Print Version Lead Auditor Module

QMD02 Quality Systems Lead Auditor SLIDE 1 QMD02 Quality Systems Lead Auditor
Needs
About this unit This unit combines the learning outcomes required for the awards of: BSBAUD501B Initiate a quality audit BSBAUD503B Lead a quality audit BSBAUD504B Report on a quality audit The learning material for this unit is provided in 3 parts: Learning requirements for Auditing skills Learning requirements for interpretation of ISO 9001:2008 Managing an Audit Programme and Team. Topics covered This unit explores the performance outcomes, skills and knowledge required to lead an audit team as they undertake a quality audit. It comprises the skills and knowledge required for the Quality Management Systems Lead Auditing. The types of audit may include external or internal quality systems audit or process or product/service audit. Upon completion of this unit you will have obtained the skills, knowledge and competency to: Initiate a quality audit: Assess the scope and objectives of an audit Communicate with an auditee Identify resources required to conduct an audit Develop and submit a quality audit plan Lead a quality audit: Lead and conduct entry and exit meetings Identify and gather relevant information Manage audit team resources
Ph: 1800 222 140 QMD02 Quality Systems Lead Auditor (Issue 1) Fax: 1300 888 146 mailto: info@linemanagement.com.au Website http://www.linemanagement.com.au Line Management Pty Ltd Page 1 of 90
QMD02 Quality Systems Lead Auditor Provide performance feedback to audit team members Report on a quality audit Compile audit results Prepare an audit report for the auditee/client Negotiate follow up action Monitor and review auditing system and activities.
Needs
Following successful completion of this unit, students will have the qualification required to seek recognition with registered auditor bodies. Copyright notice Property of Line Management Pty Ltd. 2008. Instructions Please read through all the slides in this unit. Use navigation buttons either on top of the page or on the bottom to move on to the next slide. When links are available, it is important to follow them as they will contain more relevant information related to this unit. Please make sure you allow pop ups! You may view the slides as many times as you wish. The assessment will be at the end of the unit in the attachments (check upper right hand corner). Please complete all assessment tasks and e-mail to assess@linemanagement.com.au. Make sure to include your name, your student ID number and the name or code of the unit you are submitting. If you do not know your student ID number, please send an e-mail to the address below. It may take up to two weeks for your work to be assessed. If you have any questions, concerns, or suggestions, please e-mail studentsupport@linemanagement.com.au Prerequisite Successful completion of BSBAUD402B Mandatory reading ISO 9001:2008 Quality Management System - Requirements (Provided as part of student enrolment) AS/NZS ISO 19011:2003 Guidelines for quality and/or environmental management systems auditing
QMD02 Quality Systems Lead Auditor Recommended reading and reference:
Needs
AS/NZS ISO 9000:2006 Quality Management Systems - Fundamentals and vocabulary The Audit Skills Handbook; Mallen D and Collins C; Standards Australia; 1993 The Quality Toolbox second edition; Tague N.R.; ASQ Quality Press; 2005
Ph: 1800 222 140 QMD02 Quality Systems Lead Auditor (Issue 1) Fax: 1300 888 146 mailto: info@linemanagement.com.au Website http://www.linemanagement.com.au Line Management Pty Ltd
Page 3 of 90
QMD02 Quality Systems Lead Auditor SLIDE 2 SAFETY FOR ON-LINE LEARNERS
Needs
Safety for on-line learners There are many issues computer users need to be aware of. We will discuss some of them here. Prolonged exposure to any of the elements we will discuss may have serious consequences.
Source: http://www.westone.wa.gov.au/
Chair
Well-adjusted chairs will improve your body position, improve your blood circulation, reduce muscular effort and decrease pressure on your back. Chairs should: swivel, have five wheels for stability, use breathable fabric on the seat, have adjustable seat height and backrest for lumbar support. If your feet do not reach the floor use a footrest. Adjust the backrest to support your lower back. Posture
Change posture at frequent intervals to minimise fatigue. Take frequent short rests, rather than infrequent longer rests. Monitor Placed the monitor to the side of the light source, not directly underneath., in order to avoid reflections. Try not to put the monitor near a window. If this is unavoidable ensure that neither the monitor nor the operator faces the window. If the monitor is well away from windows, there are no other sources of bright light, and prolonged desk-work is the norm, use a low level of service light of 300 lux (lux is a unit of measurement for light). If there are strongly contrasting light levels then a moderate level of lighting of 400 to 500 lux may be desirable. High quality, anti-glare screens may be necessary. Eye strain Working constantly in front of the computer monitors can produce tired and sore eyes and eye strain if you're not careful. To reduce strain, take short rests and look into the middle distance. If necessary, close your eyes and lightly cover them with your hands, then breathe deeply eight or nine times.
QMD02 Quality Systems Lead Auditor Colourful posters and plants will also help provide relief from eye strain. Desk height
Needs
You should adjust the height of your work surface and/or your chair so that the work surface is approximately the length of a finger below the height of your elbow when you are seated. Hand exercises 1. Interlace your fingers with your palms facing outwards, then straighten your arms. Hold for 10 seconds and repeat several times. 2. Rest your forearms and turn your palms up and down. 3. Spread your fingers apart, then move them together again. Repeat this several times. 4.Touch your finger to your thumb and slide the fingertip to the base of your thumb. Repeat this process for each finger. 5.Bend your wrists to 90 degrees with your fingers straight, then slowly make a fist.
Page 5 of 90
QMD02 Quality Systems Lead Auditor SLIDE 3 PART I: Introduction to audits
Needs
What is an audit? Prior to exploring the process of preparing, carrying out and reporting upon an audit lets first examine what an audit is. The definition as extracted from 3.1 of AS/NZS ISO 19011:2003 Guidelines for quality and/or environmental management systems auditing is as follows: Audit is a systematic, independent and documented process for obtaining audit evidence(3.3) and evaluating it objectively to determine the extent to which the audit criteria (3.2) are fulfilled. Audits are tools to help an organisation review its processes, outcomes and activities. The outcome of an audit may result in any one or more of the following: A verification of compliance or non-compliance with a pre-determined criteria (e.g. standard, procedure, regulation, etc) Evaluation of effectiveness of process/activity being audited Areas identified requiring improvement Non-compliances highlighted for corrective action. In plain language, 'An audit is a tool used to check, assess, analyse or verify to determine compliance and or an opportunity for improvement.' So lets explore the different levels and types of audits typically utilised within a quality or management system. First party audit First party audit is an audit conducted entirely in-house of an organisation to assess or evaluate the effectiveness of activities and processes and/or compliance with documented procedures. Whilst the auditor in this case is usually an employee of the organisation being audited, often-times the auditor may be sub-contracted externally (i.e. a quality consultant) to conduct the 1st party audit on behalf of the organisation. Second party audit Second party audit is typically an audit of a supplier (or potential supplier) against a pre determined criteria that is usually commissioned by a customer. For example, many large mining companies commission an audit to be conducted upon a tendering supplier prior to the tender being accepted. This is ordinarily to provide the mining company confidence that the potential suppliers maintain systems to minimise, reduce or eliminate any risks that may adversely affect the mining company.
QMD02 Quality Systems Lead Auditor
Needs
The auditor in this instance may be an employee of the customer or a person who is subcontracted by the customer to conduct the audit on their behalf. Third party audit This audit is conducted by an independent registration or certification body to assess organisations compliance with a standard, legislation, regulation or other prescriptive criteria. A third party audit is required to be conducted by an independent body as it requires assessment for the potential granting of a registration or certification. For example a Quality Certification Body will audit to assess a companys compliance with ISO 9001:2008 for Certification against the Quality Management System standard. These three audit levels are also segmented into two categories, known as Internal and External audits. Internal First Party (In house audit conducted within an organisaton) Second Party requirements). External Third Party (Independent body audit of an organisation to assess compliance against criteria for potential registration or certification). (Customer audit of a suppliers ability to meet customers
Page 7 of 90
QMD02 Quality Systems Lead Auditor SLIDE 4 Audit types
Needs
While by no means is this list exhaustive of all of the types of audit, the types of audits listed here are the common audit types utilised within Quality. Process Audit Process Audit is used to review and evaluate and process, to confirm its effectiveness and/or compliance with documented procedures. This is type of audit is commonly an internal (or first party) audit and as such an auditor doesnt necessarily require the knowledge of standards or regulations, as it is normally assessed against internal documents. Often, particularly within the automotive manufacturers, a customer may conduct this type of audit within a supplier, where the customer may want to evaluate the effectiveness of the production process of a particular component. Management System Audit Also known as System, Compliance or Gap Analysis audit, this type of audit is conducted within a broader scope to that of a process audit, whereby an audit is carried out to assess an organisations (or part thereof) compliance with a standard or regulation. Usually these audits are conducted by a customer or an independent body. However, organisations often conduct these audits internally to ascertain the effectiveness of the organisations systems for the purpose of identifying problems and/or improvement opportunities. Document Review Document Review is typically a desk top assessment of documentation of an organisation (or part thereof). If conducted internally, the purpose is to determine whether the documentation, procedures and work instructions meet the needs of the business. If conducted by an independent body (third party audit), it is the first step of a certification assessment process. The independent body (usually a Certification Agency) carries out this review to assess whether the organisations documentation meets the requirements of the standard. Thus, the review provides a basis for the third party auditor to prepare an audit plan and checklist to carry out the proceeding steps of the certification assessment or audit. Product or Service Audit Product or Service Audit is usually called an Inspection. This type of audit or more appropriately named Inspection is usually conducted to check specific parameters of a product or service to ensure that it meets the pre-determined requirements. This is usually conducted by employees or customers of the organisation producing the product/delivering the service. Two examples of these may be
Needs
Quality Control Inspector visually inspecting the product to verify that the item physically meets the specification or A hotel receptionist asking brief questions of guests checking out regarding their satisfaction. Typically the results of the information extracted from these types of audits (inspections) are utilised to improve processes within an organisation. Assessment An assessment can be any one of the internal or external types of audits where the auditee may be seeking an award of some description. In other words, the organisation anticipates that the findings of the audit would result in the auditor giving them something. Examples of this may be ISO 9001:2008 Certification, one of many Excellence Awards, a contract - in the case of a customer auditing a supplier, etc.
Page 9 of 90
QMD02 Quality Systems Lead Auditor SLIDE 5 Effective Audits Auditing Principles So, how do we know whether the audit has been completed effectively?
Needs
Simply by adhering to the Auditing Principles contained within 'AS/NZS ISO 19011:2003 Guidelines for quality and/or environmental management systems auditing', which are as follows: So, how do we know whether the audit has been completed effectively? Ethical Conduct: the foundation of professionalism Trust, integrity, confidentiality and discretion are essential to auditing. Fair presentation: the obligation to report truthfully and accurately Audit findings, audit conclusions and audit reports reflect truthfully and accurately the audit activities. Significant obstacles encountered during the audit and unresolved diverging opinions between the audit team and the auditee are reported.
Due professional care: the application of diligence and judgement in auditing Auditors exercise care in accordance with the importance of the task they perform and the confidence placed in them by audit clients and other interested parties. Having the necessary competence is an important factor. Independence: the basis for the impartiality of the audit and objectivity of the audit conclusions Auditors are independent of the activity being audited and are free from bias and conflict of interest. Auditors maintain an objective state of mind throughout the audit process to ensure that the audit findings and conclusions will be based only on the audit evidence. Evidence-based approach: the rational method for reaching reliable and reproducible audit conclusions in a systematic audit process Audit evidence is verifiable. It is based on samples of the information available, since an audit is conducted during a finite period of time and with finite resources. The appropriate use of sampling is closely related to the confidence that can be placed in the audit conclusions.
Page 10 of 90
QMD02 Quality Systems Lead Auditor SLIDE 6 Audit Processes
Needs
Another consideration for the effectiveness of an audit is to ensure that all steps of an audit are carried out. Plan-Do-Check-Act The steps can be simply illustrated by applying the Plan-Do-Check-Act (PDCA) cycle of continuous improvement and as such is a useful tool when conducting audits to ensure that all steps have been carried out. Plan Preparing the audit Confirm and document audit plan, scope with audit team and auditee Reviewing the documentation being audited Preparing a checklist Check any previous audit results Do Perform the audit Entry Meeting Sampling documents and records Interviewing Asking questions Following processes Check Analyse your findings Check evidence Identify Non-conformances Act Report on findings and act on results Exit Meeting
QMD02 Quality Systems Lead Auditor Report your findings and raise corrective actions Notify auditee of subsequent audit requirements Inputs and outputs Inputs and Outputs
Needs
Another consideration that is important to observe during an audit is the following: 'To ensure that an audit is utilized as a valuable tool, one must always be certain of 2 things: The Inputs of the audit have been prepared and reviewed The audit results are communicated via a useful, tangible output' No exception. In other words; aside from the Interview or inspection stage of the audit, all audits must consist of Inputs and Outputs if they are to be an effective value-adding tool. To further define Inputs and Outputs as related to the auditing process: Inputs: The documents required during the Planning stage of the audit. Outputs: The report and/or corrective actions. Inputs PLAN Preparing the audit Procedures, Policies Documented Audit Plan. Checklist Criteria/standard Previous audit reports/corrective actions. Do/check
DO/CHECK
Performing the audit

