s List of auditee r e p r e s e n t ati v es Obje c ti v e s , s c ope, and c r iteria Audit plan – dates, pla c e s , areas a u dited and ti m ing S um m ary of audit pro c ess Audit Summary Unc e rtainty due t o s a mpling 6.6.1 6.6.2

67. Audit Repo rt Pre pa r e, Appro v e & Dis tr ibute Non c onfor m ity r e p o rts Rec o mmenda t ion Obstacles encountered Any areas i n audit s c ope not c o vered Any un r e s olved is s ues betwe e n the auditee and team Confirmation that audit obje c ti v es a c c o mplished Confiden t iali t y statement Di s tribution list 6.6.1 6.6.2

68. Audit Repo rt Dis tr ibution Issue within ag r eed ti m e pe r iod I f delayed, provide rea s ons and ag r ee on new is s ue date Rep o rt m ust be dat e d, reviewed, and approved as p e r pro c edures Di s tribute t o recipients de s ignated by audit clie n t Repo r t i s prope r ty of audit clie n t Recipien t s a nd audit te a m m u st r es p e c t t h e con f identiali t y of the repo r t

69. Co m pleting the Audit 6.7 Audit i s co m plete when a ll a c ti v it i es i n audit plan h ave b e en c a r r ied out and audit repo r t i s distributed Main t ain o r d ispose o f a ud it do c um e nts ba s ed o n con tr a c t ual, regulatory, and audit prog r am pro c edures Maintain co n fident i ality of audit docu m e n t s , inf o rm a tion, a n d repo r t Noti f y audit clie n t and a uditee ASA P i f disclosure of aud i t in f ormation i s requi r e d .

70. Closing M e eting 6.5.7 Hold closing meeting t o pre s ent audit findings and c o n c lusions Cover sit u ations e n count e red d u ring a u dit that may decr e ase relian c e on audit con c lusions Di s c u ss and res o l v e diverging audit findings and c o n c lusions Keep a rec o rd i f not res o l v ed Provide rec o mm e ndatio n s for im p rov e m ent wh e re spe c if i ed by audit obje c ti v es Keep minutes and at t end a n c e rec o rds Will no r mally be informal for internal audits

71. Comple t ing the Audit Conducting the Follo w - up 6.8 Audit c o n clusions m ay re q uire co r r e c ti v e, pr event i ve, or improvement a c tions A udi t ee d e cides and c a r r i es out t h e se actio n s within a g r e ed ti m eframe The s e a c tions are not pa r t of the a u dit Audit team n umb e r should verify comp l etion a n d e f f e ctiven e ss of a c tions taken This v erificat i on may be part of a s u b s eq u ent audit Maintain independ e n c e i n s u b s equ e n t audit a c ti v it i es

72. Why? Reason Why 1 Why was our customer unhappy? The service has been delivered to late. The customer was unsatisfied. Why2 Why was the service not prepared on time? We did not prepare the service on time because it took much longer than we expected. Why3 Why did it take so much longer? Because we did not receive all approvals on time and underestimated the duration of the project. Why4 Why did we underestimate the project duration? Because we forgot to prepare a detailed list of all tasks. Why5 Why did we forget about it? Because we were running behind on other projects and failed to review our task list and time estimation during the project. Root Cause* Because we didn’t have a checklist to clearly identify all tasks that we must achieve to estimate time accurately. We need to develop a systematic approach to include these factors in future projects. Five Why Analysis The 5 Whys is a questions-asking method used to explore the root cause of a particular problem and to understand cause-effect relationships * Note the root cause(s ) of the problem here. Only the one who experienced the problem is qualified to perform the analysis. There are usually more than one root cause

73. Comple t ing the Audit Cor r e ctiv e the Follo w - up Audi t ee rec e i v es the non c onfor m ity repo r t Audi t ee prepa r es and app r oves a c o r r e c ti v e a c tion pl a n A udi t ee submits the plan t o auditors Audi t ors evaluate and app r ove the plan Audi t ee implements the app r oved c o r r e c t i v e a c tion pl a n Audi t or verif i es the implementat i on and ef f e c ti v ene s s Re c ords of all a c t i ons taken by auditor and auditee 6.8

