b) Fair presentation: the obligation to report truthfully and accurately Audit findings, audit conclusions and audit reports reflect truthfully and accurately the audit activities. Significant obstacles encountered during the audit and unresolved diverging opinions between the audit team and the auditee are reported.
c) Due professional care: the application of diligence and judgment in auditing Auditors exercise care in accordance with the importance of the task they perform and the confidence placed in them by audit clients and other interested parties. Having the necessary competence is an important factor. Further principles relate to the audit, which is by definition independent and systematic.
d) Independence: the basis for the impartiality of the audit and objectivity of the audit conclusions. Auditors are independent of the activity being audited and are free from bias and conflict of interest. Auditors maintain an objective state of mind throughout the audit process to ensure that the audit findings and conclusions will be based only on the audit evidence.
e) Evidence-based approach: the rational method for reaching reliable and reproducible audit conclusions in a systematic audit process. Audit evidence is verifiable. It is based on samples of the information available, since an audit is conducted during a finite period of time and with finite resources. The appropriate use of sampling is closely related to the confidence that can be placed in the audit conclusions. The guidance given in the remaining clauses of ISO 190011 is based on the principles set out above.
There are 3 types of audits. They all depend on who the client for the audit is.The client may be:
After registration, independent agencies also conduct periodic surveillance audits to assess the continuing suitability of the system.These agencies can also conduct a preassessment audit prior to registration. Preassessment audits do not count toward registration; their only objective is to help the auditee in preparing for the final audit.
- the auditee wishing to have its own quality system audited against some quality system standard; (1st party audit)
- a customer wishing to audit the quality system of a supplier using his own auditors or a third party; (2nd party audit)
- an independent agency authorized to determine whether the quality system provides adequate control of the products or services being provided (such as food, drug, nuclear, or other regulatory bodies); (3rd party audit)
- an independent agency assigned to carry out an audit in order to list the audited organization's quality system in a register. (3rd party audit).
Audits can be conducted by departments or by function of an organization, which are audited for compliance to all applicable requirements within the audit scope
Management Systems have to be audited using the process approach to auditing. Processes do not normally recognize departmental or functional boundary lines. Each identified process to be audited has inputs, outputs and objectives with both qualitative and quantitative measures of its outputs. So the audits have to be conducted in terms of inputs, outputs and ability to achieve objectives. The understanding of the interaction of the processes of an organization is key to a successful process audit.
C. MANAGING AN AUDIT PROGRAM
5.1 General
An audit program may include one or more audits, depending upon the size, nature and complexity of the organization to be audited. These audits may have a variety of objectives and may also include joint or combined audits (see Notes 3 and 4 to the definition of audit in 3.1).
An audit program also includes all activities necessary for planning and organizing the types and number of audits, and for providing resources to conduct them effectively and efficiently within the specified time frames. An organization may establish more than one audit program. The organization’s top management should grant the authority for managing the audit program. Those assigned the responsibility for managing the audit program should
a) establish, implement, monitor, review and improve the audit program, and
b) identify the necessary resources and ensure they are provided.
Figure 1 illustrates the process flow for the management of an audit program.
Figure 1 — Illustration of the process flow for the management of an audit program
NOTE 1 Figure 1 also illustrates the application of the Plan-Do-Check-Act methodology in ISO 19011.
NOTE 2 The numbers in this and all subsequent figures refer to the relevant clauses of ISO 19011.
If an organization to be audited operates both quality management and environmental management systems, combined audits may be included in the audit program. In such a case, special attention should be paid to the competence of the audit team.
Two or more auditing organizations may cooperate, as part of their audit programs, to conduct a joint audit. In such a case, special attention should be paid to the division of responsibilities, the provision of any additional resources, the competence of the audit team and the appropriate procedures. Agreement on these should be reached before the audit commences.
Practical help — Examples of audit programsExamples of audit programs include the following:
a) a series of internal audits covering an organization-wide quality management system for the current year;
b) second-party management system audits of potential suppliers of critical products to be conducted within 6 months;
c) certification/registration and surveillance audits conducted by a third-party certification/registration body on an environmental management system within a time period agreed contractually between the certification body and the client. An audit program also includes appropriate planning, the provision of resources and the establishment of procedures to conduct audits within the program.
5.2 Audit program objectives and extent5.2.1 Objectives of an audit program
Objectives should be established for an audit program, to direct the planning and conduct of audits. These objectives can be based on consideration of
a) management priorities,
b) commercial intentions,
c) management system requirements,
d) statutory, regulatory and contractual requirements,
e) need for supplier evaluation,
f) customer requirements,
g) needs of other interested parties, and
h) risks to the organization.
Practical help — Examples of audit program objectives Examples of audit program objectives include the following:
a) to meet requirements for certification to a management system standard;
b) to verify conformance with contractual requirements;
c) to obtain and maintain confidence in the capability of a supplier;
d) to contribute to the improvement of the management system.
5.2.2 Extent of an audit programThe extent of an audit program can vary and will be influenced by the size, nature and complexity of the organization to be audited, as well as by the following:
a) the scope, objective and duration of each audit to be conducted;
b) the frequency of audits to be conducted;
c) the number, importance, complexity, similarity and locations of the activities to be audited;
d) standards, statutory, regulatory and contractual requirements and other audit criteria;
e) the need for accreditation or registration/certification;
f) conclusions of previous audits or results of a previous audit program review;
g) any language, cultural and social issues;
h) the concerns of interested parties;
i) significant changes to an organization or its operations.
5.3 Audit program responsibilities, resources and procedures
5.3.1 Audit program responsibilities
The responsibility for managing an audit program should be assigned to one or more individuals with a general understanding of audit principles, of the competence of auditors and the application of audit techniques. They should have management skills as well as technical and business understanding relevant to the activities to be audited.
Those assigned the responsibility for managing the audit program should
a) establish the objectives and extent of the audit program,
b) establish the responsibilities and procedures, and ensure resources are provided,
c) ensure the implementation of the audit program,
d) ensure that appropriate audit program records are maintained, and
e) monitor, review and improve the audit program.