QMD02 Quality Systems Lead Auditor Outputs ACT Report on findings Audit Report Documented Objective evidence or recommendations Corrective Action reports Updated subsequent Audit Plan or notification
Needs
Page 13 of 90
QMD02 Quality Systems Lead Auditor SLIDE 7 Initiate a quality audit
Needs
When preparing for an audit, you will need to ascertain the initial parameters of the audit first. Often the Lead Auditor will source copies of all necessary documentation and parameters. The initial parameters of an audit should consist of the following: The audit scope: the extent and boundaries of the audit. The audit scope generally includes a description of the physical locations, organisational units, activities, processes and or the criteria of the audit. Auditee details: the main persons of contact throughout the audit within the area of audit. You will need to obtain any necessary contact details, position titles and names of the people you will need to make contact with to confirm the scheduled audit. Auditee team: the team of people conducting the audit. You will need to select auditors according to their audit experience, areas of experience and background and necessary strengths required for the audit. Auditee team meeting: initial planning discussion with all audit team members. The Lead Auditor will lead the meeting/discussions required for the audit team members to prepare and plan their responsibilities throughout the audit. Typically the Lead Auditor will assign such responsibilities based on the skills and experience of each auditor. This is the information required to ensure you know what you will be auditing, where and with whom. What is an audit criteria? As defined in 3.2 of AS/NZS ISO 19011:2003: 'set of policies, procedures or requirements'. Put simply, the audit criteria is the set of requirements that the area being audited should be complying with. Requirements and control points are usually defined in policies, procedures, standards or regulations. As such these policies, procedures, standards or regulations form the criteria (or benchmark) with which the auditor is evaluating the area against. Policies and procedures may be used as audit criteria typically during internal audits. Through external audit often the audit criteria is based on a Management System standard. Some examples of Standards follow: ISO 9001: Quality Management Systems - Requirements ISO/TS 16949: Quality Management Systems - Particular requirements for the application of ISO 9001:2008 for automotive production and service part organizations.
Needs
ISO 14001: Environmental Management Systems - Specification with guidance for use. HACCP: Hazard Analysis Critical Control Point - Food manufacture. ISO 13485: Quality Systems - Medical devices. AS4360: Risk Management. AS4801: Occupational health and safety management systems - Specification with guidance for use SafetyMAP: Work Safe Victoria (Victorian WorkCover Authority. ACHS: Australian Council on Health Care. TGA: Therapeutic Goods Administration. The above examples are only a sample of some of the more commonly known standards; students may wish to visit S an nd da arrd ds sA Au us sttrra alliia a http://www.standardsaustralia.com.au/ Stta to further explore the standards available in their industries. Solo auditing or team? In some cases a Lead Auditor will require extra auditors to assist in the carrying out of an audit. This may be due to a number of reasons. For example: The audit may be lengthy and extra auditors may be included to reduce the time needed to complete the audit. There may be specific areas where expertise is required and so extra auditors with the specific expertise are required. For example, a lead auditor is required to audit a pharmaceutical company. If the Lead Auditors background in pharmaceuticals isnt very strong, an auditor with a background in chemistry may be sourced to assist in the audit. Auditor selection The scope and objectives of the audit will usually dictate the auditors required for the audit. Lead Auditor: The Lead Auditor is typically an auditor with extensive experience. Registered third party auditors must meet criteria as described in ISO 19011:2003. Selection of a Lead Auditor for an audit is typically done based on their auditing experience and area of expertise. Other auditors Other auditors are typically selected by complementing the Lead Auditors experience and background. For example, an audit may be required in a construction and engineering firm. The Lead Auditor was selected based on their extensive experience auditing constructions firms. The Lead Auditor was previously a Construction Manager for 10 years. However, the Lead Auditor doesnt have a background in Engineering, nor have they audited many
Needs
Engineering firms. So, another Auditor who is a qualified Engineer and has 15 years of experience in engineering is selected for the audit . The Lead Auditor and Auditor will complement each other with their backgrounds and experience and ensure that the auditee experience is a value-added audit. Audit team planning Following the selection of the audit team members; the next step is to determine roles and responsibilities of each member throughout the audit. Typically (although not always possible) the audit team will attend a meeting/discussion to develop an audit plan as doing this together ensures that roles and responsibilities of the audit team members are allocated at the same time and best use of audit time can be planned. Lead auditor roles and responsibilities The Lead Auditor is responsible for: Leading the team and deciding on allocation of audit activities Communicating with the auditee to confirm audit plans Monitoring the performance of auditors within the team Check for adequacy any checklists and other documented preparations of the audit team members Authorising the final report before being provided to the auditee Managing any conflicts between auditors and auditees Lead team meetings to discuss progress at regular intervals throughout the audit Decide upon any non-conformances or follow-up action required based on collated findings Conducting the entry and exit meetings Collating the findings of each auditor involved in the audit. Auditor roles and responsibilities All other auditors are responsible for: Participate in the planning of the audit Prepare for the audits
QMD02 Quality Systems Lead Auditor Submit checklists to the Lead Auditor for review of adequacy
Needs
Report findings and perceived non-conformances to the lead auditor within sufficient timeframes Provide any information requiring follow-up actions Attend and participate in team meetings to report on progress Conducting audit. Pre audit discussion In some cases a Lead Auditor or Audit Coordinator may have already carried this step out, in which case you wouldnt need to, except to obtain the information regarding the discussion from the Lead Auditor or Audit Coordinator. This is the step where the Lead Auditor makes contact with the auditee and/or relevant parties to confirm the requirement for an audit and arrange the following: Ascertain the audit history, organisational structure and organisational culture Time and date of the audit Confirm the scope of the audit Confirm the process or processes being reviewed Confirm roles and responsibilities of audit team members Confirm the availability of resources required to conduct the audit Confirm the audit criteria, i.e. standards, procedures, policies, etc Confirm agenda and attendees for entry and exit meetings Confirm details of other audit team members and their roles during the audit Ascertain any logistic or health and safety considerations; i.e. a special induction to enter the site, particular safety equipment required, etc. It is imperative that initial contact be made some time before the audit to confirm the details enabling the auditee to schedule it in. Quality audits in particular are not designed to be 'surprise' audits to catch people out. Allowing the auditee enough time to prepare or schedule it within their 'busy' schedule will go along way toward ensuring the auditee cooperates throughout the audit and happily provides the information you need. It should be noted that within Certification audits, the audits are required to be conducted within certain timeframes to comply with Certification rules. The quality audit plan
Needs
In order to provide an auditee with clear details of the plan for the audit, Lead auditors are required to provide an auditee with a documented quality audit plan. This plan should include a schedule of future planned audits and also consist of documented details of the list of items listed in Pre audit discussion. The Audit plan may vary after each audit is conducted due to new findings resulting in changed priorities for audit requirements. An audit report will require a note of further audit requirements, which in turn advises the auditee of the forthcoming change to the audit plan. We will explore this further in Audit Reporting. The Document Review will provide a clearer picture of audit requirements and is beneficial to prepare and submit to the auditee with the audit plan after the Document Review has been completed. Document review The auditor will need to review any documents pertaining to the scope of the audit. The auditor will need to obtain them from either the auditee or the audit coordinator. These documents may include the following documents: Procedures Policies Standard Operating Procedures Details of previous corrective actions Details of previous audits results. So how do we review the documentation? The aim of the review is: To obtain an understanding of the activities or process youre about to audit and determining which parts of the documentation applies to the audit. To ascertain whether the documented system meets the requirements of the standard to determine when to plan the initial audit. Examples Examples of what to look for during an document review: We can go through these documents and identify with highlighter which parts indicate a requirement, e.g. if our targeted area for audit was calibration of scales, there might be a requirement for a check every 6 months.
Needs
There might also be a requirement to record these results into a log book. The existing procedure states that the results should have been within 5 grams of the target. Immediately we have a query about what the results have been at the last couple of checks and what was done if they failed. Further examination may reveal that the tolerance is tighter than is needed for this type of product but the same tolerance was used everywhere for simplicity, making it difficult to meet the requirements. We as auditors can at least assist our business by reporting this for consideration by the author of the procedure. In the case of a system audit, the auditor is required to check whether the documented requirements, as described in the Management System Standard, are complied with in the organisations documented system.
Page 19 of 90
QMD02 Quality Systems Lead Auditor SLIDE 8 Audit Checklist What is an Audit Checklist?
Needs
Put simply, its a checklist for auditors to utilise throughout the audit to ensure that they have covered all of the items they need to in order to form a sound analysis and report. Consider this: Similar to a grocery shopping list: Many of us would enter the grocery store with a list of items we need to purchase so that we dont forget them. Most of us check our list before we head to the check-out to confirm that we have all the items we needed in the store. While a checklist is a memory tool, it may not be followed to the letter. In fact, it is encouraged that the checklist be used only as a guide. Sticking to the checklist may prevent an auditor from further exploring audit trails that they may otherwise have not have known about until they started interviewing. Well discuss audit trails further on in this unit. Consider this: Many of us, while in the grocery store, spot special offers and great deals on items that are not on our shopping list and we place in the shopping basket anyway. Before we head to the check-out we still check our list to ensure we have everything we came for, even though we've got more than what the list contained. We may have even found a cheaper or better quality alternative to an item we had on our list. Prior to going to the grocery store, we may have been at home preparing our shopping list. You may have simply listed the types of food you required which enabled you to be flexible about the brands, sizes, flavours, etc that you picked up at the store, i.e. yogurt was on your list, which left you with the flexibility at the store to select Yoplait, Brownes, Nestle, Strawberry, Vanilla, single tubs, large family tubs, and so on. Whatever you do select, you will confirm before going to the checkout that you indeed have yogurt in your shopping basket. As mentioned previously, your Audit Checklist is a memory tool or in some cases a ';map' of the audit you are preparing to perform. So what sorts of items could your checklist include? A marked up copy of relevant procedure(s) Listed key points Flowcharts Check sheet or table List of questions.
Needs
Lets further explore the different types of Audit Checklists that may be prepared for your audit. Copy of procedure This type of checklist is common and requires the auditor to highlight key points or steps in the procedure and write questions the auditor plans to ask. The benefit of this type of checklist is that all of the steps of a particular process is often contained within the one document and as such provides a simple overview for the auditor to continue to check back on. One of the challenges often faced with this type of checklist is when an auditor doesnt exhibit flexibility with the written word within the procedure and doesnt consider the possibility of the procedure being incorrect or no longer applicable to the area being audited. Key Points/Control Points Every specification, regulation, flow chart or procedure contains key points or control points. These are specific statements or parameters identifying one or more of the following: Responsibility Test limits Process control limits Methods Frequency Record. To develop a measure of the effectiveness of the area being audited these points of data must be first sifted through from the many words that surround them. For example; 'Daily microbiological reports delivered to the laboratory and are attached to the batch cards they relate to. The Technical Manager must review and sign off on the daily microbiological test reports to indicate they meet specified requirements and no recall action is required.' The key information that you can audit when you get to the laboratory is that: Only the Technical Manager can sign off, so find out who this is.
Page 21 of 90
Needs
Micro results are received daily, so at least one for each day should be available for review, but you might find out later that hundreds are received daily. Have the all been signed? Where would the Technical Manager find the specified requirements to check against? The ability to 'pick out' key requirements from documents is one of the primary skills that successful auditors must possess, as auditors may come across many documents throughout an audit of which an overview of the requirements needs to be promptly drawn. Flowcharts One way to think of flow charts is to consider a map or picture that illustrates the 'direction' a process takes and the key points required before moving through the next part of the flowchart. An auditor may prepare a flowchart checklist in one of two ways: Mark up a copy of a procedural flowchart that the auditee has in place. Similar to the earlier two checklist types, the auditor can highlight key points and write questions within the copy. Draw up a flowchart of the process you have identified after having read the procedure, enabling you a 'mental picture' of the order questions you may ask to achieve a flow of information you obtain during the audit. Checksheet This type of checklist is often used to confirm that specific parameters have indeed been met throughout a process. It usually contains a list of requirements in one column and a column for ticking whether the requirement has been met. An example of where this type of checklist may be used is in the case of a Safety Hazard Audit (or Job Safety Analysis), the questions within the check sheet may be something along the lines of: Are isolations in place and proven effective? Are the appropriate MSDS available at point of use? Are tools and equipment in good condition and correct for the task? Have the correct permits/clearances been obtained? Can the job proceed safely? This type of audit checklist is better suited to 'inspection' type audits as they typically require a confirmation that something has or has not occurred.
Page 22 of 90
Needs
This type of check list would probably not be suitable for process audits that require the auditor to investigate the effectiveness of the process. List of questions Auditors may simply list the questions they wish to ask during the audit to confirm compliance or investigate effectiveness. The type of checklist that would work best for you is entirely up to you (or the Lead Auditor in the case of an audit team). Auditors select the type they are most comfortable with, ensuring they will cover all the bases. Your preferred type may be a selection of all of the above. Whatever your preference all checklists should allow for: Checking compliance with key points/control points The flexibility to follow audit trails not previously anticipated The ability to measure the effectiveness of the process(es) Ensuring good time management of the audit Ensuring your audit stays within its scope. Are you ready to perform the audit? Lets check if you are ready. Have you: Confirmed and documented the audit plan with the auditee Allocated audit team roles and responsibilities where required Discussed arrangements with all relevant parties; i.e. auditee, audit team Obtained copies of necessary audit forms Obtained a copy of the relevant procedures Confirmed the Audit Criteria Performed a Document Review Prepared an Audit Checklist. If you have ticked all eight steps, you are now ready to perform the audit.
QMD02 Quality Systems Lead Auditor SLIDE 9 Preparing the audit So you have prepared your audit and now youre ready to go.
Needs
You need to consider following before you commence the audit. It is important that you have your techniques planned prior to commencing your audit to enable fair evaluation between findings and criteria. In the case of more than one auditor conducting the audit (Audit team), it is important to consult with the team to determine and agree upon the appropriate methods and techniques that will be used. At the beginning of this unit we touched on the Audit principles. Adherence to these principles is a prerequisite for all auditors to ensure the integrity of the audit process and outcomes. Please click on the bars below for further information. Audit as a tool Lets further explore a statement made at the beginning of this presentation: 'An audit is a tool used to check, assess, analyse or verify to determine compliance and or an opportunity for improvement.' Lets consider an example of another tool for a moment: A medical practitioner relies on a number of tools to diagnose a persons illness; stethoscope, tongue depressors, thermometers and so on. However; almost every time you visit a doctor they will ask you what has been troubling you. From your explanation they are able to determine which tools they will need to diagnose your illness. Similarly, during your audit planning and preparation you may have been able to determine which audit approach to take to evaluate the processes you will be auditing. The wrong approach Some people think that an audit is a process of finding out whats going wrong or faultfinding. Consider what would happen if you took this approach during an audit. Humans by nature feel uncomfortable when theyre being tested or observed, even more so if they feel the observation is intended to 'catch them out.' Typically when an audit is approached as a fault-finding exercise, the audit outcome can be quite destructive and stressful for all parties.
Page 24 of 90

