Rolly Ceniza Remitar
Internal Audit Training
with Root Cause Analysis
• Interpret and apply the elements
of the ISO Standards
• Plan and prepare for an internal
audit
• Develop a practical checklist
• Develop and use audit
documentation
• Conduct an internal audit
• Develop an internal audit report
• Present audit findings in a
constructive manner
• Determine the roles and
responsibilities of an internal
auditor
• Conduct root cause analysis
Program
Overview of ISO
Standards
Principles and Process
 Differentiating internal
from external audits
Internal and external
audits
 Conducting internal audit
Conducting virtual audit
 Auditor’s competence
and evaluation
Day 1
 Evaluating audit situations
Writing audit findings
Review Standard’s
Requirements and how to
audit these requirements
 Simulating internal audit –
opening to closing meeting;
Root Cause Analysis
2-hour examination
Day 2
PRE-REQUISITE OF THIS COURSE
You have attended the ISO 9001:2015
Awareness Seminar covering all the
10 clauses of the standard
Go over with your ISO 9001:2015
Standard
Determine the applicable clauses in your area.
Open your ISO 9001 standard
OVERVIEW OF ISO 19011:2018
Scope
Normative references
Terms and definitions
Principles of auditing
Managing an audit programme
Establishing the audit programme objectives
Establishing the audit programme
Implementing the audit programme
Monitoring the audit programme
Reviewing and improving the audit programme
Performing an audit
Initiating the audit
Preparing audit activities
Conducting the audit activities
Preparing and distributing the audit report
Completing the audit
Conducting audit follow-up
Competence and evaluation of auditors
Determining auditor competence to fulfil the needs of the audit programme
Establishing the auditor evaluation criteria
Selecting the appropriate auditor evaluation method
Conducting auditor evaluation
Maintaining and improving auditor competence
Annex A (informative) Guidance and illustrative examples of discipline-specific knowledge and skills of
auditors
Annex B (informative) Additional guidance for auditors for planning and conducting audits
Audit Principles,
Concepts and
Process
DEFINITION
Systematic, independent and
documented (verification)
process for obtaining audit
evidence and evaluating it
objectively to determine the
extent to which the audit
criteria are fulfilled
by ISO 19011:2018
As defined in ISO 19011:
•Systematic – PDCA Approach; organized,
methodical, planned
•Independent – Auditors shall not audit their
own work
•Documented – accompanied with
documentation; recorded in writing
•Verification process – information is
confirmed, cross-checked and validated
DIFFERENCE BETWEEN INSPECTION
AND AUDIT
Inspection is checking of documents, records,
facilities and any other resources to verify a
certain set of requirements which is usually
conducted by regulatory agencies
Auditing is systematic, independent checking,
examining and analyzing the processes and
performance based on standards and specific
guidelines
AUDIT
INSPECTION
Why we conduct an internal audit?
• check before the customer
• remind us of the way of doing and make sure
that problems are avoided
• monitor conformance/compliance to any
standards or established system within the
organization
• evaluate the management system that can be
used in action plans
• mandatory requirement of any management
system
Who are involved?
1. Auditor – collects
evidence and
determine findings
2. Auditee – entity
being audited
3. Client – party
commissioning the
audit
AUDIT EVIDENCE
Audit
evidence
Persuasive
(Convincing,
Valid)
Relevance
(Connected,
Appropriate)
Sufficiency
(adequate) &
Trustworthiness
(honest)
AUDIT EVIDENCE
Verified
observations
Verified
verbal
information
Written
information
TOOLS FOR DECISION MAKING
Intuition Common sense Professional judgment
Guidelines for evaluating quality of audit
evidence
1. Relevance
2. Objectivity
3. Documentation
4. Integrity
5. Sample size
Audit Objectives and Criteria
Set of policies,
procedures or
requirements
Why an audit is being
conducted;
Define what is to be
accomplished
WORKSHOP
Determine the applicable audit evidence
4.0 Context of the Organization
4.1 Understanding the organization and its context
4.2 Needs & Expectations of Interested Parties
4.3 Scope of Quality Management System
4.4 Quality Management System and Processes
5.0 Leadership
5.1 Leadership and Commitment
5.2 Policy
5.3 Roles, Responsibilities & Authorities
6.0 Planning
6.1 Risks and Opportunities
6.2 Quality Objectives
6.3 Planning of changes
WORKSHOP
Determine the applicable audit evidence
7.0 Support
7.1 Resources
7.2 Competence
7.3 Awareness
7.4 Communication
7.5 Documented Information
WORKSHOP
Determine the applicable audit evidence
8.0 Operation
8.1 Operational planning and control
8.2 Requirements for products and services
8.3 Design and Development
8.4 Control of External Providers
8.5 Production and Service Provision
8.6 Release of products and services
8.7 Control of Nonconforming Outputs
WORKSHOP
Determine the applicable audit evidence
9.0 Performance Evaluation
9.1 Monitoring, Measurement, Analysis and
Evaluation
9.2 Internal Audit
9.3 Management Review
10.0 Improvement
10.1 General
10.2 Nonconformity and Corrective Action
10.3 Continual Improvement
WORKSHOP
Determine the applicable audit evidence
Audit Objectives
Why an audit is
being conducted;
Define what is to
be accomplished
Audit Criteria
Set of policies,
procedures or
requirements.