5.3.2 Audit program resources
When identifying resources for the audit program, consideration should be given to
a) financial resources necessary to develop, implement, manage and improve audit activities,
b) audit techniques,
c) processes to achieve and maintain the competence of auditors, and to improve auditor performance,
d) the availability of auditors and technical experts having competence appropriate to the particular audit program objectives,
e) the extent of the audit program, and
f) traveling time, accommodation and other auditing needs.
5.3.3 Audit program proceduresAudit program procedures should address the following:
a) planning and scheduling audits;
b) assuring the competence of auditors and audit team leaders;
c) selecting appropriate audit teams and assigning their roles and responsibilities;
d) conducting audits;
e) conducting audit follow-up, if applicable;
f) maintaining audit program records;
g) monitoring the performance and effectiveness of the audit program;
h) reporting to top management on the overall achievements of the audit program.
For smaller organizations, the activities above can be addressed in a single procedure.
D. AUDIT PROGRAM IMPLEMENTATION
The implementation of an audit program should address the following:
a) communicating the audit program to relevant parties;
b) coordinating and scheduling audits and other activities relevant to the audit program;
c) establishing and maintaining a process for the evaluation of the auditors and their continual professional
development, in accordance with respectively 7.6 and 7.5;
d) ensuring the selection of audit teams;
e) providing necessary resources to the audit teams;
f) ensuring the conduct of audits according to the audit program;
g) ensuring the control of records of the audit activities;
h) ensuring review and approval of audit reports, and ensuring their distribution to the audit client and other specified parties;
i) ensuring audit follow-up, if applicable.
5.5 Audit program records
Records should be maintained to demonstrate the implementation of the audit program and should include the following:
a) records related to individual audits, such as
audit plans,
audit reports,
nonconformity reports,
corrective and preventive action reports, and
audit follow-up reports, if applicable;
b) results of audit program review;
c) records related to audit personnel covering subjects such as
auditor competence and performance evaluation,
audit team selection, and
maintenance and improvement of competence.
Records should be retained and suitably safeguarded.
5.6 Audit program monitoring and reviewing
The implementation of the audit program should be monitored and, at appropriate intervals, reviewed to assess whether its objectives have been met and to identify opportunities for improvement. The results should be reported to top management.
Performance indicators should be used to monitor characteristics such as
the ability of the audit teams to implement the audit plan,
conformity with audit programs and schedules, and
feedback from audit clients, auditees and auditors.
The audit program review should consider, for example,
a) results and trends from monitoring,Results of audit program reviews can lead to corrective and preventive actions and the improvement of the audit program.
b) conformity with procedures,
c) evolving needs and expectations of interested parties,
d) audit program records,
e) alternative or new auditing practices, and
f) consistency in performance between audit teams in similar situations.
Audits are normally designed for one or more of the following purposes:Audits are generally initiated for one or more of the following reasons:
- to determine the conformity or nonconformity of the management system elements with specified requirements;
- to determine the effectiveness of the implemented management system in meeting specified objectives;
- to provide the auditee with an opportunity to improve the management system;
- to meet regulatory requirements;
- to permit the listing of the audited organization's management system in a register.
These audits may be routine, or may be prompted by significant changes in the organization's quality management systemsystem, process, product or service quality, or by a need to follow up on corrective action.
- to initially evaluate a supplier where there is a desire to establish a contractual relationship;
- to verify that an organization's own quality system continues to meet specified requirements and is being implemented;
- within the framework of a contractual relationship, to verify that the supplier's quality management system continues to meet specified requirements and is being implemented;
- to evaluate an organization's own quality system against a quality system standard.
NOTES
What is a Management system Audit?
- Management system audits should not result in a transfer of the responsibility to achieve quality from operating staff to the auditing organization.
- Management system audits should not lead to an increase in the scope of quality functions over and above those necessary to meet quality objectives.
- It is a continuous improvement activity.
- It is a friendly process.
- It is a planned activity.
- It is conducted by a trained auditor, who is independent from the activity or department audited.
E. AUDIT ACTIVITIES
6 Audit activities
6.1 General
This clause contains guidance on planning and conducting audit activities as part of an audit program. Figure 2 provides an overview of typical audit activities. The extent to which the provisions of this clause are applicable depends on the scope and complexity of the specific audit and the intended use of the audit conclusions.
NOTE The dotted lines indicate that any audit follow-up actions are usually not considered to be part of the audit.
Figure 2 — Overview of typical audit activities
6.2 Initiating the audit
6.2.1 Appointing the audit team leader
Those assigned the responsibility for managing the audit program should appoint the audit team leader for the specific audit.
Where a joint audit is conducted, it is important to reach agreement among the auditing organizations before the audit commences on the specific responsibilities of each organization, particularly with regard to the authority of the team leader appointed for the audit.
6.2.2 Defining audit objectives, scope and criteria
Within the overall objectives of an audit program, an individual audit should be based on documented objectives, scope and criteria. The audit objectives define what is to be accomplished by the audit and may include the following:
a) determination of the extent of conformity of the auditee's management system, or parts of it, with audit criteria;
b) evaluation of the capability of the management system to ensure compliance with statutory, regulatory and
contractual requirements;
c) evaluation of the effectiveness of the management system in meeting its specified objectives;
d) identification of areas for potential improvement of the management system.
The audit scope describes the extent and boundaries of the audit, such as physical locations, organizational units, activities and processes to be audited, as well as the time period covered by the audit.
The audit criteria are used as a reference against which conformity is determined and may include applicable policies, procedures, standards, laws and regulations, management system requirements, contractual requirements or industry/business sector codes of conduct.
The audit objectives should be defined by the audit client. The audit scope and criteria should be defined between the audit client and the audit team leader in accordance with audit program procedures. Any changes to the audit objectives, scope or criteria should be agreed to by the same parties. Where a combined audit is to be conducted, it is important that the audit team leader ensures that the audit objectives, scope and criteria are appropriate to the nature of the combined audit.
6.2.3 Determining the feasibility of the audit
The feasibility of the audit should be determined, taking into consideration such factors as the availability of
sufficient and appropriate information for planning the audit,
adequate cooperation from the auditee, and
adequate time and resources.
Where the audit is not feasible, an alternative should be proposed to the audit client, in consultation with the auditee.