Auditor Is not feeling welcomed at the place of audit. Auditee Puts up a guard and doesnt offer information. Result
Needs
The audit is not embraced as a useful exercise to highlight opportunities for improvement.
May lose the respect of work colleagues.
Impression of the entire audit as a negative tool, with no benefit but to waste time and energy.
Auditees go into defense mode for any Corrective Actions raised and as such may dispute the findings. Conflict would almost always be a result of this approach to audit.
Can feel quite demoralized as they feel they are the watchdog thats out to catch everyone out.
May feel of little value to the organization if they take the results on board personally. May feel victimized.
Does not trust the auditee, continually feels as if the auditee is hiding something.
Does not trust the auditor. Feel as though they must hide things.
The audit result may not reflect the true state of the processes as items may have been missed or hidden.
When we approach an audit as a tool for improvement or verification of effectiveness we seek to verify that the system has all the required integrity it needs. We look for the necessary evidence, both objective and subjective, that will demonstrated consistent and thorough implementation and effectiveness of the system. Remember in most internal audit scenarios both the auditor and the auditee work for the same company and are on the 'same side.' It would be perfectly ok to remind the auditee of this fact so as to put them at ease.
Page 25 of 90
Needs
Auditor Auditor is learning a lot about the processes and varied approaches to a task. Is appreciated by the auditees for being of great value to the processes and the organization. Feels of value to the organization for assisting to raise opportunities for improvement.
Auditee Tries to offer as much information as possible to assist the auditor in their findings. Is excited about the improvement ideas and suggestions raised to improve their process outcomes. May feel of little value to the organization if they take the results on board personally. May feel victimized.
Result The audit is not embraced as a useful exercise to highlight opportunities for improvement. The organization takes the suggestions on board for consideration.
Positive change may be implemented which may reduce costs, increase productivity, increase morale, increase revenue, increase job satisfaction, etc. The report reinforces effectiveness and highlights where they could do even better.
Increasing their positive audit skills as the approach is reinforced by the positive auditee reaction and audit outcomes.
Requests audits as a tool for evaluating their processes.
SLIDE 10 Doing the audit Here are some important considerations when performing the audit. Entry Meetings In all Second party and Third Party Audits, an Entry Meeting is required at the commencement of your visit to the auditee site. The purpose of this meeting is to give all interested parties an opportunity to confirm details and/or ask questions relating to the process. The meeting may be small (consisting of a couple of Managers) or large (consisting of 20 or more people). Typically its attended by Managers and/or Supervisors representing the areas being audited as it also provides the opportunity to meet these people where you may have not already done so.
QMD02 Quality Systems Lead Auditor The following items should be covered in most Entry Meetings:
Needs
Advise on what to expect throughout the audit and the techniques and approaches that may be used by the auditors Confirm the audit schedule Confirm objectives and scope of the audit Confirm logistical arrangements, such as meal times, amenities, transport requirements, visitor and OHS requirements, etc Estimate frequencies for progress updates Make any changes to plans, schedules and arrangements where necessary Obtain summaries from the respective Managers regarding any changes or developments within the business that may be relevant to the audit Obtain any initial and/or sample documentation required to commence the audit Identify a range of potential sources of information to seek during the audit Book specific times with auditee members for interviews. TIP: Some auditees may be inclined to delay this process to reduce the available auditing time. Be aware of this and manage time wasting to ensure the Entry Meeting meets its intent and is an effective use of time. Set the scene When you arrive at the place of audit, its important to 'set the scene'. Simply put this is just a very brief overview on what you anticipate doing through your audit. This step is important to put the auditee/s at ease and to create an experience of openness. An example may be: 'Im here to have a look at the bar service process to observe its effectiveness in serving beverages to patrons. I may ask some questions and look at records. This is just to obtain a better understanding of how things are done. I may take notes from time-to-time. This is to ensure my memory doesnt fail me when it comes time to summarise my findings. Please feel free to query the direction of my questions at any time as this may help us to save time. I am required to collate a report of my findings at the end of the audit, but I will provide a verbal summary at the end of the audit, so the report shouldnt raise any surprises. Is there anything you would like to know before I get started?'
QMD02 Quality Systems Lead Auditor Tip
Needs
Count the amount of times the word 'you' is used in the previous example. Be wary of your use of the 'you' when asking questions or making statements throughout the audit. If it is used too much it can make the auditee feel as if youre there to check on them. Alternatively use words such as process, organisation, system or 'the' when talking about a system or process. When 'you' is replaced by 'the' it changes the ownership of the system or process to avoid making the auditee feel as if you are checking on them. Further, setting the scene is an opportunity for you to obtain an overview of the process from the auditee, which will form a good place to start your questions. 'Id like to get an overview of the process before I get started. Would you explain it to me?' Another consideration Another consideration for putting the auditee at ease is to touch on something other than the audit. Use small talk to break the ice. Perhaps you can discuss the footy results, the weather or the holiday you recently took. Just steer clear of gossip or innuendo as this is in conflict with the audit principles of professionalism and integrity. While an auditor must maintain professionalism, a sense of humour can make the audit more enjoyable. An auditor with a sense of humour is usually welcomed back by any auditee. Remember, though, to leave the stand up comedy to the stand-up comedians. Auditing techniques Time management It is important throughout the audit to manage your time well. Arrive on time and dont take longer than originally scheduled. Remember the auditees are busy and have to carry on with their normal day job. Therefore if they see the audit as a long winded process that goes too long, they may not be happy to welcome you back for future audits. If you dont get to cover everything in the allocated time it is usually preferred by the auditee to re-schedule another time for when you can return to finish it. Techniques There are a variety of techniques you can adopt throughout your audit. Auditors typically pick the one or a combination of a few techniques they are comfortable with and are confident will assist them in the type of audit they are conducting. We will explore a few techniques to consider here.
Page 28 of 90
QMD02 Quality Systems Lead Auditor Conduct interviews
Needs
Interviewing during the audit is often made far more formal than it needs to be. The auditor tries to find faults and destroys the auditees well-versed excuses. As we discussed previously in the audit approach, this is not effective at all . The best interview is an informal session intended for the auditee to gather some information to understand the processes and parameters of the system and review any relevant documentation. This technique is usually used by the auditor to metaphorically draw a picture of the system in their mind and confirm issues from their document review in order for them to decide where to go or what to look at throughout the audit. Listening It is generally considered that it pays to listen twice as much as we talk. It is important that we know the process from start to finish. If we ask too many questions of input our perspective we might affect the way the auditor actually describes it. It is better to let the auditee use their own words to begin with and then use questioning to clarify areas later. Note-taking Making notes as the auditee is walking you through the system or demonstrating a particular item is a useful way of ensuring an accurate impression is obtained. In order to make the audit thorough note taking will be vital to the auditor for ensuring that all areas are covered and all queries are eventually answered. Questioning It is unlikely that everything you have read and established from a desktop review will flow smoothly from the auditee and it is certain that questions will be required. These can act as a prompt to jog memories or to direct the conversation to a particular aspect of the system not mentioned or unclear. Certain types of questions can be used effectively in different situations: Closed Questions Open Questions Directed Questions Open questions can be general in nature and invite the auditee to explain whatever they can: Would you explain how you test this product? How could a problem occur in raw material receipt? Closed questions invite confirmation of a fact: What you are saying is that the Purchasing Manager reviews all the requisitions? Tape would only be bought from 3M?
Needs
Directed questions would relate to a particular topic and might be used to further guide the auditee to the answer you might expect to hear based on the desktop review or earlier audits: Could you show me how the department is structured? Where would this aspect be controlled in the system? Remember the auditee should be given every opportunity to demonstrate an awareness of the aspect you are looking for, even if this results in 'Do you know that ISO 9001 requires a record of this check?' perhaps followed by, 'Can you show me where this requirement is controlled within the system?' More techniques Observation Many clues to things being not quite as they seem are available to the watchful auditor. The auditee may be giving the best and most accurate description of their system, but physical evidence within your range of vision may lead to a question which leads to the conclusion that the system is allowing a problem not covered in the procedures. Previously we discussed the importance of the audit maintaining a positive approach and not one of a fault-finding exercise. Your observation and vision can alert you to any problems that may be present. Continuing to maintain a positive and open audit allows you stumble upon any issues that are of concern. For example: As the supervisor of a particular section of the plant walks you through the process he describes when the product is tested and found to be faulty it is put aside for later rework. As you pass through the process line you note some product on a bench waiting for dispatch. Review of records for this product shows it was considered faulty on testing but has accidentally been allocated to a customer. You note there is no system for identifying this material. Without first noticing that material you could not have then asked about it and thus test the system that authorized the continued use. Process Flows/Audit Trails Related to the previous example scenario, another technique for audit is to follow the process flow or Audit Trail. This would require the auditor to determine the start, finish and deviation points of a process and follow it through to verify control points and the documented procedures as well as observe any suggestions for improving outcomes of the control points in process flows. This kind of technique works very well in a lot of activities and industries, particularly however, it works well in manufacturing environments where there is a tangible process of making something. Following the Audit Trail is also very effective in assessing the reliability of a system in delivering outcomes. In this approach an order, a job, a service, or record is tracked
Needs
through the process chain from beginning to end. An example of this may be in a Purchasing department. You can commence with the incoming request for purchase and follow it right through the order process until the actual purchased goods arrived and are checked that theyre fit for purpose. Risk focus Another technique to consider during your audit is assessing or analysing the risk that can occur if activities do not occur as the procedure states or control points are not adhered to or records are not maintained. This technique lends itself to ensuring the right approach to an audit rather than 'jumping up and down' when you observe an issue that has not complied with the procedure. The auditor can think about whether the step is necessary in the first place. If its not necessary the auditor can simply note it down for a suggestion of procedure change or if it is necessary then the auditor can point it out to the auditee and justify the finding by alerting them to the risk. Either way, this technique is very useful in ensuring the auditor doesnt make any enemies. This technique also lends itself to enabling the auditor to consider alternatives rather than keeping 'the blinkers off' and focusing just on what the procedure states.
Page 31 of 90
QMD02 Quality Systems Lead Auditor SLIDE 11 Records Review Review of records is a very important part of any audit.
Needs
There are a number of techniques good auditors use to speed up this often quite tedious process. We will consider some of them next. Reading documents During the audit process you are going to be presented with various forms of written evidence supporting the systems ability to maintain control. It is an important skill to be able to examine and read these documents quickly and effectively. Often you must do this while the auditee is talking. Do not be afraid to use the auditee to help you establish the purpose of the documents and to grab and carry specific records for which you might ask. Asking for help in finding information is a way of controlling the flow of the audit and slowing down the input of your enthusiastic and informative auditee. Sampling records When sampling records you can maximise the likelihood of finding significant issues by choosing a sample based on information you already have. For example: You might be aware that your companys biggest client buys a certain type of product. As the biggest client, the risk of financial problems would be high if they became dissatisfied with quality. It might make sense to select some test results on this product to ensure they are within specification, and if not you can confirm that the defined action has been taken. Specialist assistance In some circumstances a specialist may be required to assist in the audit. Typically this may be required when the auditors background and/or qualifications dont allow them to fully understand the parameters of an audit. For example: An auditor whose background is mechanical engineering may be conducting an audit within a chemical laboratory. The auditor may not be able to grasp the parameters of the processes and may call upon a specialist to attend or advise. Example two: Only one of your customers has a requirement specification imposed on the business. It would be sensible to establish that it has been incorporated at relevant levels of the business and that the records on the line again demonstrate that levels are being maintained.
Page 32 of 90
Needs
Example three: You know that line three has a new operator and it increases the risk of them not following procedure due to lack of experience. Check records from that persons shift to ensure no errors occurred. Examples two and three are describing the ability to look for events that are unusual. The customer specific requirement, change in staff, or any other change such as materials change, new product, or equipment change/modification should all be accommodated in the system. By asking the questions in these areas the integrity of the system and its ability to cope with change is ensured. Summary The amount of sample depends upon the point at which the auditor feels confident they are obtaining a true picture of results. Example four: You may be auditing purchase orders and the procedure states that the request for purchase must be signed by the relevant authority for all requests above $1000. After looking at ten purchase orders within the last week you notice only one of them wasnt signed. You might conclude that usually they are signed. Alternatively, the auditor may look at five orders per week for the past three weeks and find that they were all signed for the first week, but not for the latest two weeks. This may encourage the auditor to further evaluate this issue. Upon investigation they may find that a new purchasing clerk started two weeks ago and the Purchasing Manager has been too busy to train the clerk and the clerk wasnt aware of the requirement for the orders to be signed. Records The previous method of looking for new or unusual items is a way for auditor to find the only bad record out of hundreds they could have looked at. It is a skill that any auditor can learn very quickly. First you need to establish with the auditee what the normal process is, who is responsible, how it fits together and what the identified control points are. Once these two are established you can take your sample, preferably directed again to an area of significant importance as defined by the organisations goals or business plan. Taking a bundle (e.g. twenty or so) you should be able to quickly glance at each one looking at: Signature - Is this the person or one of the people authorised to sign off? Test results - Do the results fall within the required range and if not what happened? Amendments - Has the record been altered in any way? Has something been crossed out or added without an authorised initial? If the record is a requisition of order are there any items which appear unusual or poorly described? Are specifications and limits clearly indicated if appropriate?
QMD02 Quality Systems Lead Auditor SLIDE 12 Finishing Up The audits done and all that remains is to write the report, right? You can pack up your notes and leave the auditee, right? WRONG! Finishing up
Needs
You would never let a property valuer enter your home, have a look around and then leave without providing you with any feedback on the price they think you could sell your house for, so you shouldn't leave the audit without completing the following. The auditee/s will be extremely anxious to hear how it all went, what your perception is, feedback on their processes and activities, what the findings are and most importantly, whats going to happen next. Its important for an auditor to provide a brief verbal summary of how the audit went. It certainly wouldnt cover every detail that would be written in your report, but at least ensures the auditee will be able to sleep that night (particularly if you are unable to finish the written report for a few days)! It also provides the opportunity to ensure that the auditee understands correctly before we put it in writing in the report. Verbal summary In Second and Third Party audits, this may take place in the form of informal progress meetings or at the completion of the audit; an Exit Meeting. Unless its a formal Exit Meeting, the following must be summarised to put all interested parties at ease. What we did What we found, including patterns, trends, interrelationships and areas of risk that has assisted in you in arriving at your findings Issues they may need to address Recommendations you will be making. Most importantly, remember that nothing in your report should be a surprise to the auditor. You do not need to run a half day presentation on how the audit went. Think of it as just letting them taste the flavours of the ice-cream youve picked - some they wont like and some they will - but when the report comes everything they tasted will be there - and no more.
Needs
It is perfectly OK to contact the auditee at a later date (prior to submitting your report) to notify of something you may have forgotten to raise in the close out summary. Exit meeting Similar in purpose to the verbal summary, an Exit Meeting may be planned and carried out to formally inform all or any interested parties in the audit outcomes and findings. It is often used for a lengthy audit in a large organisation, or after a team of auditors collate their findings to present the final outcomes to the auditee/s. This meeting may consist of any person in the auditees organisation, regardless of whether they were directly involved in the audit or not and also consist of all audit team members in the cases of an audit being conducted by numerous auditors. Again, preparation is vital in this meeting, particularly if there is an audit team who has had to collate their results. This meeting may be held before or after the completion of the audit report, so long as there has been sufficient time for the information to be collated and analysed in order to report it at the meeting. An agenda is typically formulated and distributed to the attendees and usually consists of the following items: An overview of what the audit covered (the scope, procedures, criteria and so on) An overview of what took place What the findings were, including any non-conformances Your recommendations Any follow up activities you may need to schedule When they can expect to receive the report if it hasnt already been written. SLIDE 13 Dealing With Conflict Conflict during an audit Unfortunately, things dont always run smoothly or go according to plan, so its important to discuss some of the common things that may go wrong and strategies for dealing with them. Before we list some of the common things that go wrong, bear this in mind at all times when auditing: 'Change what you can change and accept what you cant change!' Here are some common issues that may arise during the audit.
QMD02 Quality Systems Lead Auditor Urgent matters
Needs
Occasionally, an audit will be about to commence or worse mid-way through and the auditee will get a call from a customer or an employee that must absolutely see them right now to deal with a problem. If something is wrong, you may be able to utilise your observation to identify a potential problem. Ask if it would be alright to tag along. After all, you are auditing the process. The auditee may do one of three things: Agree and you will be able to observe the issue The auditee may be reluctant for you to observe the issue and may delegate someone else to the issue or the audit. Either way the audit carries on. Flatly refuse and asks to abort or re-schedule the audit. Postponement You may come across the following scenario: Each time it gets close to the day you are to do the audit, the auditee postpones it. You become concerned that something may be wrong and the auditee doesnt want you to see it. You can't change what you can't change! Youre not about to burst in there and say 'Ready or not, here I come'. If it does get out of hand, you could bring to auditee's attention that the audit has been postponed for the fourth time and that you may have to write a report to indicate that the audit was unable to go ahead after the fourth re-schedule. The auditee may suddenly be pleased for you to come in, if it means that their senior management may find out that they have been elusive. Also, consider perhaps that the auditee is indeed busy and offer to re-schedule at another time. Auditee refuses information This could be in the form of either refusing to bring the correct records to you, taking you into an area you would like to observe or simply wont answer you correctly. Perhaps they are going off in tangents with their answers or beating around the bush or simply lying. In this case, you could abort audit and seek to re-schedule with a different auditee and report upon the incident within the audit report. Time As an auditor, you may occasionally get a feeling that an auditee is wasting your time. They may talk at length about the process when you clearly already have enough information. The auditee may babble on at lengths about something completely unrelated,
Needs