74. C i t e t he So u r c e! ! I S O 9001 : 2 1 5 ( “ Th e S T A N D A R D ” ) C l ause 4 . / C o nt e x t of th e O r g an i zat i o n C l ause 4 . 4 / QM S an d i t s p r o c ess e s C l a u se 4 .4 .1 P R O C E S S I N TE R A C T I O N D I A G R AM

75. The S T A N D A R D ( 4.4.1) s t a t es: “ The or g aniza t io n SH A LL : E s t ablish I m p le m e nt M a in t a i n C o n t inua ll y i m p r o v e t he QM S . ” in c lu d in g…. AUDITING THE CONTEXT OF THE ORGANIZATION

76. “ P R O C E SS E S n ee d ed A ND t h eir I N TER A CTI O N S …”

77. C la u se 4 . 4 . 1 ( Qu ali t y M a n a ge m e nt S y s t em a n d i t s P r o c e ss e s) 1 . W h a t a r e we l oo k i n g f o r w h e n we a ud i t a c li e n t ’ s p r o ce ss e s & i n t e r a c ti ons? R e qu ire d p r o c ess i nputs (4 . 4 . 1 . a ) E x p e ct ed p r o c ess o utput s (4 . 4 . 1 . a ) C ri t eria & M e th o d s (4 . 4 . 1 . c) M o n i t ori ng / M e asu reme n t / P er f o r m an c e I nd i c a t ors R eso ur c es n ee d e d t o s upp o r t th e p r o c ess (4 . 4 . 1 . d ) P r o c ess au t h ori t y & resp o n si b ili t y a ssi gn ed ( 4 . 4 . 1 . e) Ris ks an d o pp o r tun i t ies i d e nt ifie d (4 . 4 . 1 .f )

78. The PROCESS INTERACTION Audit Too/ Process Interaction Diag r am ( I SO 9001:2015; C l ause 4.4.1) I' I' ( 4.4.l.d ) Resource s , i. e . , 1 What?" P eopl e , Material s , Equipment , Work Environment, etc. {Auditor S p ecial l nterest Item} Ex p ertls e , I.e. "Whom?" Educatio n , Knowledg e , Tr a i ning, Skill s , Experience, et c . '- ./ '- ./ ::--- (4.4. 1 . a ) Inputs, I.e. What ln utl lized in ( 4.4.l.e ) P rocess Activities ( 4.4.l.e ) R espo n si b l e Person (s) (4. 4 . 1 . a ) Outputs, i . e. What output (s) does this recess teed into? O u t g o i n g P r ocess this p r ocess? I n c om i n g P r ocess v ...- ........... I' I' ( 4 . 4 . 1 . 1 } Meth o d s of Control ( 4.4.l.c ) Measures of Effectiveness (Mo E ) in Place? • • Operationa l Risk Identification & Mgt. R i s k Management/Matrix Measure J Effectlvene n - + Target? - Actua l ? -Met ? - Ac t l o n ? Quality (DPPMJFPY ? ) Time ( OT D ) ? ' ./ \. ./

79. T he P R O CES S I N TE R A CT I O N A u d it “ … d e t er mine the in p u ts re q u i re d a nd the o u t p u ts e xp ec t e d f r o m th es e p r o cesses…”

80. T he P R O CES S I N TE R A CT I O N A u d it

81. T he P R O CES S I N TE R A CT I O N A u d it “ … d e t er mine a nd app ly the cr it er i a a nd m e th od s n ee d e d t o e n sur e the ef f ec ti v e op er a ti o n a nd c o nt r ol o f th es e p r o cesses…”

82. T he P R O CES S I N TE R A CT I O N A u d it p r o cesses…”

83. T he P R O CES S I N TE R A CT I O N A u d it “ … a d d res s the r i sk s a nd oppo r t u niti e s a s d e t er min e d in a cc o r da n c e w ith the re q u i re m e nts o f (C l a use ) 6 . 1 R i sk s a nd O ppo r t u niti es”)” a