6.2.4 Selecting the audit team
When the audit has been declared feasible, an audit team should be selected, taking into account the competence needed to achieve the objectives of the audit. If there is only one auditor, the auditor should perform all applicable duties of an audit team leader. Clause 7 contains guidance on determining the competence needed and describes processes for evaluating auditors.
In deciding the size and composition of the audit team, consideration should be given to the following:
a) audit objectives, scope, criteria and estimated duration of the audit;
b) whether the audit is a combined or joint audit;
c) the overall competence of the audit team needed to achieve the objectives of the audit;
d) statutory, regulatory, contractual and accreditation/certification requirements, as applicable;
e) the need to ensure the independence of the audit team from the activities to be audited and to avoid conflict of interest;
f) the ability of the audit team members to interact effectively with the auditee and to work together;
g) the language of the audit, and an understanding of the auditee’s particular social and cultural characteristics; these issues may be addressed either by the auditor's own skills or through the support of a technical expert.
The process of assuring the overall competence of the audit team should include the following steps:
identification of the knowledge and skills needed to achieve the objectives of the audit;
selection of the audit team members such that all of the necessary knowledge and skills are present in the audit team.
If not fully covered by the auditors in the audit team, the necessary knowledge and skills may be satisfied by including technical experts. Technical experts should operate under the direction of an auditor.
Auditors-in-training may be included in the audit team, but should not audit without direction or guidance. Both the audit client and the auditee can request the replacement of particular audit team members on reasonable grounds based on the principles of auditing described in clause 4. Examples of reasonable grounds include conflict of interest situations (such as an audit team member having been a former employee of the auditee or having provided consultancy services to the auditee) and previous unethical behavior. Such grounds should be communicated to the audit team leader and to those assigned responsibility for managing the audit program, who should resolve the issue with the audit client and auditee before making any decisions on replacing audit team members.
6.2.5 Establishing initial contact with the auditee
The initial contact for the audit with the auditee may be informal or formal, but should be made by those assigned responsibility for managing the audit program or the audit team leader. The purpose of the initial contact is
a) to establish communication channels with the auditee’s representative,
b) to confirm the authority to conduct the audit,
c) to provide information on the proposed timing and audit team composition,
d) to request access to relevant documents, including records,
e) to determine applicable site safety rules,
f) to make arrangements for the audit, and
g) to agree on the attendance of observers and the need for guides for the audit team.
6.3 Conducting document reviewPrior to the on-site audit activities the auditee’s documentation should be reviewed to determine the conformity of the system, as documented, with audit criteria. The documentation may include relevant management system documents and records, and previous audit reports. The review should take into account the size, nature and complexity of the organization, and the objectives and scope of the audit. In some situations, this review may be deferred until the on-site activities commence, if this is not detrimental to the effectiveness of the conduct of the audit. In other situations, a preliminary site visit may be conducted to obtain a suitable overview of available information. If the documentation is found to be inadequate, the audit team leader should inform the audit client, those assigned responsibility for managing the audit program, and the auditee. A decision should be made as to whether the audit should be continued or suspended until documentation concerns are resolved.
F. PREPARING FOR THE ON-SITE ACTIVITIES
6.4.1 Preparing the audit plan
The audit team leader should prepare an audit plan to provide the basis for the agreement among the audit client, audit team and the auditee regarding the conduct of the audit. The plan should facilitate scheduling and coordination of the audit activities. The amount of detail provided in the audit plan should reflect the scope and complexity of the audit. The details may differ, for example, between initial and subsequent audits and also between internal and external audits. The audit plan should be sufficiently flexible to permit changes, such as changes in the audit scope, which can become necessary as the on-site audit activities progress.
The audit plan should cover the following:
a) the audit objectives;
b) the audit criteria and any reference documents;
c) the audit scope, including identification of the organizational and functional units and processes to be audited;
d) the dates and places where the on-site audit activities are to be conducted;
e) the expected time and duration of on-site audit activities, including meetings with the auditee’s management and audit team meetings;
f) the roles and responsibilities of the audit team members and accompanying persons;
g) the allocation of appropriate resources to critical areas of the audit. The audit plan should also cover the following, as appropriate:
h) identification of the auditee’s representative for the audit;
i) the working and reporting language of the audit where this is different from the language of the auditor and/or the auditee;
j) the audit report topics;
k) logistic arrangements (travel, on-site facilities, etc.);
l) matters related to confidentiality;
m) any audit follow-up actions.
The plan should be reviewed and accepted by the audit client, and presented to the auditee, before the on-site audit activities begin. Any objections by the auditee should be resolved between the audit team leader, the auditee and the audit client. Any revised audit plan should be agreed among the parties concerned before continuing the audit.
6.4.2 Assigning work to the audit team
The audit team leader, in consultation with the audit team, should assign to each team member responsibility for auditing specific processes, functions, sites, areas or activities. Such assignments should take into account the need for the independence and competence of auditors and the effective use of resources, as well as different roles and responsibilities of auditors, auditors-in-training and technical experts. Changes to the work assignments may be made as the audit progresses to ensure the achievement of the audit objectives.
6.4.3 Preparing work documentsThe audit team members should review the information relevant to their audit assignments and prepare work documents as necessary for reference and for recording audit proceedings. Such work documents may include
checklists and audit sampling plans, and
forms for recording information, such as supporting evidence, audit findings and records of meetings.
The use of checklists and forms should not restrict the extent of audit activities, which can change as a result of information collected during the audit.
Work documents, including records resulting from their use, should be retained at least until audit completion. Retention of documents after audit completion is described in 6.7. Those documents involving confidential or proprietary information should be suitably safeguarded at all times by the audit team members.
G. CONDUCTING ONSITE ACTIVITIES
6.5.1 Conducting the opening meeting
An opening meeting should be held with the auditee’s management or, where appropriate, those responsible for the functions or processes to be audited. The purpose of an opening meeting is
a) to confirm the audit plan,
b) to provide a short summary of how the audit activities will be undertaken,
c) to confirm communication channels, and
d) to provide an opportunity for the auditee to ask questions.