or the they may take too long to provide information. Keep in mind that an auditee may or may not be doing it deliberately and its important not to jump to the conclusion that they are doing it on purpose. You can use techniques to speed things up a bit. For example: 'Tony, could just go back to step four in your procedure?' 'We have only one hour to get this audit completed. Would you mind if we carried on with the audit and talk about the golf at the end?' If time wasting persist, you may consider aborting the audit and re-scheduling it for another time .You may be in a situation where you can select a different auditee next time around. Phone calls Some job roles require people to spend a lot of time on the phone. As an auditor, you need to bear in mind they have to fulfil their duties. If it does impinge on the quality of the audit, perhaps suggest that the audit be rescheduled for another less busy time.
Page 37 of 90
QMD02 Quality Systems Lead Auditor SLIDE 14 The Audit Report
Needs
The audit report is the output of the audit. The document that provides the information about the findings and the conclusion of what the results mean. Its the mechanism with which the official communication of the audit is done. It provides the necessary data and guidance upon which decisions can be made regarding the process or activity that was audited. Report content A good report should contain: Who performed the audit - we might, as management, want to ask for clarification of detail. External authorities might want to establish the credibility or independence of the auditor. When the audit was conducted - we need to fix it in time so we can tell later whether improvements or incidents that occur later were as a result of changes we made. What was covered, the scope of the audit - where did we start and finish, what did we cover and what did we not get time to do. We need to avoid duplication of effort, but we also need to ensure our audits are comprehensive and cover all the areas of risk. A summary of findings - this allows readers to quickly assimilate the impact of the report, were any issues raised, how severe is the risk if there were, do we have to take action now? The summary should identify particularly successful areas of the system that could act as a guide to other areas. Included in the summary of findings should be details of criteria where areas of the organisation did or did not comply. I.e. The procedure did not sufficiently meet the requirements described in 7.2.3 of ISO 9001:2008. Copies of Corrective Actions - The original of whatever corrective action form is in use might need to be re-examined to establish the detail of the finding, who has accepted responsibility to keep it under control or to fix it, and when is the fix required. Often a pro-forma report is available electronically or in paper form, which then provides for a consistent format. The exact structure or appearance is unimportant as long as it allows the recording of the information above. However, in the case of an audit to ascertain an auditee compliance with a standard or specified requirements, it is recommended that the audit report be formatted to clearly indicate the findings against each requirement within the standard or specification. Most of the Certification Bodies audit report are formatted in Management Standard sections as indicated in the standards. Action reports Action reports have many titles: Corrective Action Reports, Opportunities for Improvement, Improvement Notes, Observation Reports, Non-conformance Notes etc. They all provide the same service and only the acceptance of the organisations culture dictates the title.
Page 38 of 90
Needs
They are a way of recording and communicating a specific instance or concern which has been identified as a threat to the business or the public. Typically, they contain references to the location the incident was found (WHERE), who found it (WHO), perhaps a description of the cause (WHY) if known, (WHAT) what exactly was found and a date to mark the time it was noted (WHEN). Another major ingredient is the risk it is believed to present. In many organisations they use grading such as Major, Minor and Observation as a way of indicating this, but this type of definition needs further definition of its own so that everyone has the same understanding. Grading is covered a little later so lets walk through a typical CAR and identify the components and the reason they exist. Corrective Action Report Number Every action raised should have a unique reference number that everyone can use to trace the problem and subsequent investigation. Everyone concerned will know they are talking about the same and not similar incidents. Raised By It is important that the person responsible for identifying the concern should be known so that they can more clearly explain the problem if required. They can also lead other parties to the evidence of the concern more quickly as they have the experience of how they located it. It also enables analysis of the effectiveness of the auditors to be reviewed, the qualification of the auditor to be established (for external auditors) and it makes the CAR itself an auditable record. Agreed By Auditee Management To avoid any conflict the person Management Representative for the area/company under audit should accept the finding at the time it is identified. This allows them to be warned early of the threat to their system and it allows them to question the finding and obtain satisfaction that it is in fact a threat. This is a potential area for severe disagreement, and the auditor must be able to provide adequate evidence of the concern or they are likely to leave the Departmental Head unsupportive of the need to change, thus it is unlikely to change. Area/ref: This section provides a reference point to the physical area in which the incident was noted. The reference might be to an audit report number or other document leading to the raising of the CAR e.g. It is possible to use CARs as a method of ensuring action is taken after meetings. Date This fixes the incident to a point in time. We can then see if the condition recurs, and we can set a period of time for corrective and preventive actions to happen within.
QMD02 Quality Systems Lead Auditor Problem identified
Needs
This is the description of what exactly was found, why it is perceived to be a problem, and what was the non-conformance against. In order to be a non-compliance the incident must be in violation of the plan. Remember, the plan contains the legislative and customer specified requirements as well as the companies own methods of ensuring success. Ensuring information is complete So how can we ensure that this description contains enough to capture what we saw or found? One way is to use the mnemonic, or a similar one of your own, shown on the bottom of the CAR form: Problem identified Evidence to support the concern Scale or severity - risk Time or urgency of response needed We all know that raising Non-conformances or Corrective Action Requests is a PEST, but these letters enable us to ensure a complete description that will be useful in future action. These critical ingredients of a good Corrective Action Form are explained as follows: Problem identified: Simply means what exactly did you see or find. This is best expressed in your own words rather than a technical style script and if the form doesnt provide enough space then use the back or an attached piece of paper. The important thing is to make it as comprehensive as time allows e.g. The records reviewed showed that the blenders on line three mixing plant were running outside the tolerances during the night shift throughout week 15. Procedure 9 revision 1 states the required tolerances. Evidence: No case was ever established without evidence. Without it, a statement is just that, and becomes only opinion. No CAR should be raised because the auditor thought it would be a good idea, only because his knowledge and experience was able to enable him to demonstrate which part of the regulation, specification, procedure or plan the concern is in breach of. Examples of the evidence should be quoted e.g. Evidence of the out of tolerance blender was established from batch cards 29,34,38, and 45, all dated during week 15. Scale: The scale of the problem determines an element of risk. If the scale of the concern is large this indicates a potentially widespread weakness in the system, the problem has occurred often and thus the system is ineffective in keeping it under control. If the scale is small, however this may not mean the problem is small, only that it has occurred infrequently, if it is also of low risk then the urgency to fix is reduced e.g. From a
Needs
sample of 30 night shift batch cards 10 were noted to have no evidence of the checking of blender speed. This sounds as if the system only worked two-thirds of the time. Or of the 10 batch cards only one was for a product that was high risk for inadequate mixing. This sounds less severe but because of the nature of the problem might still warrant urgent investigation. Time: Time on a corrective action is critical. It governs the effect it has and controls the way in which we treat the concern. All of the other areas of Problem, Evidence and Scale lead only to the determination of how much time we should allow to investigate the issue. As auditors we should attempt to make certain we identify the real cause of the problem rather than the symptoms in order to establish how quickly we need to fix it. Action taken: At the time of the finding it was probably appropriate to establish some form of action to immediately correct the problem e.g.. If the speed controller was not being used then it could be immediately put in place, and previous product could be quarantined pending investigation or rework. This would hopefully remove the immediate threat. The section supervisor or section head rather than the auditor often fill out this section, as it generally requires local responsibility, they sign to indicate that the responsibility for action has been accepted. Action to prevent recurrence: This aspect may take a little longer to resolve. The real reason the problem occurred might not be easily identified during the audit and may require some or even extensive investigation to locate. Once located, the action taken should be sufficient to fix it for good, not just for the immediate future. Most problems are usually due to: Inappropriate requirement specified by the company itself, where a control that is too restrictive has been applied but has no reason to be applied in that way. The cure is to eliminate the requirement or respecify it to a more manageable level. Training of personnel was inadequate or incomplete. The surest cure is to complete, repeat or restructure the training to make it more effective. Available instructions - the procedure or associated information was inadequate to control the risk. The cure is to rewrite the procedure to cover the missing link and then retrain staff to understand the change. Follow up findings: There is no certainty that the well thought out corrective and preventive action you decided upon has in fact cured the problem identified. The only true test is that of TIME. You cannot just assume that the problem has gone away because something was done. You have only increased the probability that it has gone, but can you see all the factors? In reality, you can only take your best and most educated guess, using the experience of personnel and knowledge of the condition, to make your attempt at the fix. Who knows, you might get lucky and get it right first time, but what if you didnt? The only way to be sure is to leave it a while and then go back. Take another sample or audit the area again and see if the same problem jumps out. If not then great, but also make sure the fix hasnt caused a whole heap of other problems that made it worse not better. You wont know if you dont have another look.
Needs
Closed by: When you can finally say the problem is cured someone can say so by authorising the closure of the note. Other measures such as Key Performance Indicators should remain vigilant to later incidents that hopefully will not occur. Note: That concludes Part 1: Auditing Skills. We will now move onto to Part 2: ISO 9001:2008 to learn how to apply these skills to assess conformance with the requirements of ISO 9001:2008 Requirements for Quality Management Systems. SLIDE 15 Part II: Purpose of a Quality Management System What is a Quality Management System? Before we explore the requirements of ISO 9001:2008, lets first the purpose and intent of a Quality Management System. The correct definitions of Quality as defined in AS/NZS ISO 9000:2006 Quality Management System - Fundamentals and Vocabulary is as follows: Quality Degree to which a set of inherent characteristics (3.5.1) fulfils requirements (3.1.2). Put that together with the definition of: 3.2.1 System Set of interrelated or interacting elements In summary we have interrelated or interacting elements (or processes) to ensure we deliver or produce products/services that meet inherent characteristics and fulfils requirements. Lets extend this further by examining a few more definitions in AS/NZS ISO 9000:2006: 3.2.2 Management System System (3.2.1) to establish policy and objectives and to achieve those objectives and 3.2.3 Quality Management System Management System (3.2.2) to direct and control organisation (3.3.1) with regard to quality (3.1.1).
Needs
In summary: A Quality Management System is intended to establish policies to provide direction and control within an organisation to ensure the organisation achieves its established objectives. In order to do this an organisation must effectively manage processes to ensure products and/or services fulfil requirements. The purpose of business Consider an organisation or business you work within or one you have worked within. Why is the company or organisation in business? To make money. Dont be fooled; thats real reason the business exists. What if youre working within a non-profit organisation? Non-profits would always like to provide more services than they can afford to. Even though at the end of the financial year they have to report a zero balance, they still need to make more money to enable them to provide more services. And what about the public sector? Well in all governments, a budget surplus is always a key performance indicator. Sure these organisations (or employees of) may be driven by providing a service of excellence, to set industry benchmarks, to produce the best product available on the market and so on. Businesses with a culture of employees driven by these things have a better chance of making more money. The more successful your organisation is in attracting more of the market share, the more money you make. But can a business make more money by implementing a policy that states 'We want to make more money'? Maybe, but its not guaranteed. Consider your own financial goals. We all want more money, but its not going to come just like that. We (formally or informally) put plans and procedures in place to increase our income or investments. For example, our objective may be to earn $100,000 per year. Currently were earning $85,000 per year. In order to achieve the increased income, we need to obtain a qualification to have greater success at solidifying a position on the increased income. In order to achieve our objective, we may enroll in a course in such a qualification. To successfully achieve the qualification, we put systems in place that enable us the sufficient study time to complete the work required to complete the qualification. Lets consider this within business: A business may have an objective to increase its revenue by 20% in the next 12 months. The business may establish the following key performance indicators: Increased market share by 7.5% from the previous year Increased repeat business by 10% from the previous year
QMD02 Quality Systems Lead Auditor Reduced expenses by 2.5% from the previous year And so on in order to achieve the 20% revenue increase.
Needs
We all know we cant just go and get more of the market share or beg current customers to come back or go about terminating the employment contract with some employees to reduce expenses. What if you did this for your personal financial plans? Beg for more money, steal money and adopt out your kids to save on expenses. You more than likely wouldnt end up better off, rather you would probably end up in a whole lot of trouble. In contrast, a business would be more effective in achieving its goals if it has established and effectively managed plans, objectives, policies, processes and controls to manage the business toward achieving its objectives. NOTE: You will notice that this learning material at times may seem like its more of a business management course than a quality management course. Towards the end of this presentation, you will identify why its necessary to explore aspects of business management to achieve competency in quality management. Principles of business excellence When you explore businesses that experience increased market share, setting industry benchmarks, increased repeat business, customer satisfaction and increased revenue, it is evident that the following principles exist within them. Please view the table on the right. You can enlarge it by clicking on the picture.
Page 44 of 90
Needs
Principle Customer Focus
What it may look like within the business Processes in place to understand the current and future needs of the customer and improvement processes in place to strive to exceed the customers expectations.
Leadership
Effective documented and communicated purpose and direction of the business. A culture that embraces and involves people to achieve objectives.
Involvement of People
Effective tools to encourage the participation of all employees to improve processes and abilities.
Process Approach
Well understood and/or documented processes to provide guidance the relation between activities and resources throughout a process.
System Approach to Management Continual Improvement
Clear understanding of the importance of all activities and processes in assisting the business to achieve its objectives. Tools and processes are in place to continually seek and implement improvements to processes an systems within the organization.
Factual Approach to Decision Making Mutually beneficial supplier relationships
Documented and analysed data and information upon which the management of the organization makes decisions. Effective performance monitoring and order communication tools in place to effectively manage suppliers as if they were simply a department within the business.
Page 45 of 90
QMD02 Quality Systems Lead Auditor SLIDE 16 Plan-Do-Check-Act By now in your studies you may be familiar with the Deming Wheel for continual improvement. Remember, The Plan-Do-Check-Act Cycle is an approach to effective continual improvement?
Needs
We will explore how business can be effective in achieving its goals by examining a business through the perspective of Plan-Do-Check-Act. Plan The business plans it goals and objectives and develops tools and documentation necessary to guide the activities throughout the business. Document the business plan, strategy, Objectives and Policy to provide direction of where you want the business to go. Develop a financial plan (budget) for the business. Develop a marketing strategy and plan. Identify the processes needed to for the organisation. Identify potential risks to the business to enable the implementation of controls to prevent, reduce or eliminate them. Identify resources required to deliver the services/products. (Including financial, human, facilities, infrastructures, etc). Develop documented policies and procedures to provide guidance and communicate the planned processes and organisational direction. Identify the records you will need to assess the effectiveness of the processes. Identify the leaders of the business. Identify the customers and their needs. Develop review processes for which the effectiveness of the processes to achieve identified goals and objectives is reviewed. Do The processes and activities required to deliver the services/products and organisational objectives. Manage Resources
Needs
Processes to select, recruit, monitor and assess that personnel have the ability to perform the work. Processes for the identification of personnel training needs and to facilitate continual training of personnel. Processes to continually monitor the effectiveness and suitability of infrastructure and facilities. (Including buildings, information technology, transport, communication, etc). Processes to ensure that the environment is suitable for the activities.
Operations Processes and activities for: Design and development of products and services. Effective supply of goods and services to your business to ensure it complements your own processes and manufacture. Monitoring the effectiveness of suppliers. Manufacturing, producing, supplying and/or providing the service to your customers. Sales, customer service, administration of activities. Identifying product status and traceability of individual products Preserving conformity of products during storage, packaging and transportation. Measuring compliance of products and the accuracy of such measuring devices. Check Tools within a business to check (or assess) and continually improve the effectives of the processes and activities Customer feedback systems. Staff satisfaction surveys. Internal Audits. Product Quality Control (or product inspections). Not fit for use - product identification systems. Non-compliance reports (often also known as Non-conformances, Corrective Actions, etc).
Needs
Reports and presentations providing results according to collected and analysed data. Meetings to discuss and present results of data collected. Act Actions required resulting from the previously mentioned issues: Improvement programs to improve processes and activities and ultimately their outcomes in order to improve upon the effectiveness of achieving organisational goals and objectives Re-evaluate and re-establish the items in the 'Plan' section of this cycle. And, back to PLAN again. Of course, in the 'real-world' business doesnt operate as clear as this, but in all businesses there will be a need for each of the items mentioned above in order for it to operate successfully. Recap Whats all this got to do with Quality Management Systems and ISO 9001:2008? Re-capping on the definition of Quality Management System as defined in ISO 9000:2006: 3.2.4 Quality Management System management system (3.2.2) to direct and control and organisation (3.3.1) with regard to quality (3.1.1). In summary: A Quality Management System is intended to establish policies to provide direction and control within an organisation to ensure the organisation achieves its established objectives. In order to do this an organisation must effectively manage processes to ensure products and/or services fulfill requirements. When you take a brief look at the main sections of ISO 9001:2008 you will identify the similarity of the sections with the items listed in the 'Plan-Do-Check-Act and Business' example provided earlier in this presentation. Or rather, you will identify the similarity of the sections in ISO 9001:2008 with the processes, controls, etc required for a business to be effective in achieving its objectives. Please open attachment 'Main sections of ISO 9001:2008', found in the upper right hand corner.
Page 48 of 90
QMD02 Quality Systems Lead Auditor SLIDE 17 Principles of QMS
Needs
In this section we will explore the requirements of ISO 9001:2008 and examine the purpose, intent and possible examples of each requirement. Before we move onto exploring each section, lets first explore the principles that underpin this standard a Quality Management System. Earlier, we identified these principles and applied a summary of what each principle looks like within business. The table on the right illustrates where in the standard requirements may relate to the principles. Please click on the picture to enlarge. The Collection of QMS Standards There are number of standards that relate to Quality Management Systems. The most common standard providing requirements for a Quality Management System is ISO 9001:2008. This is the standard that organisations would seek Certification to. Many clients nowadays require their suppliers to provide assurance that they have systems in place to fulfill the requirements of the client. This is usually done by providing a copy of the Certificate for ISO 9001:2008. Although many clients will still prefer to perform a Second party audit. There are quite a few industries that have specific Quality Management Systems standards. This is usually due to the level of risk in the product or service and as such the specific standards include further specific requirements for an organisation to achieve certification against such a standard. Some examples of these follow: TS/ISO 16949: Requirements for a Quality Management System in the automotive manufacturing industry. HACCP: Food Industry. (Although an Internationally recognised standard has been released; which will eventually replace HACCP in the food industry - ISO22000). EQuIP: Health Industry - often required of Private Hospitals. (However the industry has commenced recognition of ISO 9001:2008). TGA: Therapeutic Goods - typically required of pharmaceutical or health aid manufacturers. ISO 13485:2003 Required of manufacturers that produce and/or provide medical devices. There are many more industry specific Quality Management System standards. All of these maintain similar principles and are the same in intent. The main difference is that in certain industries specific controls are required to minimise risk to the end user of the product or service.
