Ben Franklin wrote “The only two certainties in life are death and taxes.” And, for those of us who are responsible for determining when and where to internally audit the Quality Management System, that’s a very true statement, because, when it comes to determining the plan for internal audits, there is very little that’s predictable about what should be audited, and when.
The requirements for Internal Audits in ISO 9001 can be also considered to have the 4 phases: “Plan, Do, Check, and Act Cycle” (PDCA), in the same manner as the Quality System. When preparing for an organization’s first audit program, emphasis is usually placed on the individual’s planning for their internal audit assignment. However, for that planning to be successful, consideration must be given to where and when the audit should be performed. In this, the second newsletter to look at Internal Audits, we discuss scheduling.
Death and Taxes
Ben Franklin wrote “The only two certainties in life are death and taxes.” And, for those of us who are responsible for determining when and where to internally audit the Quality Management System, that’s a very true statement, because, when it comes to determining the plan for internal audits, there is very little that’s predictable about what should be audited, and when. Although it’s usual to put together a 12 month calendar, which identifies processes, departments or similar, which are going to be the focus of a ‘cycle’ of audits, often we miss what’s keeping management ‘awake at night’.
Ben Franklin’s advice was, in actual fact, only partially true because when considering an audit schedule, there are some “Immovable Feasts” or dates which relate to an organization’s planned events, which may include:
- Seasonally related activities – harvesting, vacation coverage, etc
- Certification Body Audit visits (once registered)
- Regularized Customer visits
- Regulatory Audits/inspections
- Product Certification surveillance visits
In all other respects it is difficult to predict – without a crystal ball – which part(s) of the Quality Management System should be audited and when, particularly 6 -12 months in advance. Although it is normal to construct a calendar, there is no actual requirement to do so in ISO 9001.
Indeed, the previous guidance document, ISO 9004:2000 stated (in part)“Planning for internal audits should be flexible in order to permit changes in emphasis based on findings and objective evidence obtained during the audit.”
Start As You Mean To Continue – NOT!
In the early stages of implementing a QMS, based on ISO 9001, it is usual and very natural to ensure that all the ISO 9001 requirements have been internally audited. No organization should enter into the ISO certification process knowingly, without ensuring that their whole system is, in fact, implemented as a network of connected processes and is producing the desired results, as defined. It is likely that to attain that level of preparation, auditors will do one huge audit or a number of smaller audits, performed over s relatively short time frame of just a few months.
Once the Quality Management System has been determined to be in compliance with the ISO 9001 requirements, it is unlikely that the same audit strategy is going to be suitable and effective to sustain the needs of the organization in the future. The challenge is to use audits for a higher purpose than preparing for a Certification Body ‘stage1’ or ‘stage 2’ audit. If we consider a graph of QMS maturity over time we can see that an internal audit programme must also follow the maturity of the system, to be capable of providing the information the organization’s management will need. Put simply, telling Management that their people “weren’t following procedures”, isn’t going to cut it!
With the movement of management systems standards to incorporation of risk and risk management, clearly, internal audit programmes will also be required to ‘step up’. The newest version of the auditing guidance document, ISO 19011 has a significant addition of risk:
“This International Standard introduces the concept of risk to management systems auditing……It does not provide specific guidance on the organization’s risk management process, but recognizes that organizations can focus audit effort on matters of significance to the management system.”
Risk is a concept which is often kept in the forefront of management’s collective mind. Risks are normally associated with:
And, since events, actions and timeframes which are co-incident with the risk are often also on management’s mind too, it follows that for internal audits to be a useful tool, management – the risk ‘owners’ – must be involved in the timing, scope and criteria used for those audits, to ensure the correct parts of the business fall under the spotlight.
Push You or Pull Me?
Compliance based internal audit programmes rely on the audit process owner pushing the schedule/calendar, timing, scope etc. of audits, to management. This is fine in the phases before and immediately after formal implementation and Certification of a management system. Once beyond that, a pull system should be used, where management actively seek the ‘services’ of the audit programme, to evaluate risk and assist with risk mitigation. This change from push to pull has already been demonstrated as effective, under the ‘Demand Flow’ techniques of the Toyota Production System – which allows flexibility in scheduling, economies and effective/efficient manufacturing in response to customer demand.
Of course, in changing the manner in which audits are scheduled may lead to changes in other aspects of the Quality Management System, in particular, the cornerstone ‘Management Review’ activities. In the next newsletter, we’ll evaluate what options are open to make Management Review one of the most productive requirements of ISO 9001.
