Adding Value to Internal QMS Audit

==========

Adding Value to Internal QMS Audit

==========

 

Internal audit is used as a tool to monitor and determine the health of the quality management system implemented in the organization. Internal audit is carried out to measure the effectiveness of the quality management system. The findings of internal audit can help in initiating appropriate measures.

 

Clause 9.2 of ISO 9001:2015 QMS standard stipulates the requirements of the internal audit. Please go through the chapter #43 on ‘Internal Audit’ in this book. If we compare the requirements of the internal audit with the earlier version, there is nothing new in the internal audit requirements of ISO 9001:2015 QMS standard. However, we find that ISO 9001:2015 QMS standard has less focus on ‘documented information’ and greater focus on achieving outcomes and results. Many clauses in ISO 9001:2015 QMS standard do not mention any requirements to maintain or retain any documented information and it is a challenge before an auditor or internal auditor how to audit compliance of standard’s requirements in such a situation.

 

A few of the tips are mentioned below for the benefit of the auditor or internal auditor, by which the auditor can add value to the audit:

 

·       Understand the intent of ISO 9001:2015 QMS standard and its concepts, such as context of the organization, risk-based thinking, addressing risks and opportunities, etc.

 

·       Make use of ISO 19011:2018, Guidelines for auditing management systems, as your guidance manual for auditing ISO 9001:2015 quality management system.

 

·       Make use of ISO 9001:2015 QMS standard as a reference standard.

 

·       Study the guidance papers and presentations issued by International Organization for Standardization (ISO) and International Accreditation Forum (IAF) and other publications, literature on ISO 9001:2015 QMS.

 

·       Get auditor’s competence by attending the relevant training. Make a habit to attend ISO 9001 related training, conference and seminar.

 

·       Pursue the outcomes from the previous audits, if any, both internal and external, to identify any specific issues or concerns still require improvement.

 

·       Understand the organization, its processes, its stakeholders, risks and opportunities, applicable legal requirements.

 

·       Seek adequate time for auditing.

 

·       Focus more on the process, process performance and its outcomes and results.

 

·       Understand and remember seven quality management principles (QMPs) and use of PDCA approach to evaluate the process effectiveness.

 

·       Look for objective evidence.

 

·       Use 5 W’s and 1 H – What, Why, Where, Who, When and How – appropriately to obtain objective evidence.

                                

·       Provide adequate opportunity to the auditee to correct any nonconformities, if noticed.

 

·    Make efforts to identify the root causes of problems or nonconformities. Don’t see who is responsible. Rather consider why and what caused the problem or nonconformity.

 

·       Adopt a ‘holistic’ approach while gathering objective evidence during audit.

 

·     Analyze the findings and relate them to the organization’s ability to provide products and services that meet customer and applicable legal requirements.

 

·       Report audit findings.

 

·       Also emphasize positive findings as appropriate.

 

·   Consider solution and corrections proposed by the auditee in response to the ‘negative findings’ (nonconformances).

 

·       Carry out process audit by following the path the auditee takes to carry out the process.

 

·       Don’t make the audit difficult by adding on requirements. Do not add any additional requirements, which are not required.

 

Value added auditing aims to add value, the organization will find useful. Value added auditing encourages result-focused systems, with minimum bureaucracy. It helps to identify strong and weak points and focus on the ways to improve. Value added auditing provides confidence that the quality management system is the king and the organization is consistently providing conforming products and services to its customers.

 

Case Study

 

Ram Dubey, a Chartered Accountant, held the position of Finance Manager at ABC Manufacturing's headquarters, overseeing two ISO 9001:2015 Quality Management System (QMS) certified manufacturing plants. Ram often visited these plants for financial management and financial audits. One day, the CEO of ABC Manufacturing praised Ram's work and requested him to conduct an internal audit of the plants’ QMS within 15 days, as the certification surveillance audit was scheduled for the following month. The CEO provided Ram with copies of ISO 9000:2015 and ISO 9001:2015 standards, blank nonconformance report forms, the quality manual, and an internal audit file. The CEO also explained the significance of opening and closing meetings, as well as the process for raising and resolving nonconformities. The CEO expected Ram to identify at least 10 nonconformities in each plant to demonstrate compliance with the company's quality manual. Ram learned that internal audits were to be conducted annually, as stated in the quality manual.

