==========
Adding Value to Internal QMS Audit
==========
Internal audit is used
as a tool to monitor and determine the health of the quality management system
implemented in the organization. Internal audit is carried out to measure the
effectiveness of the quality management system. The findings of internal audit
can help in initiating appropriate measures.
Clause 9.2 of ISO
9001:2015 QMS standard stipulates the requirements of the internal audit. Please
go through the chapter #43 on ‘Internal Audit’ in this book. If we compare the
requirements of the internal audit with the earlier version, there is nothing
new in the internal audit requirements of ISO 9001:2015 QMS standard. However,
we find that ISO 9001:2015 QMS standard has less focus on ‘documented
information’ and greater focus on achieving outcomes and results. Many clauses
in ISO 9001:2015 QMS standard do not mention any requirements to maintain or
retain any documented information and it is a challenge before an auditor or
internal auditor how to audit compliance of standard’s requirements in such a
situation.
A few of the tips
are mentioned below for the benefit of the auditor or internal auditor, by
which the auditor can add value to the audit:
· Understand the intent of ISO 9001:2015 QMS standard and its concepts,
such as context of the organization, risk-based thinking, addressing risks and
opportunities, etc.
· Make use of ISO 19011:2018, Guidelines for auditing management systems,
as your guidance manual for auditing ISO 9001:2015 quality management system.
· Make use of ISO 9001:2015 QMS standard as a reference standard.
· Study the guidance papers and presentations issued by International
Organization for Standardization (ISO) and International Accreditation Forum
(IAF) and other publications, literature on ISO 9001:2015 QMS.
· Get auditor’s competence by attending the relevant training. Make a
habit to attend ISO 9001 related training, conference and seminar.
· Pursue the outcomes from the previous audits, if any, both internal and
external, to identify any specific issues or concerns still require
improvement.
· Understand the organization, its processes, its stakeholders, risks and
opportunities, applicable legal requirements.
· Seek adequate time for auditing.
· Focus more on the process, process performance and its outcomes and
results.
· Understand and remember seven quality management principles (QMPs) and
use of PDCA approach to evaluate the process effectiveness.
· Look for objective evidence.
· Use 5 W’s and 1 H – What, Why, Where, Who, When and How – appropriately
to obtain objective evidence.
· Provide adequate opportunity to the auditee to correct any
nonconformities, if noticed.
· Make efforts to identify the root causes of problems or nonconformities.
Don’t see who is responsible. Rather consider why and what caused the problem
or nonconformity.
· Adopt a ‘holistic’ approach while gathering objective evidence during
audit.
· Analyze the findings and relate them to the organization’s ability to
provide products and services that meet customer and applicable legal
requirements.
· Report audit findings.
· Also emphasize positive findings as appropriate.
· Consider solution and corrections proposed by the auditee in response to
the ‘negative findings’ (nonconformances).
· Carry out process audit by following the path the auditee takes to carry
out the process.
· Don’t make the audit difficult by adding on requirements. Do not add any
additional requirements, which are not required.
Value added auditing
aims to add value, the organization will find useful. Value added auditing encourages
result-focused systems, with minimum bureaucracy. It helps to identify strong
and weak points and focus on the ways to improve. Value added auditing provides
confidence that the quality management system is the king and the organization
is consistently providing conforming products and services to its customers.
Case Study
Ram Dubey, a
Chartered Accountant, held the position of Finance Manager at ABC
Manufacturing's headquarters, overseeing two ISO 9001:2015 Quality Management
System (QMS) certified manufacturing plants. Ram often visited these plants for
financial management and financial audits. One day, the CEO of ABC
Manufacturing praised Ram's work and requested him to conduct an internal audit
of the plants’ QMS within 15 days, as the certification surveillance audit was
scheduled for the following month. The CEO provided Ram with copies of ISO
9000:2015 and ISO 9001:2015 standards, blank nonconformance report forms, the
quality manual, and an internal audit file. The CEO also explained the
significance of opening and closing meetings, as well as the process for raising
and resolving nonconformities. The CEO expected Ram to identify at least 10
nonconformities in each plant to demonstrate compliance with the company's
quality manual. Ram learned that internal audits were to be conducted annually,
as stated in the quality manual.