84. T he P R O CES S I N TE R A CT I O N A u d it O P T IO N A L Au d it o r a re a s o f s p ec i al i n t erest

85. The PROCESS INTERACTION Audit Too/ Process Interaction Diag r am ( I SO 9001:2015; C l ause 4.4.1) I' I' ( 4.4.l.d ) Resource s , i. e . , 1 What?" P eopl e , Material s , Equipment , Work Environment, etc. {Auditor S ecial l nterest Item} Ex ertls e , I.e. "Whom?" Educatio n , Knowledg e , Tr a i ning, Skill s , Experience, et c . '- ./ '- ./ ::--- (4.4. 1 . a ) Inputs, I.e. What ln utl lized ln ( 4.4.l.e ) P rocess Activities ( 4.4.l.e ) R espo n si b l e Person (s) (4. 4 . 1 . a ) Outputs, i . e. What output (s) does this recess teed into? O u t g o i n g P r ocess this process? I n c om i n g P r ocess v ...- ........... I' I' ( 4 . 4 . 1 . 1 } Meth o d s of Control ( 4.4.l.c ) Measures of Effectiveness (Mo E ) in Place? • • Operationa l Risk Identification & Mgt. R i s k Management/Matrix Measure J Effectlvene n -+ Target? - Actua l ? -Met ? - Ac t l o n ? Quality (DPPMJFPY ? ) Time ( OT D ) ? ' ./ \. ./

86. Internal Auditing Pitfalls - and Some Preventive Actions - Common / Frequent Stumbling Blocks and Some Preventive Steps and Tools for Planning, Conducting, Reporting, Closing Internal Audit 87

87. Four Phases to Internal Audits Planning and Preparing for the Audit Conducting the Audit Reporting Results and Writing NCRs Performing Root Cause Analysis and Implementing and Verifying Corrective Actions All four phases must be addressed for internal audits to be effective ! 88

88. Planning and Preparing Pitfalls “We always scramble to get our audits done – sometimes we don’t finish them” Suggestion: Schedule defined processes within your QMS to be done each month – don’t overload auditors Alternate: Schedule an annual “blitz” of whole system 89

89. Planning and Preparing Pitfalls “Some of our processes always seem to have more problems or take longer to audit because they are more complex” Suggestion: Schedule additional audits of certain processes based on “status” or “importance”. This is a requirement of ISO 9001:2015, 9.2. Internal Audits 90

90. Planning and Preparing Pitfalls “Our auditors say they are not sure what to look for when they audit” Suggestion: Auditors should study applicable sections of the standard, quality manual and procedures, customer and legal requirements. Make a “Turtle” diagram of the process, make a checklist. Alternate: Hire professional “external” auditors 91

91. The Turtle Diagram 92

92. Conducting the Audit “Our auditors rarely report any problems. What they do report is inconsequential” Suggestion: Audit for effectiveness Four challenging questions: “How are you (or your job) doing?” “How do you know that?” “Are you improving?” “How do you know that? ” 93

93. Conducting the Audit “Our Certification’s auditor often finds that our procedures don’t match the work” Suggestion: Audit for three contrasts: Policy – Is it clearly stated in our manual? Procedure – Is it up to date, support the policy? Do our people understand it? Practice – Do we do what we say? Are innovative ways of doing things better being considered, evaluated, approved ? When did you last review procedures ? 94

94. Conducting the Audit “Our auditors don’t know how to follow audit trails or ask the probing questions” Suggestion: Conduct a “Learning Audit” = Evaluate auditors regularly using a more experienced auditor. Use the “Turtle Diagram” as a source of questions. Ask “Why?” five times when something doesn’t jive with the manual or procedures. Obtain copies of evidence for better reporting . Practice, evaluate, practice, evaluate ! 95

95. Reporting the Audit “Our supervisors resent internal audits as useless fault finding” Suggestion: Start audit reports by summarizing the good areas, especially “best practices”. Include ideas/suggestions for resolving nonconformities (Yes, internal auditors CAN consult!!). Constantly preach that nonconformities are not the end of the world or cause for personnel punishment, but Opportunities for Improvement ! 96

96. Reporting the Audit “Our nonconformity write-ups are often difficult to understand (What do I do?)” Suggestion: ALWAYS state three items in Corrective Action Requests (CARs): The requirement violated (doc/para/text) The nonconformity (text related to req’t ) The objective evidence (what, where, when) If you can’t cite the requirement, you shouldn’t write a CAR ! (Maybe an OFI?) 97