 

After dedicating two days to studying the relevant standards and the company's quality manual, Ram felt confident about conducting the audit, drawing on his financial audit experience as a chartered accountant. A week later, he visited both plants and identified more than 10 nonconformities in each.

Some of these nonconformities, along with the relevant standard clauses and actions taken to address them, were as follows:

 

1.              No records were maintained for determining external and internal issues - Clause 4.1. The nonconformity was closed with the auditee's explanation that the standard did not require such records.

 

2.              No records were kept for determining interested parties and their requirements - Clause 4.2. The nonconformity was resolved with the same explanation provided by the auditee.

 

3.              The quality policy was not displayed in the fabrication and purchase sections, and employees were unaware of it - Clause 5.2. The plant manager promptly supplied copies of the quality policy to all employees and displayed it in the relevant sections.

 

4.              No specific individuals were assigned duties and responsibilities for QMS monitoring - Clause 5.3. The plant manager claimed to perform these duties personally.

 

5.              No formal risk register or risk records were maintained - Clause 6.1. While a risk register wasn't required, the auditee affirmed that risks were identified, and preventive actions were taken.

 

6.              The painter in the painting section couldn't state the quality objectives for his department - Clause 6.2. The head of the painting section provided the quality objective and demonstrated the related register tracking product reception, painting, and storage.

 

7.              Weighing equipment for raw materials and weighing balances were not calibrated or checked for accuracy regularly, as legally required - Clause 7.1.5. The concerned staff was unaware of the requirement but agreed to perform the necessary calibration and checks.

 

8.              Employee competence records were not available at the plant - Clause 7.2. It was suggested that these records be kept at the company headquarters, which was confirmed by the HRD section.

 

9.              No evidence was provided to determine applicable statutory and regulatory requirements - Clause 8.2.2. The Plant Manager clarified that this was managed by the Product Research Cell at the company's headquarters.

 

10.           Re-evaluation of suppliers had not been conducted as required by the established procedure - Clause 8.4. The head of the purchase department assured that re-evaluation would be completed by the end of the month and shared the re-evaluation proforma sent to suppliers.

 

11.           Nonconforming products were found without proper marking - Clause 8.7. The plant manager committed to segregating nonconforming products with special markings.

 

Upon returning to headquarters, Ram submitted his audit report to the CEO, who was pleased with his work. Ram was promoted to Chief Manager, and his emoluments were increased by 20%.

 

Analysis of Ram Debey’s Internal Audit by the CEO

 

Ram Dubey saved the company from a non-compliance in the upcoming certification audit by conducting an internal audit.   

 

Ram Dubey conducted a thorough internal audit of the quality management system of the company’s plants. Within a short duration, he demonstrated a good understanding of ISO 9001:2015 QMS standard and the company’s quality manual. He identified more than 10 nonconformities in each plant addressing various aspects of the quality management system, such as documentation, policy implementation, risk management, competence, supplier evaluation, segregation of nonconforming products, calibration etc.

 

According to the CEO, Ram Dubey’s internal audit appears to be of good quality. He followed ISO 9001:2015 QMS standard requirements and the guidelines set out in the company’s quality manual. His ability to identify relevant nonconformities and document them with clause number accurately indicates his competence in conducting internal audit. This internal audit added significant value to ABC Manufacturing. By identifying nonconformities and suggesting corrective actions, he helped the company address potential issues in its quality management system. This proactive approach ensures that the company is better prepared the upcoming certification surveillance audit.  

 

Independent Analysis of Ram Debey’s Internal Audit

 

If we consider the above case study with an open eye, we will have different outcomes. With an independent analysis, it is now evident that Ram Dubey’s internal audit had more significant shortcomings. He neglected several critical areas of the quality management system and did not measure the effectiveness, adequacy, and performance of the quality management system in many key clauses of ISO 9001:2015 QMS standard.

