Internal ISO Auditor Training

Auditing Fundamentals (Definitions)

Auditing a systematic, independent, and documented process for obtaining objective evidence and evaluating it to determine the extent to which it effectively meets the audit criteria Quality simply put, conformance to requirements Nonconformity an instance of not meeting requirements

Purpose of Auditing
To determine conformity To determine effectiveness To provide opportunity to improve To meet regulatory requirements For certification

Reasons to Conduct Internal Audits

Quality Program requirements Identification of ineffective processes Identification of quality problems Show areas where improvement is possible

Classification of Audits (Internal vs. External)

Internal audit performed within an organization to measure the organizations own performance External audit audits held by an organization on an outside source (such as a vendor). Also when an outside party, such as NUPIC or ISO Registrar performs an audit of an organization

Classifications of Audits (Based on Party)

First Party audit performed by a company on itself (internal audit) Second Party audit performed by a company on an outside source (external audit) Third Party audit performed by an independent organization for or on the company, such as an ISO Registration audit (external audit)

Process Audits
Focus on specific process elements Used to: - Determine whether a process is
effectively implemented and maintained - Determine if a process conforms to a standard such as ISO 9001:2008 - Identify continual improvement opportunities - Verify that corrective actions have been implemented and are effective

Audit Independence and Objectivity

Independence auditors are independent when they render impartial and unbiased judgment in the conduct of their engagement Objectivity auditors should have no direct responsibility for the area being audited; and should maintain an unbiased and impartial mindset in regard to all engagements

Audit Preparation and Planning (Authority)

Who has authorized the audit? - Organizational Authority: QA Manager - Policy Authority: supplier audits required by Quality Manual/Procedures - Contracts: may require audits - Regulatory: NUPIC to verify 10CFR50 Appendix B

Audit Planning and Preparation (Audit Scope)

Scope includes: - Type of audit First, second, or third party - Depth of Audit Activities, facilities, locations to be audited

Audit Planning and Preparation (Selecting Auditors)

Auditors should be selected based on the following: Attributes: fair, unbiased, etc. Independence: no responsibility for areas being audited Qualifications: see next slide Availability

Audit Planning and Preparation (Auditor Qualifications)

Possess good verbal and written skills Possess interviewing skills and good listening skills Be trained and qualified - Receive this training (initial requirement), including successfully passing test - Per QAP-18, Audits, perform 2 internal audits under a qualified Lead Auditor (on-the-job requirements)

Audit Planning and Preparation (Audit Checklist)

Based on audits purpose and scope Needs space for auditee response Needs space for auditor observations
Advantages
Promotes planning for audit Ensures consistent audit approach Serves as a memory aid Provides objective evidence that audit was performed Provides information base for future audits

Audit Planning and Preparation (Process Audit Planning)

Process Audits do not use a formal checklist To aid auditor in planning/preparation for internal audit, including the development of possible questions to ask, auditor should use Process Turtle Diagram

Audit Planning and Preparation (Process Audit Planning)

Audit Planning and Preparation

(Completed Turtle Diagram Example)

Audit Planning and Preparation (Audit Strategy)

Random Selection of Samples - Flowcharts used to understand process - Auditor looks at information for items that are: completed in progress ready to start (if applicable)

Audit Planning and Preparation (Audit Schedule)

Documents all routine audits Shows audits planned by month Written to cover a year Allows some flexibility Approved by QA Manager

Sample Audit Schedule

Audit Planning and Preparation (Audit Notification and Agenda)

Gives advanced notice to auditee Includes purpose, scope, dates and auditors name Provides times for opening and closing meetings Provides time frame for daily auditor meetings/conferences (as required)

Sample Audit Plan

Audit Performance (Opening Meeting)

Lead Auditor provides: - introduction of team members - the audit purpose, scope, and objective - the anticipated duration of the audit - may discuss classifications of findings - tentative time and date of closing meeting

Audit Performance (Methods)

Auditors should approach the audit using the 5W/1H method for interviews and documentation of objective evidence.
Who does it? What is the process? When is it done? Where is it done/documented? Why is it done like this? How is it done?