QMD02 Quality Systems Lead Auditor Quality Management Systems Complementary Standards
Needs
While ISO 9001:2008 is the most common Quality Management System standard, there are a number of documents and guidelines that complement this standard. The list below is only for the purpose of clarification or guidelines to elements of ISO 9001:2008 and are not for certification. ISO 9004:2000 Quality Management Systems - Guidelines for Performance Improvement 9001 provides the 'bare minimum' a company MUST meet to achieve certification for their quality management system. This document provides guidelines on implementing and maintaining a quality management system for continual business performance improvement. Upon reading the content of it, readers gain a better overview on the intent of Quality Management Systems and their certification. While you can not make any findings against the guidelines in ISO 9004 document, this document may provide auditors with an overview of what organisations may have in place that will meet the requirements of ISO 9001:2008. ISO 9000:2006 Quality Management Systems - Fundamental and vocabulary This document provides definitions and fundamentals of Quality Management System to ensure a consistent interpretation of the requirements of ISO 9001:2008. ISO 19011:2003 Guidelines for auditing quality and environmental management systems This document provides guidelines for auditing quality and environmental management systems. Third party auditors are typically required to meet the guidelines of this document in order to become a registered Third party auditor. Throughout the remainder of this presentation, you will be required to also reference your copy of ISO 9001:2008. This presentation will be asking you to read the section and then the presentation as it explores interpretation for the purpose of auditing a quality management system.
Page 50 of 90
QMD02 Quality Systems Lead Auditor SLIDE 18 ISO 9001:2008
Needs
The intention of a Quality Management System is 'to establish policies to provide direction and control within an organisation to ensure the organisation achieves its established objectives. In order to do this an organisation must effectively manage processes to ensure products and/or services fulfil requirements'. There is absolutely no other reason for an organisation to have a Quality Management System implemented than to ensure the business runs smoothly and effectively to achieve its goals. The business may seek Certification for marketing and commercial purposes, but the system the organisation has implemented MUST be developed for the effectiveness of the business. If the business has a system in place 'just to get certification' , you can almost guarantee that youll find a gap in the system simply because the quality management system will be seen within the organisation as something different to what the business is doing. Bearing this in mind: all elements/clauses/requirements of the standard MUST be considered in the reality of a business. When auditing the most effective quality management systems you may not find an 'exact' title match for activities, processes and models required by the standard. You will find the businesses own interpretation of the element/clause/requirement. As an auditor, it will be your job to determine whether the businesses systems meet the requirements of the standard. ISO 9001:2008 Introduction This section provides guidelines for organisations in the adoption of ISO 9001:2008, as their standard for a quality management system. Most importantly, it introduces the model for process-based quality management system. The model illustrates the importance of each activity within an organisation to be interrelated or linked to other areas of the business. Further, this model also illustrates how each element/clause of the standard relate and the linkages between them. Please take a moment to review the model in your provided copy of ISO 9001:2008 and consider the model within the organisation you work. Do a quick sketch of each major function within your organisation and the flow between each activity. Does this model fit within your organisation? TIP: In auditing a quality management system, this model provides auditors with a simple model from which to commence a checklist when preparing their audit. ISO 9001:2008 Section 1 Scope/Section 2 Normative Reference/Section 3 Terms and Definitions These sections of the standard simply provide guidelines on the use and selection of the standard. These sections are not used for the purpose of assessing your quality management system for compliance with the requirements of ISO 9001:2008. The requirements of a quality management system are detailed in the section 4 through to 8.
Needs
Most quality practitioners will usually only talk about sections 4 through to 8 of ISO 9001:2008. Section 4 4.1 General requirements This section indicates that 'the organisation shall establish, document and maintain a quality management system and continually improve its effectiveness in accordance with the requirements of this standard'. Then theres a list a) through to f) of how the organisation shall do this. Interpretation: The organisation shall have a quality management system that meets the requirements of this standard. In ensuring that the list is covered within the QMS, you may wish to refer back to the process-based model in the Introduction of the standard. The intent here is for an organisation to carefully provide consistency and clarity with the system that has been implemented and its purpose/s. Learning Exercise: Refer back to your 'sketch' of the process-based model with your organisation and consider whether your organisation: Has identified the processes needed for the QMS Has determined the flow of processes Has determined the specifications/criteria and control methods to ensure the processes are effective Has ensured availability and effective resources and information necessary Has implemented effective tools and techniques to monitor, measure and analyse the processes Has implemented activities and methods for continual improvement of all of the above. If your organisation does all of this then it has a Management System. Whether it meets the requirements of this standard is yet to be determined further in the standard. To demonstrate this clause of the standard, organisations often develop and implement a model or guidance document to illustrate or provide an overview of their quality management system. Many organisations may have a business model or guidance document.
Page 52 of 90
QMD02 Quality Systems Lead Auditor 4.2 Documentation Requirements 4.2.1 General
Needs
This clause provides the requirements of documented procedures. The International Standards Organisation (ISO) recognise that not every single process and parameter needs to be documented within an organisation when you consider that qualified personnel may be performing the tasks and so on. As a minimum, an organisation should document the following: a) The organisations policy for quality and the organisations objectives - this is to ensure that clarity of purpose can be communicated throughout the organisation b A manual that provides guidance to the organisations quality management system c) The procedures that are required by this standard to be documented - which we will explore shortly d) Any documented procedure required by the organisation to ensure clarity for processes throughout the organisation e) Records as indicated by the standard - which we will also touch on shortly. There are three notes within this clause to provide clarity of quality management system documentation requirements, which are important to take into account when auditing a quality management system. 1. There must be an implemented and maintained documented procedure as required by this procedure. 2. The organisation has a 'creative license' with regard to how their documentation meets the requirements of this standard. 3. We can look outside the traditional methods of documenting when we document a procedure. It may be on paper, electronic, on signage, on control charts, etc. There are six documented procedures specifically required by ISO 9001:2008: 4.2.3 Control of documents 4.2.4 Control of records 8.2.2 Internal audit 8.3 Control of nonconforming product 8.5.2 Corrective action 8.5.3 Preventive action.
Needs
While the standard uses the term 'procedures' these can be work instructions, operating instructions, etc. 4.2.2 Quality Manual This clause further provides requirements for the quality manual (or organisational quality management system overview/guideline document/s) and its content. When auditing a quality management system (or in particular performing a document review) this is usually the best place to start, as it provides auditors with an overview of the organisation and its management system to enable the decision of audit methods, tools, schedule and basis upon which you may find evidence of an effective quality management system. 4.2.3 Control of documents This clause further provides requirements for the effective control of documents within the organisation. NOTE: this is one of the requirements for a 'documented procedure'. The intent of this clause is to ensure that documentation is being issued and changed via authorised means and that the validity of the documentation is clear so as to ensure that all personnel are following the correct an authorised versions of a documented procedure. A documented procedure is intended to provide clear communication of a process or activity. This clause is simply saying ensure the communication tool (documented procedure) is controlled and current to reduce the risk of poor quality due to an incorrect procedure being followed. 4.2.4 Control of records The intent of this clause is to ensure that an organisation decides upon the records they need to that provides evidence of conformity or non-conformity of processes and activities. It is also intended to ensure that you maintain such records to prevent loss or damage of such records and no data from which to base organisational decisions upon. The clause requires defined controls needed for identification, storage, protection, retrieval, retention times and disposition of records. Such controls shall be documented. NOTE: Another document requirement. Summary of section 4 To provide direction of an organisations quality management system they are required to establish, document and implement it. They are required to document the procedures as required by ISO 9001:2008.
Needs
To ensure consistency and clarity of use of such procedures the organisation is required to control documented procedures and records. Section 5 5.1 Management Commitment Top Management shall demonstrate commitment to the quality management by Communicating to the organisation the importance of meeting customer and legislative requirements Establishing a Quality Policy and organisational objectives Regularly conducting reviews Provision of sufficient and effective resources. This clause is essentially telling us that direction and overall performance overview of the Quality Management System must come from Top Management. In some organisations Top Management may be the Board of Directors, the Managing Director,etc. Top Management refers to the very top of the hierarchy, the person/or people who make the company or corporate decisions. Commitment from this level is essential to ensuring that the quality management system will be and is implemented to effectively support the business. This is the clause that says to Top Management: 'This Quality Management System is a framework for continual improvement for your business and you have to care about it and utilise the tools and controls ISO 9001:2008, enforce to effectively monitor your business performance and identify improvement opportunities. If its not working for your business, then change the quality system. And youll know if its working for your business by regularly reviewing its effectiveness'. This clause doesnt mean that the Top Manager has to be the QA Manager of the business. A clause further on deals with that. What this means is that direction of the Quality Management System comes from Top Management. The further clauses in section 5 of ISO 9001:2008 continue to address Managements Responsibilities with regard to their Quality Management System. 5.2 Customer focus One of the most important reasons for implementing a Quality Management System is to ensure we fulfill the customers requirements so that they will continue to buy from our company.
Page 55 of 90
Needs
This clause is small in content (albeit it refers to 7.2.1 and 8.2.1 of ISO 9001:2008 on further requirements) but it is important to get it right. Weve all heard a horror story about McDonalds. But heres another one for you: Most of us know the basic ingredients of a Chicken Caesar Salad: Chicken, Lettuce, Bacon, Croutons, Parmesan cheese and Caesar salad dressing. Going through McDonalds drive-through one day a lady orders a Chicken Caesar Salad.The 15 year old order taker responds: 'Im sorry; we dont have Chicken Caesar Salads'. Looking at the menu board for a different option, the lady spots another choice and asks: 'Well can I have the Chicken Caesar Deli Roll please'? 'Yes, drive through to the next window please', answers the order taker. Upon receiving her Chicken Caesar Deli Roll through the second window, the lady proceeds to empty the contents of the roll into the wrapper, hands the contents minus the roll back to the McDonalds staff and says: ' I thought you dont do Chicken Caesar Salads'? Well OK, theres a whole range of issues that are problematic for McDonalds level of service - that would be a different learning unit. This story was shared with you to highlight the importance of understanding what the customer wants and then to determine how or whether indeed you can meet those needs. So this clause is titled 'Customer Focus' - or interpreted as 'getting to the know the customer and helping them to articulate what they are after'. If we carry on giving the customers the goods or services we have, without finding out if they meet their needs, then eventually we lose the customers. The clause talks about Top Management and their requirement to ensure Customer Focus as this is essential to the strategy, objectives and plans for the business. In order for the business to succeed, it needs to understand the market demand and need, ensure there are systems in place to deliver according to what has been promised (contract) and having systems in place for continually monitoring the satisfaction of the customers in order to improve. 5.3 Quality policy Simply speaking: this clause requires Top Management to establish and implement a Company Commitment to quality. The commitment needs to be specific, including goals and how the commitment to quality and the goals relates to the customers requirements. The quality policy must be in some way documented and communicated to all employees so that all employees understand how the policy affects them. In the real world of business this is often demonstrated as part of the business strategic and business plan. Quite often the overview of such plans are summarised into a quality policy. The Top Management (Board, Directors, Shareholders) will sign off on the
Needs
business strategic and business plans and hence the requirement for Top Management to develop and 'sign off' on the Quality Policy as it ensures that the policy is developed for effectiveness within the business. The Quality Policy is essentially the tool that Top Management can use to communicate its purpose and strategy to all stakeholders (employees, customers, shareholders, community, etc). It should not be vague, as it is also a tool for all key performance indicators within the business to measure against and monitor the business effectiveness of progress toward its strategic and business goals. 5.4 Planning 5.4.1 Quality Objectives What we are trying to achieve exactly! Relating to 5.3; this clause requires organisations to develop SMART objectives. Essentially this clause is encouraging business to be specific about what its trying to achieve in order to continually enable the measurement of success of meeting the objectives. SMART Objectives S = Specific. Be exact about what you want to achieve. M = Measurable. Ensure the objectives are something you can measure; so that you can monitor progress. A= Achievable. Make sure the objectives are things you can achieve. R = Realistic. Weve all got big dreams, but what can realistically be done now? T = Timely;. When do you want to achieve such objectives. This clause requires the Top Management to develop the Objectives to complement the quality policy (or business strategy). Associated with 5.3 (quality policy), objectives are critical at all stages of the business in order for all departments, teams, production lines, etc to understand what their key measures of success are. The objectives are also a tool for communicating to all within a business how they affect the quality policy. If theyre not meeting the objectives set for them, the business as a whole may not meet its objectives and effectively its quality policy (strategic plan) will be compromised. 5.4.2 Quality Management System Planning Top Management shall ensure that plans are developed for the implementation of the QMS, as well as the implementation of systems and processes to achieve the objectives. When you consider this clause in the view of the Plan - Do - Check - Act cycle explored earlier in this material; this clause is encouraging business to thoroughly think through what its doing and how its going to do it. Further in the standard the clauses require businesses to Do the activities, Check the progress and Act on the results in order to revise the Plan if necessary.
Page 57 of 90
Needs
When you consider this clause within the entirety of section 5, it is encouraging Top Management to develop a plan for the QMS and the business, and the plan should include: A purpose (Strategy or quality policy (5.3) Objectives throughout the business in order to measure the effectiveness of processes, activities, etc (5.4.1) Identification of roles and responsibilities (5.5) Demonstration of commitment (5.1) Methods of communicating the plan throughout the business (5.5.3) Methods of continually reviewing the effectiveness of the QMS and the business (5.6) In order to deliver the expectations and requirements of the customer as effectively identified by the business (5.2). Considering these clauses within any Project, a successful project will have a well developed and documented plan including the following for the project: Reason for the project Objectives of the project Whos doing what in the project Methods of communicating to all involved in the project Defined milestones for the project Identification of the customers needs and requirements of the project. Within a real business this clause is often demonstrated within the business strategic and/or business plan. These plans are a great resource when conducting an audit as it provides the goals and objectives of the business and as such a purpose for all other activities within the business. In an effective QMS; the business will be experiencing a smooth flow of activities and processes, which all lead to and support/complement the business objectives and purpose. Further, when business/strategic plans change within a business, it is important that the overall QMS plans change to effectively complement any change management activities. A Quality Plan should ensure that the integrity of the QMS is not lost when the business experiences change.
Page 58 of 90
QMD02 Quality Systems Lead Auditor 5.5 Responsibility, authority and communication 5.5.1 Responsibility and authority
Needs
Top Management shall clarify what everybody is supposed to do and what they are responsible for. In other words everyone in the business needs to know whos who in the zoo and what theyre responsible for. This is in order to ensure that direction is consistent and understood throughout the business. This is often demonstrated in a business via an organizational chart to communicate to the overall business; and often position descriptions to provide further detail to each individual of their role and responsibilities. 5.5.2 Management Representative Whilst the Top Management are required to be committed to the QMS, it is not always a viable option that theyre the ones to do the leg work in developing, implementing and monitoring the QMS. So Top Management select someone in Management whose responsibility it is to do (or delegate) the leg work for the coordination of the QMS. 5.5.3 Internal Communication Top Management need to ensure there are communication methods that lets everyone know whats happening. This clause is essentially in ISO 9001:2008 to encourage Top Management to keep the communication channels open. Effective communication is a vital element in ensuring everyone knows what they have to do, to feed opportunities for improvement, identify business opportunities, etc. Just as various areas of a business are required to communicate their own progress to the Top Management; so too should Top Management communicate to the various areas of their respective effectiveness in supporting the business to meet its objectives or any changes to direction and plans that the various areas should know about to ensure their activities will continue to support the business objectives. 5.6 Management Review 5.6.1 General Hows everything going? The Top Management need to review the effectiveness of QMS in ensuring that processes and activities are delivering what is required for the business to achieve its objectives. Top Management need to carry out such reviews on a regular basis in order to actively and continually monitor the progress of the business. Typically in a business, Top Management regularly attends meetings to review and discuss the direction of the business. The purpose of this clause is that it is encouraging the Top Management to continue to do this but also utilize the results of tools and activities to assist in any decision making about the direction of the business and any associated activities. The reviews are carried out in many different ways from business to business. The important thing to be aware of when auditing this clause within a business is that the reviews are utilising (as a minimum) the items listed in 5.6.2 and 5.6.3.
Needs
Essentially, the next 2 clauses talk about the information that goes in (input) and comes out (output) of these reviews to ensure the reviews are effectively reviewing the effectiveness of the QMS to assist the business to meet its objectives. 5.6.2 Review Input This clause is essentially a reminder to Top Management that the QMS has within it some very useful tools of which can provide results toward the overall review of the business and as such the management reviews must include information as follows: Results of audits can assist Top Management to determine whether theres anything thats preventing success or highlighted opportunities for improving a way things are done Results of customers feedback and complaints contain vital clues and/or cues on effectiveness of processes or areas for improvement Results of any training needs analysis Results of supplier performance monitoring Results of continual process performance monitoring and the clues and cues it may provide Results of corrective and preventive action and its progress toward improvement Results of actions from previous reviews Recommendations for improvement Any changes within the business. 5.6.3 Review Output This clause is essentially saying that if any decisions or actions come out of the reviews, then how are these going to be communicated to ensure the decision is followed and action is carried out. Typically the communication coming out from a meeting is minutes. Sometimes it may be: An organisational bulletin about an improvement project thats about to be commenced. A staff meeting to communicate any changes that resulted from decisions made or changes to customer requirements. Allocation of staff to improvement projects.
Page 60 of 90
Needs