 

Many areas were left by Ram Dubey, where he has neither raised any nonconformities nor he submitted any compliance reports meeting requirements, such as:

 

·       Scope of the quality management systems – 4.3

·       Leadership and commitment – 5.1

·       Design and development activities – 8.3

·       Production and service provision – 8.5

·       Release of products and services – 8.6

·       Monitoring, measurement, analysis and evaluation including customer satisfaction – 9.1

·       Internal audit – 9.2

·       Management Review – 9.3

·       Improvement – 10.1, 10.2, 10.3

 

From the omitted audit areas, it is clear that Ram Dubey’s internal audit lacked thoroughness and professionalism. His limited knowledge of quality management system audit and the absence of formal training in ISO 19011:2018, combined with his lack of understanding of ABC Manufacturing’s production processes, raised serious concerns about the quality of the audit.

 

While Ram Dubey identified nonconformities in some areas, the overall effectiveness and reliability of his internal audit are questionable because:

 

·       Ram Dubey omitted critical audit areas, such as the scope of the QMS, leadership and commitment, design and development activities, production and service provision, release of products and services, monitoring, measurement, analysis and evaluation, internal audit, management review and improvement. This incomplete audit scope raises concerns about the comprehensiveness of the internal audit.

 

·       Ram Dubey’s lack of knowledge about ISO 19011:2018 management systems auditing standard highlights a significant deficiency in his audit approach. This standard provides guidance on auditing principles and techniques and is essential for conducting effective internal audits. Ram Dubey has limited expertise and knowledge in quality management system auditing.

 

·       Considering the gaps in the audit and Ram Dubey’s limited expertise in quality management system auditing, it raises questions about the motives behind the audit. It appears that the audit may have been conducted primarily to please the CEO, rather than to genuinely assess the quality management system of ABC Manufacturing.

 

·       Ram Dubey’s lack of formal quality management system audit training is a critical shortcoming. Proper training is essential to conduct thorough and effective audits, and his background as a financial professional may not adequately prepare him management systems auditing.

 

·       It is clear that Ram Dubey’s internal audit was not conducted to the level of quality and professionalism expected in the field of quality management system auditing. It may have lacked objectivity, depth, and compliance with auditing standards and guidelines. The internal audit carried out by Ram Dubey was inadequate.

 

·       Since Ram Dubey’s lack of formal quality management system audit training, he did not develop an audit plan or criteria for selecting audit areas. A structured plan could improve the efficiency and effectiveness.

 

·       During the audit, Ram Dubey focused his attention on finding and reporting the nonconformities, he omitted to note those objective evidence that showed compliance with ISO 9001:2015 QMS standard requirements.

 

Learning from the Case Study: From the above case study, we find that Ram Dubey lacked formal quality management system audit training and also lacks of knowledge about ISO 19011:2018 management systems auditing standard. Had he been given the formal training he would have been a competent QMS internal auditor and the outcome of his internal audit would have been different. With formal training, he could have added value the quality management system internal audit.

 

Concluding Summary

 

This write-up emphasized the essential concepts and considerations for conducting a value-added internal audit within the framework of ISO 9001:2015 QMS. The key takeaways are:

 

·       Internal auditor should grasp the intent of ISO 9001:2015, understand its requirements including its new concepts, like context, risk-based thinking, addressing risks and opportunities.

 

·       ISO 19011:2018 provides valuable guidelines for management systems auditing, serving as an indispensable resource for the auditor.

 

·       A holistic, solution-oriented approach is crucial. The auditor should focus on processes, outcomes and root-causes while emphasizing positive findings alongside nonconformities.

 

·       Continual training and development are vital for an auditor to stay updated and competent in its role.

 

·       The case-study given in this chapter demonstrated practical application, highlighting the importance of thoroughness, competence of the auditor, and a balanced perspective in the internal audit.

 

In conclusion, value-added internal audit goes beyond mere compliance checking. It serves as a means to drive continual improvement, enhance organizational performance, and ensure effectiveness of the quality management system. By adhering to value-added internal audit, the internal auditor helps the organization to achieve greater confidence in its ability to consistently provide quality products and services to ita customers.

 

Best Regards,

Keshav Ram Singhal

(This write-up is a part of a forthcoming book on ISO 9001 being written by Keshav Ram Singhal)