Practical help — Opening the meeting
In many instances, for example internal audits in a small organization, the opening meeting may simply consist of communicating that an audit is being conducted and explaining the nature of the audit. For other audit situations, the meeting should be formal and records of the attendance should be kept. The meeting should be chaired by the audit team leader, and the following items should be considered, as appropriate:
a) introduction of the participants, including an outline of their roles;
b) confirmation of the audit objectives, scope and criteria;
c) confirmation of the audit timetable and other relevant arrangements with the auditee, such as the date and time for the closing meeting, any interim meetings between the audit team and the auditee's management, and any late changes;
d) methods and procedures to be used to conduct the audit, including advising the auditee that the audit evidence will only be based on a sample of the information available and that therefore there is an element of uncertainty in auditing;
e) confirmation of formal communication channels between the audit team and the auditee;
f) confirmation of the language to be used during the audit;
g) confirmation that, during the audit, the auditee will be kept informed of audit progress;
h) confirmation that the resources and facilities needed by the audit team are available;
i) confirmation of matters relating to confidentiality;
j) confirmation of relevant work safety, emergency and security procedures for the audit team;
k) confirmation of the availability, roles and identities of any guides;
l) the method of reporting, including any grading of nonconformities;
m) information about conditions under which the audit may be terminated;
n) information about any appeal system on the conduct or conclusions of the audit.
6.5.2 Communication during the audit
Depending upon the scope and complexity of the audit, it can be necessary to make formal arrangements for communication within the audit team and with the auditee during the audit.
The audit team should confer periodically to exchange information, assess audit progress, and to reassign work between the audit team members as needed.
During the audit, the audit team leader should periodically communicate the progress of the audit and any concerns to the auditee and audit client, as appropriate. Evidence collected during the audit that suggests an immediate and significant risk (e.g. safety, environmental or quality) should be reported without delay to the auditee and, as appropriate, to the audit client. Any concern about an issue outside the audit scope should be noted and reported to the audit team leader, for possible communication to the audit client and auditee.
Where the available audit evidence indicates that the audit objectives are unattainable, the audit team leader should report the reasons to the audit client and the auditee to determine appropriate action. Such action may include reconfirmation or modification of the audit plan, changes to the audit objectives or audit scope, or termination of the audit.
Any need for changes to the audit scope which can become apparent as on-site auditing activities progress should be reviewed with and approved by the audit client and, as appropriate, the auditee.
6.5.3 Roles and responsibilities of guides and observers
Guides and observers may accompany the audit team but are not a part of it. They should not influence or interfere with the conduct of the audit.
When guides are appointed by the auditee, they should assist the audit team and act on the request of the audit team leader. Their responsibilities may include the following:
a) establishing contacts and timing for interviews;
b) arranging visits to specific parts of the site or organization;
c) ensuring that rules concerning site safety and security procedures are known and respected by the audit team members;
d) witnessing the audit on behalf of the auditee;
e) providing clarification or assisting in collecting information.
6.5.4 Collecting and verifying information
During the audit, information relevant to the audit objectives, scope and criteria, including information relating to interfaces between functions, activities and processes, should be collected by appropriate sampling and should be verified. Only information that is verifiable may be audit evidence. Audit evidence should be recorded.
The audit evidence is based on samples of the available information. Therefore there is an element of uncertainty in auditing, and those acting upon the audit conclusions should be aware of this uncertainty.Figure 3 provides an overview of the process, from collecting information to reaching audit conclusions.
Figure 3 — Overview of the process from collecting information to reaching audit conclusions
Methods to collect information include
interviews,
observation of activities, and
review of documents.
Practical help — Sources of information
The sources of information chosen may vary according to the scope and complexity of the audit and may include the following:
a) interviews with employees and other persons;
b) observations of activities and the surrounding work environment and conditions;
c) documents, such as policy, objectives, plans, procedures, standards, instructions, licenses and permits, specifications, drawings, contracts and orders;
d) records, such as inspection records, minutes of meetings, audit reports, records of monitoring programs and the results of measurements;
e) data summaries, analyses and performance indicators;
f) information on the auditee’s sampling programs and on procedures for the control of sampling and measurement processes;
g) reports from other sources, for example, customer feedback, other relevant information from external parties and supplier ratings;
h) computerized databases and web sites.
Practical help — Conducting interviews
Interviews are one of the important means of collecting information and should be carried out in a manner adapted
to the situation and the person interviewed. However, the auditor should consider the following:
a) interviews should be held with persons from appropriate levels and functions performing activities or tasks
within the scope of the audit;
b) interviews should be conducted during the normal working hours and, where practical, at the normal workplace
of the person being interviewed;
c) every attempt should be made to put the person being interviewed at ease prior to and during the interview;
d) the reason for the interview and any note taking should be explained;
e) interviews can be initiated by asking the persons to describe their work;
f) questions that bias the answers (i.e. leading questions) should be avoided;
g) the results from the interview should be summarized and reviewed with the interviewed person;
h) the interviewed persons should be thanked for their participation and cooperation.
6.5.5 Generating audit findings
Audit evidence should be evaluated against the audit criteria to generate the audit findings. Audit findings can indicate either conformity or nonconformity with audit criteria. When specified by the audit objectives, audit findings can identify an opportunity for improvement. The audit team should meet as needed to review the audit findings at appropriate stages during the audit.
Conformity with audit criteria should be summarized to indicate locations, functions or processes that were audited. If included in the audit plan, individual audit findings of conformity and their supporting evidence should also be recorded.
Nonconformities and their supporting audit evidence should be recorded. Nonconformities may be graded. They should be reviewed with the auditee to obtain acknowledgment that the audit evidence is accurate, and that the nonconformities are understood. Every attempt should be made to resolve any diverging opinions concerning the audit evidence and/or findings, and unresolved points should be recorded.
6.5.6 Preparing audit conclusions
The audit team should confer prior to the closing meeting
a) to review the audit findings, and any other appropriate information collected during the audit, against the audit objectives,
b) to agree on the audit conclusions, taking into account the uncertainty inherent in the audit process,
c) to prepare recommendations, if specified by the audit objectives, and
d) to discuss audit follow-up, if included in the audit plan.