The ultimate purpose of 5.6 within ISO 9001:2008 is to ensure that Top Management are conducting effective reviews utilising the results throughout the business to make decisions or make changes to processes, resources, etc. Summary of Section 5 Leadership, commitment and the active involvement of the top management are essential for developing and maintaining an effective and efficient quality management system to achieve benefits for interested parties. To achieve these benefits, it is necessary to establish purpose, plans, objectives, communication channels, review processes and identify responsibilities to ensure clear and consistent direction of the business and as such the parameters of the QMS to deliver upon the business objectives. Section 6 6.1 Provision of Resources In short, this section of the standard highlights the requirements for the provision and management of resources. Or rather: What is needed to get the job done? The further clauses in this section discuss the requirements pertaining to different types of resources: 6.2 deals with Human Resources (People) 6.3 deals with Infrastructure (Stuff) 6.4 deals with the Work Environment (the Workplace) What is required to meet customer requirements and implement, maintain and continually improve upon the QMS in the delivery of the business objectives. 6.2 Human Resources People 6.2.1 General Who will do the job? You wouldnt allocate a beautician to perform a welding job within your business (unless of course the beautician also has a First class welders ticket). So 6.2 covers the requirements for a business to effectively identify and manage the required competencies to carry out the tasks and processes required to deliver the product/service that will fulfill the customers expectations.
Page 61 of 90
QMD02 Quality Systems Lead Auditor 6.2.2 Competence, awareness and training What skills do they need to get the job done effectively?
Needs
There are a number of issues that an organisation needs to address when managing human resources: Allocate people to jobs according to competence: Identify the people required to perform identified tasks and activities Determine the competency, experience, and education the people should have to perform tasks and activities Determine if the tasks/activities require specialized skills or qualifications (i.e. a store person may require a forklift license) Allocate people to tasks and activities according to the above Provide training where required: Determine what the people need to know to effectively perform the tasks and activities Identify the requirements for further training for the staff in order to satisfy the competency needs of improve upon level of skills, this includes any inductions required to provide staff an introduction to the activities, health and safety requirements Other considerations are: awareness of the quality management system and the policy, the policies or standards for the business and any other statutory or legislative obligations. Ensure that training is fulfilling the needs of the people to perform tasks: Evaluate whether the training and other actions have been effective Develop any improvements required resulting from the evaluations Ensure that people understand the relevance and importance of what they are doing: People tend to be better motivated if they feel integral to the objectives of the business Implementing position descriptions is a means of communicating to people what theyre piece of the big picture is. Position Descriptions are also a means of identifying the persons individual objectives which are derived from the organisations objectives and as such a business ensures that investment in people and their training is indeed beneficial to the business. Keep records:
Page 62 of 90
Needs
What records have you got on each person to check back on to ensure they have the appropriate competence, skills and experience when allocating or re-allocating them to a job or activity. CVs are an extremely important record to keep as it provides a historic record and as such identification of strengths in the utilisation or allocation of staff. Often-times people are capable of a lot more than the initial position they applied for; so when changes occur in the business or other skills are required by your business, you might find within CVs that the competence already exists within your people. If you consider human resources in a similar perspective of the maintenance of assets and facilities, continual training and assessment of staff competence is in a sense preventative maintenance of the business human asset. When auditing this requirement of the standard; you will more than likely spend most of your audit time within the Human Resources department; sampling staff education and experience records. However, a great record to review in an audit is the position descriptions of the staff, available within a lot of large businesses. Position Descriptions are an effective tool for the business in identifying the training and competence needs of people in particular jobs. They usually also highlight the positions role in the business and reporting lines. To assess whether this requirement of the standard has been effectively implemented you may wish to track the education and competency records of staff doing particular jobs. Further, you may wish to seek documentation that demonstrates how the business identifies it human resource needs and how they fulfil the needs. 6.3 Infrastructure Stuff What facilities are required to carry out the task/activity in order to fulfill the customers expectations? Simply speaking what 'stuff' is needed to perform the tasks. Some considerations of 'stuff' are: Buildings Utilities (i.e. gas, electricity) Motor Vehicles Computer Equipment Heavy moving equipment High volume transportation vehicles (Trucks) Telephones Presentation equipment Office furniture and equipment Software Soft communication tools (email, internet) Industrial or manufacturing machinery Tools Testing equipment Work space
QMD02 Quality Systems Lead Auditor Transportation requirements (i.e couriers, airplanes, trains, etc) Stationer, etc.
Needs
So, the first issue to cover with infrastructure is the need to identify what you need. The second issue to cover is how you will continue to maintain the 'stuff' to ensure it is continually fit for purpose. The maintenance may be preventive maintenance programs to continually service, test and check according to set criteria. Some examples are: A cleaning program for buildings Service schedules for vehicles IT update agreement with IT Lease IT support contract with an external IT support company Calibration schedule for testing equipment, etc.
6.4 Work Environment Workplace
'In what sort of conditions should the work be performed'? The business needs to determine the best conditions that the work will best be performed and manage such conditions for consistency to fulfil the requirements and expectations of the customers. Examples may be: A physiotherapist centre may consider comfortable rooms with privacy so that clients feel comfortable when receiving treatment A Motor Vehicle Repair Centre may consider a workshop to work on vehicles. A large warehouse to store products And so on. Summary of Section 6 The business needs to determine what is needed and how to monitor and maintain the resources in order to perform tasks and activities in order to meet the requirements and expectations of the customers.
Page 64 of 90
QMD02 Quality Systems Lead Auditor SLIDE 19 Section 7 ISO 9001:2008 Section 7 Product Realisation
Needs
Simply put, this Section deals with the 'doing; in the business. Product Realisation was the term chosen by the International Standardisation Organisation (ISO) to refer to the collective activities involved in the 'Operations; of the business. This includes the making of products, the purchase of material to make something, the design of a product, the delivery of a service, the taking of customer orders, the transportation of goods, the storage of goods, the preservation of goods, the quality inspection (quality control) throughout production (or in-process monitoring), and so on. For those people who are employed in the 'doing' part of the business, this is the part of the standard they understand best and do really well. Usually the operations areas within a business require the least amount of work when implementing a QMS, as most of the requirements in Section 7 are already being carried out. Sometimes they just require some improvement. 7.1 Planning of product realisation In simpler terms: Process Management Plans Clause 4.1 referred to this clause, as it deals with the requirement to plan the processes needed to make the product or deliver the service. 7.1 & 7.2 both describe the important elements of planning the Processes to deliver the customers requirements. This is where process flow charts are typically used within a business, to illustrate the flow of activities, information, materials, etc to make something or deliver a service. The clause requires objectives, documented procedures, and provision of resources for the processes to carry out the processes. It also requires the identification of monitoring and inspections methods and activities to ensure products continually and consistently meet requirements throughout the process. In manufacturing organisations this may be in the form of Control Plans and Standard Operating Procedures. Control Plans (CP) typically provide the specifications and testing methods and criteria. Standard Operating Procedures (SOP) typically provide the process flow and other important process information. In service orientated businesses this may be in the form of Service Plans, Service Models, Service Charters, etc which typically provide guidelines and objectives when providing such services.
Page 65 of 90
QMD02 Quality Systems Lead Auditor 7.2.1 Determination of requirements related to the product
Needs
Typically the sales or contracts department deals with these requirements within the business. You need to find out what the customer wants. Organisations should consider their processes and techniques to identify the specifications required by the customer, including the requirements not stated by the customer. The most important consideration for this clause is how to communicate the customers requirements throughout the organisation so that processes may be planned to deliver such requirements. 7.2.2 Review of requirements related to the product Once you have determined the requirements of the customer, you need to confirm whether you can indeed deliver upon those requirements. Records of the customers requirements and review of ability to deliver shall be maintained to provide clarification of the requirements throughout the processes if necessary. Examples of such records are an order, or a contract or tender. 7.2.3 Customer Communication If you were building a house, you wouldnt want the building company to only contact you when the house is ready to move into. You would want them to contact you to advise of progress occasionally, select colours and fixtures when necessary and so on. So when you are dealing with a customer order it is important to determine the communication arrangements to update progress of an order, confirm any changes to an order, seek feedback, enable them to make enquiries and provide feedback. Summary of 7.1 and 7.2 The clauses in 7.1 and 7.2 deal with the process management plans and collaboration required with your customers. To ensure the processes are indeed going to deliver the specific requirements of the customer it is important to ensure there is clarification of their requirements and communication channels are open and you confirm whether you can indeed fulfill their requirements. 7.3 Design and development This is the only clause of the standard that a company can exclude from their QMS, where design is not relevant to their organisation. The clauses within 7.3 cover the requirements for taking a controlled and disciplined approach to the design and development of products.
Needs
An extraction from HB90.1-2000 describes the required controls for 7.3 quite well: The design controls should generally cover the following: Establishing the design aims, planning how the design is to proceed, and who is to carry out the design (clause 7.3.1) Establishing what is needed to be known for the design to proceed (clause 7.3.2) Establishing the form of the output from the design (clause 7.3.3) Reviewing, on completion of the design stage, whether it has achieved what was wanted (clauses 7.3.4, 7.3.5 and 7.3.6) Modifying the design to include changes, which may occur at any stage of the process and for any reason (clause 7.3.7).
7.3.1 Design and Development Planning By now you may have noticed that theres a lot of planning that goes on in ISO 9001:2008. Referring back to the Plan-Do-Check-Act methodology: the intent of the Plan step is to ensure that there is a clear picture and thorough consideration of what needs to be done before you go ahead and do it. Re-capping on the Project Management example, the plans need to include: Specifications required for the product Important stages/milestones Lessons learnt data from previous design activities Controls required throughout the design process for review, verification and validation Responsibilities and authorities Communication channels A documented plan indicating all of the above. Some organisations that carry out design and development activities often utilise tools to assist in the planning of the designs and development activities pertaining to each product. 7.3.2 Design and Development Inputs This is the clause that prompts you to consider what the end product has to look like, comply with, do, etc.'
Page 67 of 90
Needs
Records must be maintained to comply with this clause as it is critical that the requirements for the design are clear and can continuously be referred to in order to minimise the likelihood mistakes. As referred to in ISO 9001:2008, the inputs may be in the form of: Specifications provided by the customer order/contract Specifications and lessons learnt from proto-type designs Information from similar previous designs Statutory and regulatory requirements pertaining to the type of product; (I.e. structural regulations for structures). 7.3.4 Design and development Review 'Is the design going to work? Are we on track? Throughout the entire design and development process, checks (or reviews) need to planned and carried out in order to control the process to ensure the product will meet specification. The reviews should be planned for in the planning stage as they often provide obvious phases once design activities commence. The amount of reviews and/or frequency of reviews depends upon the product and the number of people required to be involved. As referred in ISO 9001:2008; the reviews are essentially to evaluate the ability of the product to meet requirements Highlight any possible problems before its too late. The reviews should also include any necessary stakeholders. Examples of stakeholders follows: A production Manager may need to be involved to ensure they are able to plan for the manufacture of the product Laboratories that may be required to test any proto-types The customer to ensure their acceptance of the design. The government where approval is required, etc. Naturally, records of such reviews provide the business with proof that indeed they reviewed the products adequacy and/or the stakeholders accepted the design so that there is no confusion.
Needs
The figure on the right has been extracted from HB90.1-2000 to illustrate the relationship of the design stages. Please click on the picture to enlarge. 7.3.5 Often this stage of the design process is done in collaboration with the previous stage. At this stage we check that the design meets the initial (or documented changed) requirements that were identified during the planning stage of design. Again, records are necessary for the same reasons as stated in 7.3.4. 7.3.6 Design and development validation 'Does it work'? This is usually the stage where tests are run to confirm whether the product can do what is was designed to do. In some instances, the product may be put in operation in varying conditions and parameters to ascertain whether it will continue to work in changed environments and extremes. In manufacturing environments this stage may be conducted with a proto-type to ensure that there hasnt been mass production and then find out that it doesnt work. 7.3.7 Control of design and development changes Changes may occur to the design throughout the entire design process. They may result from: Testing results Verification and validation activities The review of the design Change of specifications coming from customer or market demand and so on. This clause requires that a any changes are documented and records maintained, but most importantly the changes to the design are: Included in changed plans Reviewed Verified Validated
QMD02 Quality Systems Lead Auditor Accepted/approved Prior to including the change into the design.
Needs
Summary of 7.3 The intent of 7.3 is to control and minimise or eliminate risk to all stakeholders for the design of products. Essentially the clauses in 7.3 follow the Plan-Do-Check-Act cycle (as shown below), but also highlights the importance of documenting the plans, controls, changes and stages to ensure there is clarity, acceptance and approval from all relevant parties. Please click on the picture on the right to enlarge. 7.4 Purchasing 'Buying stuff to fulfil the manufacture or service delivery requirements'. The requirements in this clause are not only important for the assurance that the company is getting the correct products, materials and services to enable them to deliver their product of service but also this clause is a framework for ensuring businesses have a system for managing suppliers and hence expenditure. A well managed purchasing system should enable the business to manage expenditure and identify areas of better buying power - and ultimate a healthier bottom line. You hear so many stories where a business may declare to its employees that theyre cutting expenditure. So when items are needed staff start writing lengthy proposals justify why they are submitting a purchase request. Or worse; companies just start buying cheaper products regardless of the integrity of the product - which we all know may cost the company further on in rework, for example. These requirements are useful for businesses to understand ways in which they can make the purchasing system effective so that suppliers are selected on the basis of price, performance and product compliance. The further clauses within 7.4 provides requirements for a business to manage its buying to reduce costs and still maintain product and service integrity. 7.4.1 Purchasing Process Have a clear and documented process for buying products, raw material and services that are required for the design, manufacture and delivery of your product or service. Include processes for the evaluation and selection of suppliers. One of the biggest motivators for a Purchasing Manager is to buy the cheapest possible products. What if those cheaper products cost the company in the long run with rework, returns and of course time? The process should include the identification of materials and services the
Needs
company requires; so that the Purchasing Department are aware that there is no deviation from the materials and service specifications required. Managing your suppliers: Suppliers should always be perceived as just another department of your business and are under the same amount of performance scrutiny as any other department in the business. How can you do this when you have no control over the running of the supplier? You may not have control over the running of it; but (as a customer) you do have the power to choose whether you continue to use them. In order to effectively monitor the performance of your suppliers, the following needs to be considered for supplier evaluation and selection: Are they reliable? Can they supply to your specifications? Do they have sufficient resources? Do they have systems in place? What has their performance been like in the past? What is their reputation like? And develop a supplier criteria based on these questions. Remember we cant monitor performance if we dont first set a performance criteria. The types of products, materials and services you include in your supplier performance program will depend upon the type of business your in, for example: A call centre will depend upon their telephone leasing company to provide a prompt service of telephones. A printing company will depend upon the quality of paper and ink cartridges they buy. A construction company will rely upon the delivery of bricks. A steel fabrication company will rely upon the quality of steel. A mining company will rely upon heavy fitting contractors to effectively service its earthmoving equipment. The performance monitoring is done differently from business to business according to the business size and importance of each supplier. It can be conducted as simple as an annual review of purchase orders against delivery dates and returns.
Needs
Or as in depth as conducting Second party audits within your suppliers to ascertain confidence in their ability to deliver. Either way the system chosen should be identified according to the level of risk.
7.4.2 Purchasing Information This clause deals with purchase requests and orders: the communication essentially used to buy stuff. As ISO 9001:2008 refers, there should be no doubt what it is you need and when and what approval requirements are necessary. When considering this clause in audit, sampling is usually performed to ascertain how concise orders and requests are so as to ensure there is no confusion between relevant parties. How often have you seen or heard of the situation where a production supervisor will phone a supplier and scream at the poor person on the other end of the phone because the material hasnt arrived in time, only to learn that the purchase order didnt state when they needed it by. When referring to clause 7.2.1 Customer related processes, you understand the importance of understanding what youre customer wants in order to deliver to their requirements . Bear this in mind when communicating with your suppliers too. If you dont tell them, they may just take a guess. This is also important when submitting a purchase request to the purchasing department (especially in large businesses) the purchasing officer probably has no experience in your area of the business and as such if you havent been concise in your request, chances are the purchasing officer may take a guess. 7.4.3 Verification of purchased product Did you get what you wanted? It is important to develop verification process/es to check that you indeed got what you ordered. These processes, when carried out effectively, assists in the monitoring of supplier performance. For example, if you receive the incorrect goods from company 'ABC-123' six times out of the last ten, you may just decide that enough is enough and explore other avenues. Remember to track this. You will need records, particularly in the case of a contracted supplier who wont allow you to break the contract. If you can provide them with evidence, they may just back down. The way in which this is done varies from business to business and of course type of product/service.
Needs
Large companies may have a Goods deliveries' and the received product is not allowed to enter production until the goods have been inspected for compliance. Summary of 7.4 The intent of this clause is for a business to manage its purchasing so it does not increase the risk of poor performance impinging on their ability to meet their customers requirements. 7.5.1 Control of production and service provision 'Process Management' This entire clause (including sub-clauses) covers the controls required throughout production or service delivery in order to ensure at various stages of the process/es that everything is running according to requirements and plans, or alternatively something has gone wrong and you have the opportunity to fix it before moving onto the next activity. The controls required should: Provide information of the correct processes (work instructions, standard operating procedures, control charts, etc. The specifications of the product or service required (control charts, service orders) Availability of monitoring and measuring tools and techniques (testing equipment, data collection charts) Inspection processes and techniques Product identification labels Post delivery activities, etc. Remember, 4.2.1 d) of ISO 9001:2008 states 'documents needed by the organization to ensure the effective planning, operation and control of its processes'. In other words, it is a documented procedure, instructions, etc are needed to ensure that the activity is performed consistently, then the activity should have a documented procedure. 7.5.2 Validation of processes for production and service provision This clause deals with the testing and validation that cant be performed during production or service delivery. An example of this may be when a 'parent-help' organisation assists parents with the development of skills to manage their childrens difficult behaviour. The organisation may send the parents home to 'try' the new techniques they have learned. The validation activity in this instance would be the 'parent-help' organisation telephoning the family two weeks later to see if the techniques worked for the parents.
