Iso 9001 audit procedures


Published on

Iso 9001 audit procedures

Published in: Business
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Iso 9001 audit procedures

  1. 1. Iso 9001 audit proceduresPlanning for the Internal AuditThe key to an effective, thorough and value added internal audit is in the preparation. Ifinternal auditors are spending one to two hours preparing for an internal audit, it is notenough time. To properly prepare for an audit, it should take twice to three times that. Ifthe actual audit time will take an hour, there should be at between two and three hoursspent in preparation. A good rule of thumb to spend about two and half times as muchtime in preparation as the audit will take. Often times, auditors plan for a two hourinternal audit and spend 1 hour preparing which leads to them running out of questionsabout 30 minutes into the audit. I cant stress this enough if you want to be a successfulinternal auditor or manage a successful internal audit program then make certain youspend adequate time in preparation for the audit.This sounds easy, but it is actually very difficult. The major obstacles to allocatingenough time for preparation are time restrictions placed on the internal auditors. Chancesare they have other responsibilities aside from internal auditing that compete for theirprecious time. One method to help remove that obstacle is to have as many trainedinternal auditors as possible to spread the work load.Effective planning for an internal audit requires following a few simple steps that arelisted below.1. Learn the process (turtle diagram)2. Identify the interfaces with the standard3. Document review (compliance to standard)4. Identify process interfaces5. Identify potential process failure modes (pFMEA)6. Value stream map process to breakdown activities7. Review old audits8. Develop audit questions9. Develop audit plan.1. Learn the processBefore you can audit a process you must become familiar with it. You need to learn howit is supposed to work, what it supposed to do, what are the inputs, outputs, activities,resources and controls. The first step would be to create a turtle diagram of the process(This may have already been done by the organization as part of their documentation, orin previous audits). A turtle diagram looks at the suppliers, inputs, activities, controls,resources, outputs, and customers. A turtle diagram is laid out such that the processactivity is a box in the middle, the inputs come in from the left and outputs exit from the
  2. 2. right of the box. The supplier is listed in the upper left hand corner and the customer islisted in the upper right hand corner. The controls are above the process activity and theresources are below the process activity. The feedback loop is an arrow from the outputto the input. Lets do an example of a turtle diagram for a process. For this example, theprocess will be one that applies to about every business in some way and thatspurchasing.Inputs:This is what the process needs for the activity. It can be in the form of information or aproduct. For this example the inputs are: Demand (what is driving the purchase),Quantity, Type, Specifications and Requirements, Due date and Budget (how much canbe spent).Supplier:This is who is supplying the inputs to the process. The supplier can supply information ora material product. For our example the supplier would be whoever is specifying what topurchase, when to purchase and how many to purchase.Process Activity:This is the process. There are a number of associated tasks contributing to the process.For our example the process activity is purchasingOutputs:This is the result of the process. It can be information, energy or material. In our examplethe output of the purchasing process is the desired product or service delivered whenneeded. For our example it could be a product like a computer or piece of test equipment.It could be information such as a failure analysis, training materials, book or manual. Itcould also be a service such as mowing the grass, doing the laundry or processingpayroll.Controls:These are the items that regulate the rate at which inputs are converted to outputs.Without controls, the process would operate continuously generating the output. Thecontrols for our example could be the material requirements planning software, thepurchase requisition approval process and inventory analysis.Resources:These are the items used or consumed in the process activity. It could be peoples time,machine time or money. For our example, the resources would be the buyer or purchasingagent, money, the representative for the company supplying the product or service and
  3. 3. possibly other support functions who have input for the purchase. Additional resourcesare in the form of computers, material planning software, phones, fax, office space, etc.Customer:The customer is the group that takes the output and uses it. It is most likely used as aninput to another process or as a resource.Feedback Loop:This is the mechanism used to monitor the process. What metric is used to tell the processowner how the process is performing and when action needs to be taken to correct it. Fora purchasing process it could be supplier performance, dollars spent, on-time delivery orreceiving inspection information.2. Identify the Interfaces to the StandardThe interfaces are the points where the process intersects the standard. In simple terms itis where the requirements of the ISO 9001:2000 standard are applicable to the processbeing audited. The easiest way to accomplish this is to use a matrix with the elements ofthe standard on one axis and the process name on the other.To better discern the interfaces of the process