Practical help — Audit conclusions
Audit conclusions can address issues such as
a) the extent of conformity of the management system with the audit criteria,
b) the effective implementation, maintenance and improvement of the management system, and
c) the capability of the management review process to ensure the continuing suitability, adequacy, effectiveness and improvement of the management system.
If specified by the audit objectives, audit conclusions can lead to recommendations regarding improvements, business relationships, certification/registration or future auditing activities.
6.5.7 Conducting the closing meeting
A closing meeting, chaired by the audit team leader, should be held to present the audit findings and conclusions in such a manner that they are understood and acknowledged by the auditee, and to agree, if appropriate, on the timeframe for the auditee to present a corrective and preventive action plan. Participants in the closing meeting should include the auditee, and may also include the audit client and other parties. If necessary, the audit team leader should advise the auditee of situations encountered during the audit that may decrease the reliance that can be placed on the audit conclusions.
In many instances, for example internal audits in a small organization, the closing meeting may consist of just communicating the audit findings and conclusions.
For other audit situations, the meeting should be formal and minutes, including records of attendance, should be kept. Any diverging opinions regarding the audit findings and/or conclusions between the audit team and the auditee should be discussed and if possible resolved. If not resolved, all opinions should be recorded. If specified by the audit objectives, recommendations for improvements should be presented. It should be emphasized that recommendations are not binding.
H. WHAT THE AUDITOR IS LOOKING FOR
- Objective evidence of compliance to procedures and work instructions.
- Objective evidence of compliance to the ISO 9000 or other standards' requirements.
The objective evidence can be: 9.1 The types of nonconformances
Records Documentation (Work Instructions, Procedures, Standards)
Knowledge/training of employees
Compliant product handling
A nonconformity, sometimes called a discrepancy or a finding, arises when you find objective evidence of noncompliance to either:
1. Procedures, work instructions or workmanship standards: There are 2 levels of gravity:The auditor finds objective evidence that the procedure, work instruction, workmanship standard, checklist, or specification is not being followed. I.e. the procedure calls for making a record of an inspection on a traveler, or for signing off on a Sales Order as evidence of contract review, and while reviewing the records you find that it is not being done.
2. The requirements of the standard being audited to:
The auditor finds objective evidence that a requirement of the standard is not met in the procedure or in the implementation of the procedure. I.e. for ISO 9001:2000 the procedure calls for an inspection without any record being made of it (8.2.4), and the inspection/verification status on the inspected product is not maintained (7.5.2). Or orders are being shipped late without agreement from the customer (7.2.2)
Minor nonconformity: Objective evidence of deviations from procedures or the standard requirements.
1. The deviation is not systemic (throughout the quality system) Major nonconformity: Objective evidence of deviation from procedures or the standard requirements.2. The deviation does not imply that nonconforming products are SYSTEMATICALLY being delivered to customer.
3. The deviation does not imply that nonconforming products are KNOWINGLY being delivered to customer.
1. The nonconformity is systemic (throughout the quality system) 2. The nonconformity implies that nonconforming products are SYSTEMATICALLY being delivered to customer.
3. The nonconformity implies that nonconforming products are KNOWINGLY being delivered to customer.
I. AUDIT REPORTING:
6.6 Preparing, approving and distributing the audit report
6.6.1 Preparing the audit report
The audit team leader should be responsible for the preparation and contents of the audit report. The audit report should provide a complete, accurate, concise and clear record of the audit, and should include or refer to the following:
a) the audit objectives;
b) the audit scope, particularly identification of the organizational and functional units or processes audited and the time period covered;
c) identification of the audit client;
d) identification of audit team leader and members;
e) the dates and places where the on-site audit activities were conducted;
f) the audit criteria;
g) the audit findings;
h) the audit conclusions. The audit report may also include or refer to the following, as appropriate:
i) the audit plan;
j) a list of auditee representatives;
k) a summary of the audit process, including the uncertainty and/or any obstacles encountered that could decrease the reliability of the audit conclusions;
l) confirmation that the audit objectives have been accomplished within the audit scope in accordance with the audit plan;
m) any areas not covered, although within the audit scope;
n) any unresolved diverging opinions between the audit team and the auditee;
o) recommendations for improvement, if specified in the audit objectives;
p) agreed follow-up action plans, if any;
q) a statement of the confidential nature of the contents;
r) the distribution list for the audit report.
6.6.2 Approving and distributing the audit report
The audit report should be issued within the agreed time period. If this is not possible, the reasons for the delay should be communicated to the audit client and a new issue date should be agreed.
The audit report should be dated, reviewed and approved in accordance with audit program procedures.
The approved audit report should then be distributed to recipients designated by the audit client. and maintain the confidentiality of the report.
J. AUDIT TECHNIQUES:
11.1 Tell Me/Show me:
This technique is the most effective in conducting quality audits. The auditor basically requests the auditee to explain or walk him through the activity or process audited. The question needs to be open-ended and yet precise. Open-ended questions are perceived in a less adversarial fashion as close-ended questions such as: Do you conduct this activity, yes or no? So the better auditing question is:
The next step is to compare the information gathered with procedures, instructions standards, forms, checklists, computer system entries, and/or actual operation. So examples of audit questions are:
- Tell me how you conduct this activity.
- Tell me what are the inputs into the process. (ISO 9001:2000)
- Tell me what are the outputs into the process. (ISO 9001:2000)
- Tell me how the outputs of the process link into other processes. (ISO 9001:2000)
- Tell me how this process operates. (ISO 9001:2000)
- Tell me what the objectives of the processes are. (ISO 9001:2000)
The next step is to verify that the processes are operated consistently by looking at objective evidence of compliance such as records, employee knowledge, compliant product handling. So recommended questions are:
- Show me the procedure or workmanship standard that explains what you just told me.
- Show me how the process is monitored/operated. (ISO 9001:2000)
- Show me how the objectives are defined. (ISO 9001:2000)
- Show me the records that show that you are always doing it.
- Can I talk to some employees who are involved in this activity or process?
- Can I witness some of this activity?
11.2 Gradual elevationThere is a gradual elevation in identifying a nonconformity from an observation:
- First you make an observation, based on objective evidence.
- If the objective evidence shows noncompliance, you check whether it is a minor nonconformity.
- Then you check whether it is a major nonconformity.