Page 73 of 90
Needs
Another example may be that a private surgeon performs an plastic surgery operation on a patient. The validation activity would be an appointment post operative (and healing) to check if the patient is happy with the result. A further example may be in situations where more in-depth tests are required to be carried out in an environmentally controlled laboratory. 7.5.3 Identification and traceability This clause deals with the status and location of the product throughout the process and often post delivery. For example: A pharmaceutical manufacturing company may affix batch numbers to product to ensure a recall is possible if necessary. The organisation is required to implement controls to ensure that the status of a product can be identified and the product can be traced if necessary. In some organisations job cards are used, Inspection result labels, operator initials of documentation, tags, etc. Whatever system is used to identify and trace products, its usually not effective without records, particularly in the case of a product recall. If a problem has been identified with a particular batch for example,the batch number may not be of use if there is not record of where the batch went. Some other examples follow: An automotive parts manufacturer may stamp the parts with serial numbers and record the numbers on production records and inspection sheets. Hospitals will place an identification bracelet and anklet on a patient to ensure that in all situations, the patient can be identified. A vehicle repairer will record your cars registration number in the job card to enable them to identify the car for which the job is for. 7.5.4 Customer Property When youre required to handle or use customers property in order to produce the product or deliver the service they require, then this clause deals with the care required to look after it. The requirements of 7.5.3 is also important in the dealing with customer property, in that it should be identified and traceable throughout the processes and activities. The example provided in 7.5.3 regarding a vehicle repairer would also serve this purpose. Organisations should also have processes implemented for the notification and/or repair of damage to the customers property whilst in the organisations care. For example, a
Needs
vehicle repairer may telephone a car owner if they have had an accident in the car and then cover the cost of repair of the damage caused by the accident. 7.5.5 Preservation of Product 'Look after the products throughout all activities, storage and transport.' This clause requires a company to ensure controls are in place to ensure that the product/s will continue to comply with requirements throughout production, handling, storage and transportation. 7.6 Control of monitoring and measuring devices 'Calibration and/or confidence in testing equipment'. Calibration is the process of periodically comparing your equipment against a reference standard to determine how accurate it is and whether or not it is still capable of meeting the accuracy required for the measurements made with it. Periodically - refers to the frequency that the calibration is performed, whether weekly, monthly, annually or as/when used.
From HB90.1-2000
Throughout identifying the controls required during production and/or service delivery you will have identified the tests required to ensure the process is moving along as planned. In some of these case you may require the use of testing equipment to perform such tests. How do you know the testing equipment is accurately testing or measuring the parameters, such as specification required by the customer of regulations? The management of testing equipment is required to be carefully thoughout, planned and maintained. The organization is required to implement records, identification and calibration of testing equipment. In many organisations this consists first of the identification of tests requiring accuracy. Then there is often a register of equipment that requires calibration, the register will usually consist of identification numbers that correspond with each piece of equipment and calibration requirements (inclusive of any standards required and tolerances accepted). Similar to the requirements of 7.5.3; the testing equipment requires identification, not only to identify the piece of equipment, but more importantly to identify the status of calibration. This provides potential users of the equipment the notification that the piece of equipment is accurate. Further considerations of organizations are the requirements: To record results of calibration performed to ensure that the tolerances are acceptable To store the equipment in a place and/or a manner that will maintain the integrity of the accuracy of the test equipment.
QMD02 Quality Systems Lead Auditor Examples of testing equipment that may require calibration processes are: Mulimeters in an electrical environment Gas detectors.
Needs
Further interpretation is available in HB90.1-2000 The Small Business Handbook Guide to ISO 9001:2008. Although in some industries and various equipment, there are specific Australian or International Standards for which the equipment must comply with, organisations should investigate such standards and also comply with those. Non-compliance with such is also a non-compliance with 7.6a). Summary of 7.5 and 7.6 7.5 and 7.6 deals with Process Management of production and/or service delivery. The most important factor being the implementation of controls to ensure that requirements will be met throughout the entire processes.
Page 76 of 90
QMD02 Quality Systems Lead Auditor SLIDE 20 Section 8 8.1 General 'How are we going to monitor the activities and progress'?
Needs
In short this clause requires organisations to plan how they are going to monitor their own performance or perform self-assessment activities in order to continually improve the effectiveness of the QMS. The clauses below cover the minimum tools and techniques to incorporate into your Measurement, Analysis and Improvement plans. 8.1 through to 8.3 generally deals with the tools for monitoring and measurement, 8.4 specifically deals with the analysis of the data that the tools draw out and 8.5 deals with the improvements that follow such monitoring and analysis activities. A useful methodology to consider when trying to understand these clauses is DMAIC, typically utilised within 6 Sigma (or any other improvement) projects, this method assists in the understanding of the purpose and importance of each of these clauses in the continual improvement cycles. Define : Define your measurement and monitoring Criteria and methods. Measure: Measure your processes and product against such Criteria Analyse: Analyse the data to determine the effectiveness. Improve: Instigate improvements to increase the effectiveness. Control: Implement controls to continue the effectives. Putting this methodology into the clauses in Section 8 highlights the similarity of this methodology and these requirements further. Please see the table on the right. Click on the picture to enlarge. DMAIC is a methodology that was initiated by GE and Motorola in the development of their 6 Sigma improvement projects. 8.2.1 Customer Satisfaction Most of us have been approached at some time or another to provide feedback on a product or service, so most of us are experienced at providing and feedback (and usually pretty good at providing feedback at dissatisfaction). Remember though there is just as much to learn from customers satisfaction as there is to learn from dissatisfaction, so dont just monitor your customers complaints. One of the important factors of this clause is that, unfortunately you wont get the feedback unless you seek it. So the clause requires organizations to actively seek the feedback from their customers.
Needs
This is performed differently from business to business; examples are: focus market groups, surveys (in person/telephone/online), market research, etc. The essential thing that the organisation must do is to do something with the information. A lot of time, energy and money is often put into creating customer feedback systems, unfortunately the feedback comes in and gets filed. Oh sure, someone has read it at some point, but thats it! The information you get is like 'gold' for continual improvement of your business, if handled correctly. You may not change what you do according to one persons suggestion, but trends will provide an impetus to make some changes. There is also the temptation for an organisation to continue to use the exact same survey for several years for every single customer. They may be extremely good at monitoring the data it provides, but after several years start to notice reputation in the data. This clause is not saying that every single customer should be offered the opportunity to provide feedback, rather the clause intends that you utilise customer feedback for improvement within the business. That may mean that you plan to conduct a month long process of seeking customer feedback and use the data from it to make any necessary changes throughout the year. 8.2.2 Internal Audit 'How effective are the processes and activities within the business'? The definition as extracted from 3.1 of AS/NZS ISO 19011:2003 Guidelines for quality and/or environmental management systems auditing is as follows: AUDIT: systematic, independent and documented process for obtaining audit evidence(3.3) and evaluating it objectively to determine the extent to which the audit criteria (3.2) are fulfilled Audits are a tool to help an organisation review its processes, outcomes and activities. The outcome of an audit may result in any one or more of the following: A verification of compliance or non-compliance with a pre-determined criteria (e.g. standard, procedure, regulation, etc) Evaluation of effectiveness of process/activity being audited Areas identified requiring improvement and/or Non-compliances highlighted for corrective action. In plain language;
Needs
'An audit is a tool used to check, assess, analyse or verify to determine compliance and or an opportunity for improvement.' Internal Audits are the organizations opportunity to evaluate how its going. The clause requires that the organisation documents a procedure for the management of audits, auditors and planning of audits. When auditing this clause of the standard, you should typically find: An audit plan or schedule Procedure for management of the audits and auditors Some form of competency records of auditors Defined responsibilities pertaining to the coordination and management of the organisations audits, auditors and audit plan. TIP: Sampling previous internal audit reports during an audit would provide information and clues as to the effectiveness of the organisations QMS and hints of problems throughout the organisation. 8.2.3 and 8.2.4 8.2.3 Monitoring and measurement of processes AND 8.2.4 Monitoring and measurement of product Both of these clauses deal with the monitoring and measurement (or inspection and testing) of products and processes to verify that the process of the product complies with requirements at pre-determined intervals and prior to final delivery. Organisations are required to establish the methods that are suitable for the process and product, some examples of methods include: Proofreading Chemical analysis Measuring dimensions Testing temperatures, etc. Organisations are required to document a criteria to which the inspection and test is to measure against for compliance. A criteria may be documented in a number of ways according to the type of product being developed, examples follow:
Needs
Sampling plan - providing details of numbers and frequencies of samples to be inspected, particularly used when there is bulk product to be inspected and tested. A procedure or instruction that describes the testing process The initial order may contain the specifications and as such is often used as a criteria document, etc. Whatever the chosen method and criteria, the measurement process must be consistent to ensure variables and trends can be monitored. ISO 9001:2008 requires that an organisation must maintain records of such monitoring and measurement processes, for the purpose of evidence of products and processes complying with requirements. One of the most important benefits to recording such activities is the opportunity to draw trends and data to analyse the overall effectiveness of the processes used. Results of such trends and data are required for management to review the effectiveness of the processes in order to measure against objectives. Records of measurement and monitoring of processes and product activities may be check sheets. The record should consist of the inspection result; i.e. did the product comply with the criteria and why/why not and what happened to it after that. For example, if the product passed the inspection, the record may indicate such as well as indicate that it then was dispatched to the customer. The organisation also has a requirement to determine when the final approval of a product takes place, the method and required records of the final tests and inspections. In large manufacturing, fabrication organisation specifically; these activities are typically carried out by Quality Control personnel or QC Inspectors. In many cases the people involved in the manufacture or delivery may inspect their own work.
8.3 Control of Non-conforming product
'Stop dont use that - it doesnt meet requirements'. This clause is in ISO 9001:2008 to deal with the requirements for control of a product when it doesnt meet specification. Whether its products that you have bought from a supplier or products you have developed, this requirement applies. This clause requires organisations to implement a documented procedure to provide clear processes for dealing with such products. When a product doesnt meet specification, the following is usually considered: Can I still make it work/fit? Should it be returned and replaced?
QMD02 Quality Systems Lead Auditor Could it be used elsewhere? What other problems could arise as a result of the non-conformance? This clause requires you record this decision and identify the status of the nonconformance to prevent unintended use.
Needs
As well as results of the re-verification when it does become fit for use (i.e. in the situation of a re-work). Ways in which many organisations identify nonconforming products, consist of one or all of the following: Status label or tag affixed to the product; Placed within a quarantine area Placed within a re-work area or bin Disposed of in not fit for use bins. The documented procedure should also cover the requirements for release of product upon re-work and re-verification to ensure that the product does meet specification prior to going into use. This may consist of authorities and approval procedures to ensure clarity of the approval processes and as such is a added control of preventing nonconforming products from going into use. 8.4 Analysis of data 'What does all the data mean'? As touched on in 8.1; this is an extremely important step in measuring the effectiveness of a QMS. Within many clauses of ISO 9001:2008 there are stated (and implied) requirements to monitor and measure process and products. These requirements also include the maintenance of records of such monitoring and measurement activities, which is great; but what do you do with the data collected. Data is only ever useful if it is used to analyse a situation. Otherwise why would you bother collecting the data? This clause encourages (requires) organisations to: Define the data that is required to determine effectiveness Measure and monitor to extract data Analyse the data for any trends that provide clues to root causes of problems Improve upon the QMS according to the data analysed Control the processes to collect data.
Needs
Results of these analyses is required to be input into Management Review to ensure that Top Management can base decisions upon facts as collected throughout the processes and activities of the business. Particular clauses throughout ISO 9001:2008 that requires measurement and as such data analysis may occur for a range of issues and activities, such as: Customer satisfaction Process effectiveness Product compliance Staff Satisfaction, etc. 8.5 Improvement 8.5.1 Continual Improvement 'Improvement should be continual. No end and no break'. The section title PLAN-DO-CHECK-ACT AND A QMS' illustrates the flow of continual improvement within a QMS. This clause of the standard simply 'reminds' us of the importance to utilise the some of the tools to continually improve upon outcomes within the business. The PDCA Continual Imporvement model is illustrated below to demonstrate some of the tools required by ISO 9001:2008 and where they fit within the continual improvement cycle. PLAN Quality Policy Quality Objectives DO Operations CHECK Internal Audits Management Review Analysis of data Measurement and monitoring ACT
QMD02 Quality Systems Lead Auditor Corrective Action Preventive Action 8.5.2 Corrective Action
Needs
One of the main differences between Corrective Action and Preventive Action is that Corrective Action is usually conducted upon problems or nonconformities that HAVE ALREADY occurred and Preventive Action is usually the action taken to elmininate causes of potential problems. This clause requires organisations to have a procedure for the 'elimination of the cause' when problems or nonconformities occur. Whether the problem is related to a product that doesnt meet specification or a process problem a record of the following is required: Details of the problem The action taken to rectify the initial problem Details of the investigation into the 'CAUSE' of the problem Actions to eliminate the cause of the problem The effectiveness of the actions taken. Most organisations address this requirement with the following: A procedure describing the process of a corrective action and how they are managed A hard or electronic form to record all of the above issues. The name given to the tool (or form) differs from company to company depending upon their culture and approach to Corrective Actions, names such as Improvement Request, Business Improvement Tool, Corrective Action Notice, etc. Whatever the name, essentially tool should: Identify the problem Describe the immediate correction to prevent the problem affecting other processes (i.e. quarantine, re-work, temporary deviations, etc) Details of results of the investigation of the cause of the problem Actions required to eliminate the root cause to prevent recurrence; AND EXTREMELY IMPORTANT
Page 83 of 90
Needs
Review of the actions taken to confirm the effectiveness of such actions to eliminate the root cause/s. Records are important as they provide data for the analysis of QMS effectiveness,details of which is required to be input into Management Review. This requirement has a direct and close relationship with the requirements for 8.3 Control of nonconforming product. As discussed, 8.3 deals with the importance of control products or services that have not conformed with specification. In this case, that is the Problem and it is recorded and initial action is taken to lessen the threat of the problem reaching further. However as 8.5.2 implies, the corrective action doesnt stop there. It is important to then identify what caused the problem in the first place and then eliminate the cause. For example, a part you are producing fails to meet specification - Problem. You tag the part to identify that it doesnt comply to prevent it from being dispatched to the customer. - Initial Action. You may even then rework the part so that its meet the specifications - Initial Action. Issue dealt with? No! Then you would go through the process of investigating the root cause of the noncompliance to ensure that you arent continuing to produce parts that dont comply. Because if you did; that would be extremely costly. Due to the nature of manufacturing businesses in particular; the elimination of the root cause of product problem in particular so often gets overlooked. 'We just have to meet the production timelines; we dont have the time to sort it out, just re-work it and send it out' is an excuse you may hear. But what of the costs and time to rework? Especially if the cause wasnt eliminated and 100 of the non-complying parts were sent to the customer and they come back to you with a 'please explain and rectify - or well go elsewhere'. 8.5.3 Preventive action Quite often the same tool (form) used for Corrective Action is used to record action required for preventive action. However the requirement of this clause is different to 8.5.2, as stated; Preventive Action is the elimination of causes to POTENTIAL problems. So how are potential problems identified? Most businesses conduct regular risk assessments/evaluations to identify any potential problems that may occur to enable them to implement controls to eliminate, reduce or manage the risk. The same theory applies for this clause and in fact many businesses will include Process, Product and OHS within their Risk Assessments, which essentially identifies the potential problems for the QMS. This clause requires that organisations to the following with regard to potential problems:
QMD02 Quality Systems Lead Auditor Identify potential problems Evaluate the affects if the problem were to occur Utilise the results of the evaluation to determine a course of action
Needs
Implement actions, controls and training necessary to eliminate, reduce or manage the potential problem Record the results of the action taken (this is where the Corrective Action form is sometimes utilised to record the actions, so that the results go through the same review of effectiveness as does Corrective Actions) Review the effectiveness of the action taken. Regardless of the methods the organisation chooses to conduct this process; each step is should be carried out, recorded and a procedure describing the process if required. And why wouldnt a business take the time to determine likely problem? The process of doing so carries with it such a wide range of benefits that no successful business could do without; benefits such as: reduced insurance premiums, reduced costs of producing, reduced likelihood of stakeholder complaints, reduced likelihood of legal action against the business and so on. An integral step in the continual improvement cycle, this clause contributes to the planning for all activities and processes throughout a business as the results of preventive action activities should be input into management review to assist in the evaluation of the effectiveness of your QMS. The most important factor of both 8.5.2 and 8.5.3 is the requirement to eliminate the CAUSE of the occurred or potential problem. Summary of Section 8 As stated in 8.1, Section 8 deals with the tools and processes required to use the results of analysis of effectiveness of the QMS to continually improve the effectiveness - and ultimately improve the success of the business. So, to comply with these clauses you would expect documented procedures for and records of: Define : Define your measurement and monitoring Criteria and methods Measure: Measure your processes and product against such Criteria Analyse: Analyse the data to determine the effectiveness Improve: Instigate improvements to increase the effectiveness
QMD02 Quality Systems Lead Auditor Control: Implement controls to continue the effectiveness. SLIDE 21
To provide a final overall interpretation of ISO 9001:2000: One of the most important elements and intent of ISO 9001:2000 as a model for a quality management system Continual Improvement. Put into the perspective of the Plan-Do-Check-Act model for continual improvement, the standard has indeed been developed for the natural flow of business improvement as illustrated in the diagram below.
Needs
Section 5 Management Responsibility
Section 7 Product Realisation
Section 6 Resource Management
PLAN ACT
Section 8 Improvement
DO
CHECK
Section 8 Measurement & Analysis
SLIDE 22 Part III: Managing an Audit Programme and Team To understand the requirements for an audit programme within a Quality Management System lets first examine the clause within ISO 9001:2008 that describes the requirements for Internal Audit, 8.2.2. While this clause is referring specifically to internal audit programs it is also relevant for Second and Third party audit programs.
ISO 9001:2008, Quality Management System Requirements 8.2.2 Internal Audit

