A Conversation on QMS Internal Audit

Keshav Ram Singhal

I posted an article ‘Adding value to internal QMS Audits’ at my blog on ‘ISO 9001:2008 QMS Awareness’ (Link: http://iso9001-2008awareness.blogspot.com) on 6th October 2011. Just after a few days I received a telephone call from a friend. He desired to meet me and accordingly we met and have conversation on the topic. Here-in-below I describe the conversation for the information of my readers.

My friend – Your article ‘Adding value to internal QMS Audits’ is good, but it does not speak about the mistakes generally done by internal auditors and solutions to those mistakes.

KRS – Thanks for the input, however, can we have conversation on your point? First, I would like to know what common mistakes you observe from your internal auditors.

MF – Our organization is a manufacturing unit and more than 150 employees are working in our unit. We have provided internal audit training to five employees, who are being assigned the task of QMS internal auditing in our organization and I am observing that our internal auditors do not carry out the audit with sincerity. They view auditing as a routine task.

KRS – Yes, many auditors view auditing as a mundane task, just as a routine. This is unfortunate. They should set out to add value to organization’s business.

MF – Adding value to organization’s business. How?

KRS – Motivate your internal auditors to be alert with the organization’s objectives and during audit process auditors should keep their eyes and ears open.

MF – Every person keep eyes and ears open while working. What do you mean?

KRS – It is very true that a person generally keeps his eyes and ears open, but whether he actually looks to and/or hears the problems in the auditee’s area is relevant point for an auditor. I want to emphasize that while auditing the auditor should grasp the opportunity to seek out problems so that your organization can propose adequate solutions for the continual improvement and the effectiveness of your quality management system.

MF – Yes, I understood your point, but one problem generally we see. Auditors are interested in finding lapses or omissions, so that they can blame someone. Auditors give an impression that they are looking for something so that someone can be blamed.

KRS – Here our article ‘Adding value to internal QMS audits’ that has included a relevant valid point. When an auditor observes a problem or nonconformity, he should not see who is responsible. Rather he should consider why and what caused the problem or nonconformity. When you consider why and what caused the problem or nonconformity, you may find various points, such as, there was inadequate training, applied procedures were unrealistic, resources were insufficient, there was not enough time for doing things properly, there may be better way of doing things.

MF – You are very right. But auditors feel happy when they raise CAR or NCR on the auditee. They want to blame that people are not working properly.

KRS – Auditors should focus on the processes of the organization and not on the persons. Auditors should avoid careless words like, ‘whose lapse would that be?’, and ‘who did it?’ It should be the endeavour of the auditor to find out ‘what part of the system is letting the auditee or organization down?’ An auditor should always remember the mantra that ‘Audits uncover defects in the system.’

MF – Nice, but I have noticed that although organization incurs lot of expenses on the training of internal auditors, but they perform their QMS internal audit without sufficient preparation. What do you say about preparation for QMS audit?

KRS – Yes, I agree organizations invest on trainings of QMS auditors, but it is also the moral responsibility of the MR and the top management to provide necessary support for conducting an audit. It is bad if an auditor perform an audit without sufficient preparation. An auditor should do his homework and check through the standard and relevant work procedures of the organization. As I earlier stated, auditors should focus on the processes of the organization.

MF – You said, check through standard. Which standard?

KRS – ISO 9001:2008QMS Standard. This is the standard which provides requirements for quality management system.

MF – How to check?

KRS – The auditor should draw up a checklist with the relevant part of the ISO 9001:2008 QMS Standard and internal procedures of the organization. If an auditor is new for auditing work, then he should allow more time in his audit preparation.

MF – That’s right, but it may happen that an auditor may skimp on details, when he asks many questions to an auditee.

KRS – It is observed that a careless person may skimp on details and move from being objective to subjective. It is for the auditor to always seek out objective evidence. An auditor should always ask open questions.

MF – How?

KRS – Such questions that can provide objective evidence, such as, show me, how you do, what is it … The auditor should listen the reply of the auditee with patience, but he should not be deflected by a good talker. The auditor should be more careful if the auditee is a talkative person. While asking questions an internal auditor should remember 5W1H for asking open questions. 5W1H means what, where, who, why, when and how.

MF – This is a good suggestion to remember 5W1H.

KRS – Very true, if you ask any questions using any of the 5W1H, you will find answer in detail. No question can be replied with an answer yes or no, if you have used any of the 5W1H. It is seen that auditors generally ask closed questions because of time pressures. It will be good not to skimp on detail of time pressure. Auditor should record good and bad aspect.

MF – What you wish to emphasize? Good or bad aspects?

KRS – Good aspect is for conformity and bad aspect is for nonconformity. Conformity to standard’s requirements and/or organization’s established procedures will come under good aspects, and nonconformity to standard’s requirements and/or organization’s established procedures will come under bad aspects. An auditor should look for evidences in the manner things are being planned meets customer requirements, applicable legal requirements, standard’s requirements and organization’s own requirements. He should look for evidence that processes are being carried out in the manner they are planned.

MF – So, it is an objective of an auditor to look for objective evidences.

KRS – You are very right. It should also be an objective of an internal auditor to see that the process approach is effectively implemented in the organization and the organization is adhering to PDCA cycle.

MF – Good … Good, but what I feel that preparing an audit report is also an important work for an internal auditor. Many times it is observed that auditor’s report lacks content and traceability.

KRS – Yes, very true, you are. An auditor should not slip into the habit of vague generalizations, such as – ‘I have checked several processes/requirements and found compliance.’ He should list all areas, activities, procedures, standard’s requirements with relevant reference that he checked during audit process. If an auditor has raised any NCR or CAR, he should refer to and include its reference number in the audit report. The auditor should remember that someone, either MR or top management, will refer to his report and would like to retrace his steps. A value added internal audit is that is useful in helping the organization to achieve organization’s objectives and continually improve. A value added audit supports and encourages result-oriented systems. It helps to identify strong and weak points and focus on continual improvement in the organization. A value added internal audit gives confidence that QMS is implemented in the right spirit.

MF – Thanks, Mr. Singhal for the conversation.

KRS – Thanks.

Abbreviation used – CAR = Corrective Action Report, NCR = Nonconformity Report, MR = Management Representative, PDCA = Plan Do Check Act, QMS = Quality Management System