- DO NOT JUMP TO CONCLUSIONS.
The gradual elevation of observations as well as statements of conformance need to be substantiated by an audit trail, which is a collection of evidences that follow the path of the investigation relating to the particular activity or requirement.
K. THE AUDIT PATH:
The audit schedule will reflect a sequence of activities or personnel to be audited. This sequence is commonly called the audit path. An intelligent selection of the audit path is critical to a successful audit and should be conducted using description of the interaction between the processes of the quality management system. The important factors for this selection are:
For audits requiring more than one auditor the audit schedule will need to reflect multiple audit paths. Each auditor will have his own set of activities and processes to audit with a particular path. The different paths can overlap in the areas where the activity requires more than one auditor to achieve a proper sampling within the time allocated. The paths should also be selected according to auditor's expertise. I.e. an auditor with a strong administrative background should focus on the administrative processes such as Sales, and Purchasing.
- Audit scope: the activities in the audit path have to be within the audit scope, and need to ensure full coverage of all areas and processes to be audited.
- Availability of the auditee: the auditee needs to be available and auditable at the scheduled times.
- Activity/Process flow: The sequence of activities to be audited should be based on a description of the interaction between the processes and the quality management system. This will ensure effective auditing of the various processes, enable a better comprehension by the auditor of the quality management system, and facilitate the communication between auditor and auditee.
At some fixed times during the audit, the auditors need to meet and exchange notes based the observations made in their particular audit paths. This is necessary to evaluate the level of gravity of nonconformities. If all the auditors found the same type of nonconformity in their audit paths, it will indicate that the nonconformity is systemic and is therefore major. They also need to coordinate audit activities for interrelated processes, by exchanging information on the outputs of processes that may be inputs for other processes.
L. EFFECTIVE COMMUNICATION TECHNIQUES:
Psychology is an extremely important factor in the success of the audit. Failure to communicate effectively by taking into account the psychology of the auditee can actually yield to degradation rather then improvement of an activity or process, mainly because of resentful or disgruntled auditees. So the proper actions are:
- Evaluate the auditee, to see how receptive he/she is to the audit.
- Evaluate the situation to see whether the auditee is not in an uncomfortable position during the audit i.e. being watched and scrutinized by his boss while being audited.
- Evaluate how the auditee perceives you in view of previous audits, or professional relationship.
- Make the auditee comfortable by adopting an attitude, taking an action or making positive statements that will help diffuse any possible tension detected from the issues listed above.
- Ask open-ended questions and listen.
- Control the interview and make sure the auditee does not lead the interview.
- Manage time in order to achieve the goal of the audit within the time allocated.
- Make sure the auditee understands that you are not auditing him or her, you are auditing the system.
M. SAMPLING: DOsShow interest. Remove distractions.
Show empathy.
Show patience.
Ask precise questions.
Focus on the requirements of the standard.
DON'TsJudge or be negative. Lose focus.
Lose track of original question.
Interfere with auditee's thoughts.
Hear what you want to hear.
Feel superior in any way to the auditee.
The definition of sampling is: the act, process, or technique of selecting a suitable sample; specifically: the act, process, or technique of selecting a representative part of a population for the purpose of determining parameters or characteristics of the whole population. For audits it is a technique used in order to collect sufficient objective evidence to determine whether a process or system is in compliance or has nonconformities to the standard (ISO 9001, ISO 14001 or others). Examples of a sampling population for an audit are members of an auditee's organization, or records to review.
Looking at all the records or interviewing every single employee is very often not possible because of time and resource constraints on the audit team. Therefore representative samples of employees are interviewed and representative samples of records are reviewed.
The sample size selection is very subjective but the following guidelines are recommended.
1. Take an initial random sample of 15-25% of the records you need to review. Use lower samples sizes when the number of records is large. For the number of employees to interview/audit, the same percentage sampling guideline can be applied.2. If the records show objective evidence of compliance, you can make the observation that you have objective evidence of compliance. Document a description of the sample you reviewed.
3. If the initial sample shows objective evidence of noncompliance, take an additional 15% random sample to determine the severity of the nonconformity.
N. AUDIT COMPLETION & FOLLOW UP:
6.7 Completing the auditThe audit is completed when all activities described in the audit plan have been carried out and the approved audit report has been distributed.
Documents pertaining to the audit should be retained or destroyed by agreement between the participating parties and in accordance with audit program procedures and applicable statutory, regulatory and contractual requirements.
Unless required by law, the audit team and those responsible for managing the audit program should not disclose the contents of documents, any other information obtained during the audit, or the audit report, to any other party without the explicit approval of the audit client and, where appropriate, the approval of the auditee. If disclosure of the contents of an audit document is required, the audit client and auditee should be informed as soon as possible.
6.8 Conducting audit follow-up
The conclusions of the audit may indicate the need for corrective, preventive or improvement actions, as applicable. Such actions are usually decided and undertaken by the auditee within an agreed timeframe and are not considered to be part of the audit. The auditee should keep the audit client informed of the status of these actions.
The completion and effectiveness of corrective action should be verified. This verification may be part of a subsequent audit. The audit program may specify follow-up by members of the audit team, which adds value by using their expertise. In such cases, care should be taken to maintain independence in subsequent audit activities.
O. COMPETENCE & EVALUATION OF AUDITORS
7.1 General
Confidence and reliance in the audit process depends on the competence of those conducting the audit. This competence is based on the demonstration of
the personal attributes described in 7.2, and
the ability to apply the knowledge and skills described in 7.3 gained through the education, work experience, auditor training and audit experience described in 7.4.
This concept of competence of auditors is illustrated in Figure 4. Some of the knowledge and skills described in 7.3 are common to auditors of quality and environmental management systems, and some are specific to auditors of the individual disciplines.
Auditors develop, maintain and improve their competence through continual professional development and regular participation in audits (see 7.5).
A process for evaluating auditors and audit team leaders is described in 7.6.
Figure 4 — Concept of competence
7.2 Personal attributesAuditors should possess personal attributes to enable them to act in accordance with the principles of auditing described in clause 4.