The organization shall conduct internal audits at planned intervals to determine whether the quality management system conforms to the planned arrangements, to the requirements of this International Standard and to the quality management system requirements established by the organization, and is effectively implemented and maintained.
Page 86 of 90
Needs
An audit programme shall be planned, taking into consideration the status and importance of the processes and areas to be audited, as well as the results of previous audits. The audit criteria, scope, frequency and methods shall be defined. Selection of auditors and conduct of audits shall ensure objectivity and impartiality of the audit process. Auditors shall not audit their own work. The responsibilities and requirements for planning and conducting audits, and for reporting results and maintaining records shall be defined in a documented procedure. The management responsible for the area being audited shall ensure that actions are taken without undue delay to eliminate detected nonconformities and their causes. Follow-up activities shall include the verification of the actions taken and the reporting of verification results. So what does it mean? Audits need to be conducted to determine if the system complies with requirements. Audits are pre-planned to ensure that frequency of such audits according to risk of non following such frequency. That audits are indeed conducted as per pre-planned. Develop audit frequency and requirements based on the needs of the business and potential risk of not auditing as per planned arrangements. Define what needs to be audited, when and how. Document and implement a procedure to describe who is responsible for maintaining, coordinating and evaluating the effectiveness of the audit system as well as maintaining records of audit results Records of audits need to be maintained. All resulting actions shall be verified to ensure the action was fulfilled and adequate. Significance of an internal audit Why is an internal audit system necessary in any business, regardless of whether certified to ISO 9001:2008? A well managed and progressive internal audit system ensures a business has a mechanism for evaluating the effectiveness of processes and as such encourages improvement. As with any system in business, without careful planning and documented control points, the system may not be effective in carrying out its intended purpose.
Page 87 of 90
QMD02 Quality Systems Lead Auditor Managing an effective audit programme
Needs
A document was prepared by the International Standardisation Organisation to provide guidelines for Quality and Environmental Management Systems Auditing. This guideline is titled: 'ISO 19011:2003 Guidelines for quality and/or environmental management systems auditing'. For this unit you are required to review the guidelines as described in this document particularly for the effective development and implementation of and audit programme in section five of the document. Managing an audit team In Part One of this unit we explored the coordination of an audit team during an audit. It is also important to consider the management of an audit team in collaboration with managing an audit programme. Section seven of ISO 19011:2003 describes the guidelines for the Competence and Evaluation of Auditors. Selection of Auditors subsequently results from the effective evaluation and management of auditor competence. You are required to review the guidelines as described in section 7 of ISO 19011:2003. ISO 1901 and third party auditors To become registered as a third party Quality and/or Environmental Management Systems auditor, an auditor must demonstrated auditing competence as described in ISO 1901. Certification Bodies must demonstrate these guidelines in the management of their audit programmes and auditors within their accreditation audits.
Page 88 of 90
Needs
Page 89 of 90
Needs
Page 90 of 90

Print Version Lead Auditor Module

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Print Version Lead Auditor Module

Uploaded by

Copyright:

Available Formats

QMD02 Quality Systems Lead Auditor SLIDE 1 QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor Recommended reading and reference:

QMD02 Quality Systems Lead Auditor SLIDE 3 PART I: Introduction to audits

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor SLIDE 4 Audit types

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor SLIDE 6 Audit Processes

Performing the audit

QMD02 Quality Systems Lead Auditor SLIDE 7 Initiate a quality audit

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

May lose the respect of work colleagues.

QMD02 Quality Systems Lead Auditor

Requests audits as a tool for evaluating their processes.

QMD02 Quality Systems Lead Auditor Tip

QMD02 Quality Systems Lead Auditor Conduct interviews

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor Urgent matters

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor SLIDE 14 The Audit Report

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor Problem identified

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

Principle Customer Focus

System Approach to Management Continual Improvement

Factual Approach to Decision Making Mutually beneficial supplier relationships

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor SLIDE 17 Principles of QMS

QMD02 Quality Systems Lead Auditor SLIDE 18 ISO 9001:2008

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor

QMD02 Quality Systems Lead Auditor