97. Closing the Audit “Our corrective actions don’t work. The problems keep coming back” Suggestion: Conduct formal Root Cause Analysis and Effective Corrective Action training for all managers/supervisors CAR respondees must fully comprehend the difference between correction and corrective action and understand that there is a system cause to the nonconformity, not just “operator error” 98

98. Containment ( aka Correction ) In some cases, swift action needs to be taken to contain the problem and prevent any consequences of the problem (“escapes”) from affecting customers This containment action includes the immediate fixing of the problem at hand, which is referenced in ISO 9000 as correction , which should not be confused with corrective action 99

99. Correction vs. Corrective Action ISO 9000:2005 defines these as: Correction: Action to eliminate a detected nonconformity (3.6.6) Corrective action: Action to eliminate the cause of a detected nonconformity or other undesirable situation(3.6.5) Note 1 There can be more than one cause for a nonconformity Note 2 Corrective action is taken to prevent recurrence Bold = My emphasis 100

100. Some More Advice Recognize that there are at least two causes for each quality problem: A technical cause (and there may be more than one !!!) such as a bearing failure or an operator error and A system cause such as an ineffective preventive maintenance program or incomplete employee training program or incorrect procedure or work instruction You Must Fix Both (ALL) 101

101. Even More Advice Utilize all appropriate quality tools to get at the root cause, such as: Ishikawa fishbone cause/effect diagram with the seven M’s as the branches, Man, Machine, Method, Materials, Measure- ments , Mother Nature, Management “Five Why’s” fault tree analysis diagram, looking for common “grandfathers” as high priority items to fix Kepner-Tregoe Cause Analysis 102

102. Assuring Effectiveness Don’t forget to prevent recurrence by changing the system as appropriate: Revise procedures, policies, QA Manual Train/retrain employees, adjust training needs matrix Inform all who “touch” the process Look at other processes/products. Can or should the fix( es ) be used on them? 103

103. Closing the Audit “Our CARs seem to hang open forever” Suggestion: Monitor CAR action item timing/commitments, remind owners, only accept corrective action plans that address true root causes, are appropriate actions Audit the process to verify that ALL actions have been effectively implemented, other processes have been considered, there has been NO RECURRENCE since the corrective action has been implemented Only then can you close the CAR 104

104. Based on the information given, if you think the situation represents a nonconformity, then write a non conformity statement that includes the following information: Situation #; area/process being audited; applicable ISO 9001 clause #; whether the nonconformity is major or minor; a clear description of the specific requirement that the situation is nonconforming against; a clear description (finding) of the nonconformity itself, supported by relevant objective evidence. OR, based on the information given, if you do not think there is a nonconformity, then clearly state your reason(s), and also provide at least 3 further actions you would take to gather additional evidence of conformity or nonconformity (had you been there performing the audit).

105. Case study 1 In the purchasing department, the auditor notes that the staff are placing orders over the phone with suppliers using a computerized purchasing system. On inquiry, the auditor is told that the staff has been fully trained and the database holds details of all supplier contract specifications and, therefore, there is no need for an independent review of individual orders.

106. Case Study 2 In the quality manager’s office, the auditor asks to see the schedule for internal audits. This schedule shows that each of the eight QMS processes are audited every six months. The auditor asks the quality manager how the frequency of audits was decided. The manager says that when the system was set up three years ago, 6-month intervals were specified for all processes. The company has kept to this original schedule. The auditor asks to see the file containing corrective action requests (CARs). It lists 85 CARs for the past two rounds of internal audits. Of these, 65 CARs are in the production department and the remainder are spread evenly over five other departments. Two departments received no CARs.

107. Case Study 3 In the shipping area, the auditor stops to look at six finished products, serial numbers X245 to X250, in individual cardboard cartons. The auditor asked the shipper why the items are packed in corrugated cardboard instead of plastic containers as required by packaging work instruction PWI 6, revision 2. The shipper replied that the shipping supervisor had instructed them to use corrugated cardboard when they ran out of plastic containers three weeks ago.

108. Any Questions? Thanks

109. For y ou attendance and partic i pation !