After dedicating two
days to studying the relevant standards and the company's quality manual, Ram
felt confident about conducting the audit, drawing on his financial audit
experience as a chartered accountant. A week later, he visited both plants and
identified more than 10 nonconformities in each.
Some of these
nonconformities, along with the relevant standard clauses and actions taken to
address them, were as follows:
1.
No records were maintained for determining external
and internal issues - Clause 4.1. The nonconformity was closed with the
auditee's explanation that the standard did not require such records.
2.
No records were kept for determining interested
parties and their requirements - Clause 4.2. The nonconformity was resolved
with the same explanation provided by the auditee.
3.
The quality policy was not displayed in the
fabrication and purchase sections, and employees were unaware of it - Clause
5.2. The plant manager promptly supplied copies of the quality policy to all
employees and displayed it in the relevant sections.
4.
No specific individuals were assigned duties and
responsibilities for QMS monitoring - Clause 5.3. The plant manager claimed to
perform these duties personally.
5.
No formal risk register or risk records were maintained
- Clause 6.1. While a risk register wasn't required, the auditee affirmed that
risks were identified, and preventive actions were taken.
6.
The painter in the painting section couldn't state
the quality objectives for his department - Clause 6.2. The head of the
painting section provided the quality objective and demonstrated the related
register tracking product reception, painting, and storage.
7.
Weighing equipment for raw materials and weighing
balances were not calibrated or checked for accuracy regularly, as legally
required - Clause 7.1.5. The concerned staff was unaware of the requirement but
agreed to perform the necessary calibration and checks.
8.
Employee competence records were not available at
the plant - Clause 7.2. It was suggested that these records be kept at the
company headquarters, which was confirmed by the HRD section.
9.
No evidence was provided to determine applicable
statutory and regulatory requirements - Clause 8.2.2. The Plant Manager
clarified that this was managed by the Product Research Cell at the company's
headquarters.
10.
Re-evaluation of suppliers had not been conducted
as required by the established procedure - Clause 8.4. The head of the purchase
department assured that re-evaluation would be completed by the end of the
month and shared the re-evaluation proforma sent to suppliers.
11.
Nonconforming products were found without proper
marking - Clause 8.7. The plant manager committed to segregating nonconforming
products with special markings.
Upon returning to
headquarters, Ram submitted his audit report to the CEO, who was pleased with
his work. Ram was promoted to Chief Manager, and his emoluments were increased
by 20%.
Analysis of Ram
Debey’s Internal Audit by the CEO
Ram Dubey saved the
company from a non-compliance in the upcoming certification audit by conducting
an internal audit.
Ram Dubey conducted
a thorough internal audit of the quality management system of the company’s
plants. Within a short duration, he demonstrated a good understanding of ISO
9001:2015 QMS standard and the company’s quality manual. He identified more
than 10 nonconformities in each plant addressing various aspects of the quality
management system, such as documentation, policy implementation, risk
management, competence, supplier evaluation, segregation of nonconforming
products, calibration etc.
According to the CEO,
Ram Dubey’s internal audit appears to be of good quality. He followed ISO
9001:2015 QMS standard requirements and the guidelines set out in the company’s
quality manual. His ability to identify relevant nonconformities and document
them with clause number accurately indicates his competence in conducting
internal audit. This internal audit added significant value to ABC Manufacturing.
By identifying nonconformities and suggesting corrective actions, he helped the
company address potential issues in its quality management system. This
proactive approach ensures that the company is better prepared the upcoming
certification surveillance audit.
Independent Analysis
of Ram Debey’s Internal Audit
If we consider the
above case study with an open eye, we will have different outcomes. With an
independent analysis, it is now evident that Ram Dubey’s internal audit had
more significant shortcomings. He neglected several critical areas of the
quality management system and did not measure the effectiveness, adequacy, and
performance of the quality management system in many key clauses of ISO
9001:2015 QMS standard.