to the standard you could break theelements down into the sub elements. For example, 7.2 Customer Related Processes iscomprised of 7.2.1 Determination of requirements related to the product, 7.2.2 Review ofrequirements related to the product and 7.2.3 Customer communication. The left side ofthe matrix would become larger, but you would have a more definitive intersection of theprocess and standard. This activity provides you with the understanding of what areas ofthe standard apply to the process. You will be developing questions to ensure complianceto the standard and this tells you what areas of the standard to focus on.3. Document ReviewThe document review section requires reading and understanding the associateddocumentation for the process you are auditing. Start with the level 1 document, thequality manual. The quality manual should provide an overview of the process andshould describe how the process fits into the overall quality system. The quality manualwill explain what processes feed the process you are auditing and what processes aresupported by it. It will describe the interaction and interrelationship of processes withinthe quality system.The main output from the review of the quality manual will be an understanding of all theprocesses that make up the quality system and how they interact. The quality manualshould provide a good description of how the processes work.
  4. 4. Next, review the level 2 documentation or procedures. Procedures should describe theprocess in more detail than the quality manual. There could be many procedures outliningthe quality system, or there could be the minimum required by the ISO 9001:2000standard, six. The six required procedures are:Control of documentsControl of recordsInternal AuditsControl of nonconforming productCorrective actionPreventive actionSince the ISO 9001:2000 standard requires less documentation than previous versions ofISO 9000, there may not be as many procedures to evaluate. In this case the documentreview portion will be reduced. During the document review of the manual andprocedures your are trying to understand the process and the system and ensure therequirements of the standard are met.4. Identify Process InterfacesProcess interfaces are the "hand off" points from one process to another. This is wherethe previous process in providing an input to the audited process and the audited processis providing input to another process. How are process interfaces different from inputsand outputs? An input is the deliverable the process uses and the process interfacedescribes how and when the deliverable is achieved. For example, an input into thepurchasing process is the requirements of the purchased item. Looking at the processinterface we want to understand how are the requirements delivered to the purchasingprocess, when are they delivered and by whom? In essence we are not looking at do therequirements exist, but are they clearly defined and understood by the process usingthem. We want to investigate are the requirements delivered on time and are theyaccurate?On the output side, we will look at those things the purchasing process provides to otherprocesses. Clearly one output is the purchased item on time, to specification and in thecorrect quantity. Another consideration is how is it moved from purchasing to receivingand inventory. There are other outputs of the purchasing process used by other processes.One could be supplier selection for the item purchased. Engineering or Quality may needto interface with the supplier and if the selection process is delayed, it could affect thedesign, or ability to qualify the product.Understanding the process interfaces can lead to some audit questions concerning howsmooth the hand off is between processes.5. Identify Potential Process Failure Modes
  5. 5. Another tool we want to utilize is the pFMEA, which stands for "process failure modesand effects analysis. You may have some background in FMEAs and you may not.Either way is alright because we are not going in depth in the FMEA process. AnpFMEA is a method to identify potential problems with a process before the process isimplemented. It is a preventive measure that aims to resolve problems before they occur.For our purposes we will be concerned with the process function, the failure mode andthe cause of the failure mode. Below is an example of an pFMEA for the purchasingprocess:Process Function Failure Mode Potential Causeget good product bad product requirements not understoodsupplier is not capablenot inspected enoughproduct on time product is late lack of capacityordered latesupplier out of productlow total cost too costly excessive reworkexcessive freightexcessive testingpFMEAs are an exhaustive approach that generates a large quantity of potential auditdirections. By evaluating the prospective problems associated with a process, you candevelop audit questions and an audit approach to ensure the potential problems areaddressed. This can lead to some findings that can have positive impact on the qualitymanagement system.6. Value Stream Map the ProcessIf you really want to energize the efficiency factor of your internal audits, then conduct avalue stream map. Value stream mapping is a lean manufacturing tool that aids in findingthe activities in the process that are non value added. Similar to the pFMEA example wewill approach this tool in an overview so it can be used but we wont go into great detailand explicit flowcharting that a lean project might require. Lean initiatives would includetake time, inventory, etc, we will not include those for this use of the tool. For thispurpose you will flowchart the process activities and look for steps that could beeliminated or reduced.