An auditor should be:
a) ethical, i.e. fair, truthful, sincere, honest and discreet;
b) open-minded, i.e. willing to consider alternative ideas or points of view;
c) diplomatic, i.e. tactful in dealing with people;
d) observant, i.e. actively aware of physical surroundings and activities;
e) perceptive, i.e. instinctively aware of and able to understand situations;
f) versatile, i.e. adjusts readily to different situations;
g) tenacious, i.e. persistent, focused on achieving objectives;
h) decisive, i.e. reaches timely conclusions based on logical reasoning and analysis; and
i) self-reliant, i.e. acts and functions independently while interacting effectively with others.
7.3 Knowledge and skills
7.3.1 Generic knowledge and skills of quality management system and environmental management system auditors
Auditors should have knowledge and skills in the following areas.
a) Audit principles, procedures and techniques: to enable the auditor to apply those appropriate to different audits and ensure that audits are conducted in a consistent and systematic manner. An auditor should be able
to apply audit principles, procedures and techniques,
to plan and organize the work effectively,
to conduct the audit within the agreed time schedule,
to prioritize and focus on matters of significance,
to collect information through effective interviewing, listening, observing and reviewing documents, records and data,
to understand the appropriateness and consequences of using sampling techniques for auditing,
to verify the accuracy of collected information,
to confirm the sufficiency and appropriateness of audit evidence to support audit findings and conclusions,
to assess those factors that can affect the reliability of the audit findings and conclusions,
to use work documents to record audit activities,
to prepare audit reports,
to maintain the confidentiality and security of information, and
to communicate effectively, either through personal linguistic skills or through an interpreter.
b) Management system and reference documents: to enable the auditor to comprehend the scope of the audit and apply audit criteria. Knowledge and skills in this area should cover
the application of management systems to different organizations,
interaction between the components of the management system,
quality or environmental management system standards, applicable procedures or other management system documents used as audit criteria,
recognizing differences between and priority of the reference documents,
application of the reference documents to different audit situations, and
information systems and technology for, authorization, security, distribution and control of documents, data and records.
c) Organizational situations: to enable the auditor to comprehend the organization's operational context. Knowledge and skills in this area should cover
organizational size, structure, functions and relationships,
general business processes and related terminology, and
cultural and social customs of the auditee.
d) Applicable laws, regulations and other requirements relevant to the discipline: to enable the auditor to work within, and be aware of, the requirements that apply to the organization being audited. Knowledge and skills in this area should cover
local, regional and national codes, laws and regulations,
contracts and agreements,
international treaties and conventions, and
other requirements to which the organization subscribes.
7.3.2 Generic knowledge and skills of audit team leaders
Audit team leaders should have additional knowledge and skills in audit leadership to facilitate the efficient and effective conduct of the audit. An audit team leader should be able
to plan the audit and make effective use of resources during the audit,
to represent the audit team in communications with the audit client and auditee,
to organize and direct audit team members,
to provide direction and guidance to auditors-in-training,
to lead the audit team to reach the audit conclusions,
to prevent and resolve conflicts, and
to prepare and complete the audit report.
7.3.3 Specific knowledge and skills of quality management system auditors
Quality management system auditors should have knowledge and skills in the following areas.
a) Quality-related methods and techniques: to enable the auditor to examine quality management systems and to generate appropriate audit findings and conclusions. Knowledge and skills in this area should cover
quality terminology,
quality management principles and their application, and
quality management tools and their application (for example statistical process control, failure mode and effect analysis, etc.).
b) Processes and products, including services: to enable the auditor to comprehend the technological context in which the audit is being conducted. Knowledge and skills in this area should cover
sector-specific terminology,
technical characteristics of processes and products, including services, and
sector-specific processes and practices.
7.3.4 Specific knowledge and skills of environmental management system auditors
Environmental management system auditors should have knowledge and skills in the following areas.
a) Environmental management methods and techniques: to enable the auditor to examine environmental management systems and to generate appropriate audit findings and conclusions. Knowledge and skills in this area should cover
environmental terminology,
environmental management principles and their application, and
environmental management tools (such as environmental aspect/impact evaluation, life cycle assessment,
environmental performance evaluation, etc.).
b) Environmental science and technology: to enable the auditor to comprehend the fundamental relationships between human activities and the environment. Knowledge and skills in this area should cover
the impact of human activities on the environment,
interaction of ecosystems,
environmental media (e.g. air, water, land),
management of natural resources (e.g. fossil fuels, water, flora and fauna), and
general methods of environmental protection.
c) Technical and environmental aspects of operations: to enable the auditor to comprehend the interaction of the auditee’s activities, products, services and operations with the environment. Knowledge and skills in this area should cover
sector-specific terminology,
environmental aspects and impacts,
methods for evaluating the significance of environmental aspects,
critical characteristics of operational processes, products and services,
monitoring and measurement techniques, and
technologies for the prevention of pollution.
O. COMPETENCE & EVALUATION OF AUDITORS (Cont.)
7.4 Education, work experience, auditor training and audit experience
7.4.1 Auditors
Auditors should have the following education, work experience, auditor training and audit experience.
a) They should have completed an education sufficient to acquire the knowledge and skills described in 7.3.
b) They should have work experience that contributes to the development of the knowledge and skills described in 7.3.3 and 7.3.4. This work experience should be in a technical, managerial or professional position involving the exercise of judgment, problem solving, and communication with other managerial or professional personnel, peers, customers and/or other interested parties.
Part of the work experience should be in a position where the activities undertaken contribute to the development of knowledge and skills in
the quality management field for quality management system auditors, and
the environmental management field for environmental management system auditors.
c) They should have completed auditor training that contributes to the development of the knowledge and skills described in 7.3.1 as well as in 7.3.3 and 7.3.4. This training may be provided by the person's own organization or by an external organization.
d) They should have audit experience in the activities described in clause 6. This experience should have been gained under the direction and guidance of an auditor who is competent as an audit team leader in the same discipline.
NOTE The extent of direction and guidance (here and in 7.4.2, 7.4.3 and Table 1) needed during an audit is at the discretion of those assigned the responsibility for managing the audit program and the audit team leader. The provision of direction and guidance does not imply constant supervision and does not require someone to be assigned solely to the task.