Many areas were left
by Ram Dubey, where he has neither raised any nonconformities nor he submitted
any compliance reports meeting requirements, such as:
· Scope of the quality management systems – 4.3
· Leadership and commitment – 5.1
· Design and development activities – 8.3
· Production and service provision – 8.5
· Release of products and services – 8.6
· Monitoring, measurement, analysis and evaluation including customer
satisfaction – 9.1
· Internal audit – 9.2
· Management Review – 9.3
· Improvement – 10.1, 10.2, 10.3
From the omitted
audit areas, it is clear that Ram Dubey’s internal audit lacked thoroughness
and professionalism. His limited knowledge of quality management system audit
and the absence of formal training in ISO 19011:2018, combined with his lack of
understanding of ABC Manufacturing’s production processes, raised serious
concerns about the quality of the audit.
While Ram Dubey
identified nonconformities in some areas, the overall effectiveness and
reliability of his internal audit are questionable because:
· Ram Dubey omitted critical audit areas, such as the scope of the QMS,
leadership and commitment, design and development activities, production and
service provision, release of products and services, monitoring, measurement,
analysis and evaluation, internal audit, management review and improvement. This
incomplete audit scope raises concerns about the comprehensiveness of the
internal audit.
· Ram Dubey’s lack of knowledge about ISO 19011:2018 management systems
auditing standard highlights a significant deficiency in his audit approach. This
standard provides guidance on auditing principles and techniques and is
essential for conducting effective internal audits. Ram Dubey has limited expertise
and knowledge in quality management system auditing.
· Considering the gaps in the audit and Ram Dubey’s limited expertise in
quality management system auditing, it raises questions about the motives
behind the audit. It appears that the audit may have been conducted primarily
to please the CEO, rather than to genuinely assess the quality management
system of ABC Manufacturing.
· Ram Dubey’s lack of formal quality management system audit training is a
critical shortcoming. Proper training is essential to conduct thorough and effective
audits, and his background as a financial professional may not adequately
prepare him management systems auditing.
· It is clear that Ram Dubey’s internal audit was not conducted to the
level of quality and professionalism expected in the field of quality
management system auditing. It may have lacked objectivity, depth, and
compliance with auditing standards and guidelines. The internal audit carried
out by Ram Dubey was inadequate.
· Since Ram Dubey’s lack of formal quality management system audit
training, he did not develop an audit plan or criteria for selecting audit
areas. A structured plan could improve the efficiency and effectiveness.
· During the audit, Ram Dubey focused his attention on finding and
reporting the nonconformities, he omitted to note those objective evidence that
showed compliance with ISO 9001:2015 QMS standard requirements.
Learning from
the Case Study: From the above case study, we find that Ram Dubey
lacked formal quality management system audit training and also lacks of
knowledge about ISO 19011:2018 management systems auditing standard. Had he been
given the formal training he would have been a competent QMS internal auditor
and the outcome of his internal audit would have been different. With formal
training, he could have added value the quality management system internal audit.
Concluding
Summary
This write-up
emphasized the essential concepts and considerations for conducting a value-added
internal audit within the framework of ISO 9001:2015 QMS. The key takeaways are:
· Internal auditor should grasp the intent of ISO 9001:2015, understand
its requirements including its new concepts, like context, risk-based thinking,
addressing risks and opportunities.
· ISO 19011:2018 provides valuable guidelines for management systems
auditing, serving as an indispensable resource for the auditor.
· A holistic, solution-oriented approach is crucial. The auditor should
focus on processes, outcomes and root-causes while emphasizing positive findings
alongside nonconformities.
· Continual training and development are vital for an auditor to stay
updated and competent in its role.
· The case-study given in this chapter demonstrated practical application,
highlighting the importance of thoroughness, competence of the auditor, and a
balanced perspective in the internal audit.
In conclusion,
value-added internal audit goes beyond mere compliance checking. It serves as a
means to drive continual improvement, enhance organizational performance, and
ensure effectiveness of the quality management system. By adhering to value-added
internal audit, the internal auditor helps the organization to achieve greater
confidence in its ability to consistently provide quality products and services
to ita customers.
Best Regards,
Keshav Ram Singhal
(This write-up
is a part of a forthcoming book on ISO 9001 being written by Keshav Ram
Singhal)