  6. 6. 7. Review Old AuditsA key source of information to develop your audit strategy is to review old audits.Review both internal and external audits if available. Look for areas of weakness orwhere findings were noted and see if action has been taken and if its still effective. Inreviewing an old audit of purchasing you find that there was a nonconformity written forthe buyer not conveying to the supplier all of the requirements of the product. Based onthis you may want to gear some of the audit to see how effective the process is now atconveying the requirements to the supplier.8. Develop Audit QuestionsWhat we want to do now in the planning process is develop some questions based on theexercises listed above.Turtle Diagram generated questions:How are the requirements for the purchased item documented and communicated?Who specifies a budget and who monitors it to ensure it is not exceeded?What training has the purchasing agent received and what is scheduled?How is inventory monitored to ensure correct purchases at the right time?What is the measure of the process?Who monitors it?What are the planned results and what happens when they are not achieved?Interface with the Standard generated questions:Is there a procedure or work instructions describing the process?Is the purchasing process covered in the quality manual?Does the current process reflect what is documented?How does the purchasing agent know what their responsibilities and authorities are?Do they know and understand the quality policy and quality objectives? What does itmean to them?How are suppliers selected and rated? Is it effective?How are purchased items evaluated when received?What happens when a purchased item is received and does not meet requirements?Who reviews the data from the purchasing process? Does the data get delivered tomanagement?How has the purchasing process been improved? Has it shown improvement and what iscurrently being done to improve it?9. Develop Audit PlanUp to now you have developed an understanding of the business process you will audit,you have also used various tools to identify some audit questions or paths. Now we willtake this one step further and develop the audit plan. The audit plan is your playbook for
  7. 7. the audit. If you fail to plan, then you plan to fail. This statement couldnt be any moretrue than in the auditing functions. You develop the audit plan based on the questions andwho you will audit.Based on our previous work, we will develop our audit plan as follows:Auditee: Purchasing agent1. Explain to me how the purchasing process works?Verify that it is consistent with whatever is documented.Document what is said, does it match what you had perceived? If not make adjustmentsin your audit plan.2. How are the requirements for the purchased item documented and communicated toyou? Pick a critical purchased part and look for evidence of requirements being specified.Are they clear and do they communicate the quantity, time frame and budget?3. How are the requirements communicated to the supplier? Look for records that thesupplier has acknowledged the requirements or was sent them. You can also later reviewthe incoming inspection or records relating to problems with this part, quality, delivery,quantity or price, this can be a reflection of how well they understand the requirements.4. How are the suppliers selected? Look for evidence they followed their process andverify the effectiveness based on complaints or issues with the product.5. How is it verified the suppliers are capable? Look for evidence that someone evaluatedthem for ability to meet the requirements. Can they produce to the specifications? Wascapability studies done? Do they have the capacity?You can continue this process to develop a larger audit plan. You can even developquestions and expected responses for other people such as engineering, quality,manufacturing, material control, etc. It depends upon the scope of the purchasing processand who is involved.If you want to download over free 50 ebook for iso 9001 standard, you can visit:http://iso9001ebooks.infoBest regards