Audit Performance (Interviews)

Put the auditee at ease Show respect, dont induce fear Explain the purpose of the interview Ask open-ended questions The interview results should be summarized and reviewed with the person interviewed Thank the person for his/her time

Audit Performance
(Open vs. Closed Ended Questions)
Open-ended
What do you do first?
How do you record that result? Where do you record that result?

Closed-ended
Is this what you do?
Do you document that results? Is this where you record that result?

Please show me the shop instruction?

Is there a procedure for this?

Audit Performance (The art of listening)

Eliminate any distractions Listen for content Suspend all judgment Listen for themes in answers Seek clarification of answers

Audit Performance (Verifying Records/Documents)

Sampling selection: - Necessary due to time limits - Auditor should select samples - Examine samples in detail - No set amount of samples - Cover relevant time period - Look at control of records/documents - Record all samples examined as objective evidence

Audit Performance (Observations)

Look at the physical evidence Look for unsafe, unusual conditions Look at storage of records Look at calibration of instruments (as applicable) Make notes: -comprehensive, accurate, legible

Audit Performance (Audit Findings)

May be used to identify any and/or all of the following: - Positive findings/strengths - Opportunities for improvement or observations - Nonconformities (major or minor)

Audit Performance (Nonconformities)

A well documented nonconformity will have three parts: - a description of the problem - explanation of the requirement - reference the objective evidence related to the nonconformity

Audit Performance (Nonconformity Classification)

Major the absence or total breakdown of a process
- A number of minor nonconformities against one clause/section of a process can represent a total breakdown of a process and thus be considered major

Minor failure to meet on requirement of a clause of the standard or a single observed lapse in following one item of a procedure

Audit Performance (Objective Evidence)

Factual evidence of differences between process, procedures, and audit criteria Evidence of differences between procedures and work practices Lack of evidence to support adequate implementation of standards Documentation of specific records you have reviewed during the audit (ex. PO numbers, survey numbers)

Audit Performance (Documentation)

Audit Performance (Sample Documentation)

Audit Performance (Exit Meeting)

Meeting to present audit observations and findings Lead Auditor presents team findings, with clarification as necessary from auditors Discuss need (if any) for follow-up audit Opportunity to thank auditee for support

Audit Reporting (Timely Reporting)

Checklists and associated notes should be completed and turned into Lead Auditor as soon as possible after the audit Report should be completed by Lead Auditor as soon as possible after audit Any associated CPARs should be written/issued at the same time Timely reports add value

Audit Reporting (Report Contents)

Audit scope, objectives, criteria Identification of auditors and auditees Audit findings, including nonconformities Any recommendations, opportunities for improvement Assessment of process effectiveness Summary of audit process Distribution list
NOTE: Audit reports should be traceable from the report and any CPARs generated

Audit Reporting (Items NOT included in report)

Confidential or proprietary information Subjective Opinions Minor deficiencies corrected during the audit Specific names of employees associated with findings Anything not discussed during the exit meeting

Audit Reporting (Report Retention)

Purpose - meet quality requirements - allow for review of audit work - follow up on corrective actions - future audit planning - reference for developing future audit checklists

Audit Follow-up and Closure (General)

Follow-up: - a process by which internal auditors determine the adequacy, effectiveness, and timeliness of action taken by management/process owners on reported audit findings - The largest cause of failure in internal audits is the lack of effective corrective action taken on the nonconformities identified

Audit Follow-up and Closure (Action)

Action should be taken by agreed upon time Review documented evidence Should be performed on-site Is only a review of corrective actions NOT another audit

Audit Follow-up and Closure (Documented Evidence)

Evidence may be in the form of: - Records of action taken - Training certificates - Amended Procedures - New equipment

Audit Follow-up and Closure (Process)

1. Auditor: - identifies problem and issues CPAR 2. Auditee: - evaluates the corrective action - performs root cause analysis - develops an action plan - implements the corrective action - standardizes the action

Audit Follow-up and Closure (Process continued)

3. Auditor: - verifies the implementation and effectiveness of the corrective action - issues the close-out report

NOTE: If follow-up audits are required, the CPAR should remain open until the followup audit is complete and the auditor has verified the effectiveness of the corrective action.

Audit Planning Practical

References
Auditing to ISO 9001:2008 Course, Quality and Productivity Solutions, Inc. Internal Auditor Training Course, QualityGurus.com Schulz Electric Company Quality Assurance Procedure 18, Audits