7.4.2 Audit team leadersAn audit team leader should have acquired additional audit experience to develop the knowledge and skills described in 7.3.2. This additional experience should have been gained while acting in the role of an audit team leader under the direction and guidance of another auditor who is competent as an audit team leader.
7.4.3 Auditors who audit both quality and environmental management systemsQuality management system or environmental management system auditors who wish to become auditors in the second discipline
a) should have the training and work experience needed to acquire the knowledge and skills for the second discipline, and
b) should have conducted audits covering the management system in the second discipline under the direction and guidance of an auditor who is competent as an audit team leader in the second discipline.
An audit team leader in one discipline should meet the above recommendations to become an audit team leader in the second discipline.
7.4.4 Levels of education, work experience, auditor training and audit experienceOrganizations should establish the levels of the education, work experience, auditor training and audit experience an auditor needs to gain the knowledge and skills appropriate to the audit program by applying Steps 1 and 2 of the evaluation process described in 7.6.2.
Experience has shown that the levels given in Table 1 are appropriate for auditors conducting certification or similar audits. Depending on the audit program, higher or lower levels may be appropriate.
Table 1 — Example of levels of education, work experience, auditor training and audit experience for auditors conducting certification or similar audits
Parameter
Auditor
Auditor in both disciplines
Audit team leader
Education
Secondary education
(see Note 1)
Same as for auditor
Same as for auditor
Total work experience
5 years
(see Note 2)
Same as for auditor
Same as for auditor
Work experience in quality or environmental
management field
At least 2 years of the total 5 years
2 years in the second
discipline (see Note 3)
Same as for auditor
Auditor training
40 h of audit training
24 h of training in the second
discipline
(see Note 4)
Same as for auditor
Audit experience
Four complete audits for a
total of at least 20 days of
audit experience as an
auditor-in-training under the
direction and guidance of an
auditor competent as an
audit team leader (see
Note 5).
The audits should be
completed within the last
three consecutive years
Three complete audits for a
total of at least 15 days of
audit experience in the
second discipline under the
direction and guidance of an
auditor competent as an
audit team leader in the
second discipline (see
Note 5).
The audits should be
completed within the last two
consecutive years
Three complete audits for a
total of at least 15 days of
audit experience acting in
the role of an audit team
leader under the direction
and guidance of an auditor
competent as an audit team
leader (see Note 5).
The audits should be
completed within the last two
consecutive years
NOTE 1 Secondary education is that part of the national educational system that comes after the primary or elementary stage, but that is
completed prior to entrance to a university or similar educational institution.NOTE 2 The number of years of work experience may be reduced by 1 year if the person has completed appropriate post-secondary
education.NOTE 3 The work experience in the second discipline may be concurrent with the work experience in the first discipline.
NOTE 4 The training in the second discipline is to acquire knowledge of the relevant standards, laws, regulations, principles, methods and
techniques.NOTE 5 A complete audit is an audit covering all of the steps described in 6.3 to 6.6. The overall audit experience should cover the entire
management system standard.
7.5 Maintenance and improvement of competence
7.5.1 Continual professional development
Continual professional development is concerned with the maintenance and improvement of knowledge, skills and personal attributes. This can be achieved through means such as additional work experience, training, private study, coaching, attendance at meetings, seminars and conferences or other relevant activities. Auditors should demonstrate their continual professional development.
The continual professional development activities should take into account changes in the needs of the individual and the organization, the practice of auditing, standards and other requirements.
7.5.2 Maintenance of auditing ability
Auditors should maintain and demonstrate their auditing ability through regular participation in audits of quality and/or environmental management systems.
7.6 Auditor evaluation7.6.1 General
The evaluation of auditors and audit team leaders should be planned, implemented and recorded in accordance with audit program procedures to provide an outcome that is objective, consistent, fair and reliable. The evaluation process should identify training and other skill enhancement needs.
The evaluation of auditors occurs at the following different stages:
the initial evaluation of persons who wish to become auditors;
the evaluation of the auditors as part of the audit team selection process described in 6.2.4;
the continual evaluation of auditor performance to identify needs for maintenance and improvement of knowledge and skills.
Figure 5 illustrates the relationship between these stages of evaluation.
The process steps described in 7.6.2 may be used in each of these stages of evaluation.
7.6.2 Evaluation processThe evaluation process involves four main steps.
Step 1 — Identify the personal attributes, and the knowledge and skills to meet the needs of the audit program
In deciding the appropriate knowledge and skills, the following should be considered:
the size, nature and complexity of the organization to be audited;
the objectives and extent of the audit program;
certification/registration and accreditation requirements;
the role of the audit process in the management of the organization to be audited;
the level of confidence required in the audit program;
the complexity of the management system to be audited.
Step 2 — Set the evaluation criteria
The criteria may be quantitative (such as the years of work experience and education, number of audits conducted, hours of audit training) or qualitative (such as having demonstrated personal attributes, knowledge or the performance of the skills, in training or in the workplace).
Step 3 — Select the appropriate evaluation method
Evaluation should be undertaken by a person or a panel using one or more of the methods selected from those in
Table 2. In using Table 2, the following should be noted:
the methods outlined represent a range of options and may not apply in all situations;
the various methods outlined can differ in their reliability;
typically, a combination of methods should be used to ensure an outcome that is objective, consistent, fair and reliable.
Step 4 — Conduct the evaluation
In this step the information collected about the person is compared against the criteria set in Step 2. Where a person does not meet the criteria, additional training, work and/or audit experience are required, following which there should be a re-evaluation.
An example of how the steps of the evaluation process might be applied and documented for a hypothetical internal audit program is illustrated in Table 3.
Evaluation Methods
Objectives
Examples
Review of records
To verify the background of the auditor
Analysis of records of education, training, employment and audit experience
Positive and negative
feedback
To provide information about how the performance of the auditor is perceived
Surveys, questionnaires, personal references, testimonials,
complaints, performance evaluation, peer review
Interview
To evaluate personal attributes and communication skills, to verify information and test knowledge and to
acquire additional information
Face-to-face and telephone
interviews
Observation
To evaluate personal attributes and the ability to
apply knowledge and skills
Role playing, witnessed audits, on-the-job performance
Testing
To evaluate personal attributes and knowledge and
skills and their application
</