Used as a
reference against
which audit
evidence is
compared
Audit Scope
Process Area
Functional
unit
Location Site/Branches
Audit Findings
• Fulfillment of requirements
Conformity / Compliant
• Non fulfillment; deviation
• Catastrophic/Critical, Major, Minor
Nonconformity / Non compliant
• Fulfilled requirements however, there is a better way
to do things
Opportunities for improvement (and/or
good practices) / Positive findings
Classification of Audit Findings
(ISO 19011:2018 Clause 6.4.8)
Nonconformities can be graded depending on
the context of the organization and its risks.
This grading can be quantitative (e.g. 1 to 5)
and qualitative (e.g. minor, major). They should
be reviewed with the auditee in order to obtain
acknowledgement that the audit evidence is
accurate and that the nonconformities are
understood
Audit findings = Audit conclusion
Outcome of an
Audit: AUDIT
CONCLUSION
After consideration of the audit
objectives and all audit findings
Audit Types
• 1st party – internal
audits of the system
• 2nd party – supplier
audits
• 3rd party – independent
or certification audits
(external)
Internal Audit Objectives
1st party audit
(rationale)
Verify corrective action
Applicability of procedures
and work instructions
Identify potential
danger spots
Verify implementation and results
Organizational changes (establish/
identify minimum competency
requirements)
Audit Types
• Customer audits supplier with
their staff
• Beneficiaries – supplier and
customer
• Style – can be formal or informal
depending on whether the
contract is at stake or whether for
improvement
• Planning – varies depending on
relation with supplier
• Depth –detail depends on the
contract
• Follow up – depends on the
contract
EXTERNAL AUDIT – 2nd party
Auditors – independent
Beneficiaries – company
Style – formal according to
protocols
Planning – done in detail
per protocol
Depth – sufficient to check
compliance and
effectiveness
Follow up – CA is always
verified
EXTERNAL AUDIT – 3rd party
Audit Approach
Vertical - looks in depth at a particular function or
department; monitors the use of all relevant
procedures as they are used. E.g. auditing the
Purchasing Dept. covering training, document
control and etc
Horizontal – follow a process from start to end;
looks at procedures as they support process;
E.g. Document Control in different areas or
training records
7 Audit Principles
INTEGRITY
Foundation of professionalism;
auditors perform their work with honesty, diligence and
responsibility (character, not uncontrollable factors that
could exert influence)
FAIR PRESENTATION
The obligation to report truthfully and accurately;
Audit findings, conclusions and reports should reflect
truthfully and accurately the audit activities (personal
issues)
DUE PROFESSIONAL CARE The application of diligence and judgment in auditing;
Auditors having the ability to make reasoned judgments
in all audit situations
7 Audit Principles
CONFIDENTIALITY Security of information;
Prudence in the use and protection of information acquired in
the course of their duties; information should not be used
inappropriately for personal gain by the auditor or audit client
or manner detrimental to auditee’s interest (personal
attributes)
INDEPENDENCE
The basis for the impartiality of the audit and objectivity of the
audit conclusions;
Auditors should be independent of the activity being audited
(size, qualified persons)
EVIDENCE-BASED APPROACH The rational method for reaching reliable and reproducible
audit conclusions in a systematic audit process; audit evidence
is verifiable; based on samples (and sampling) (negligence)
7 Audit Principles
Risk-based approach: an audit
approach that considers risks
and opportunities
The risk-based approach should
substantively influence the
planning, conducting and
reporting of audits in order to
ensure that audits are focused
on matters that are significant
for the audit client, and for
achieving the audit programme
RISKS
• planning, e.g. failure to set relevant audit objectives and determine the extent, number,
duration, locations and schedule of the audits;
• resources, e.g. allowing insufficient time, equipment and/or training for developing the
audit programme or conducting an audit;
• selection of the audit team, e.g. insufficient overall competence to conduct audits
effectively;
• communication, e.g. ineffective external/internal communication processes/channels;
• implementation, e.g. ineffective coordination of the audits within the audit programme, or
not considering information security and confidentiality;
• control of documented information, e.g. ineffective determination of the necessary
documented information required by auditors and relevant interested parties, failure to
adequately protect audit records to demonstrate audit programme effectiveness;
• monitoring, reviewing and improving the audit programme, e.g. ineffective monitoring of
audit programme outcomes;
• availability and cooperation of auditee and availability of evidence to be sampled
OPPORTUNITIES
• allowing multiple audits to be conducted in a
single visit;
• minimizing time and distances travelling to
site;
• matching the level of competence of the
audit team to the level of competence
needed to achieve the audit objectives;
• aligning audit dates with the availability of
auditee’s key staff.
AUDITOR’S CHARACTERISTICS
• ethical behavior
• open-mindedness
• diplomacy
• observational skills
• perceptive (insightful)
• versatility
• Tenacity/persistent
• decisiveness
• self-reliance/get things done
• Fortitude (strength in mind)
• openness to improvement
• cultural sensitivity, and
• collaboration
THE AUDIT PROCESS
Basis of Internal Audit
ISO 9001: 2015
9.2 .1 The organization shall conduct internal audits at
planned intervals to provide information on quality
management system:
• conforms to:
– the organization’s own requirements for its
environmental management system;
– the requirements of this International Standard;
• is effectively implemented and maintained.
Basis of Internal Audit
-Selection of auditors and conduct of
audits shall ensure objectivity and
impartiality of the audit process.
-Auditors shall not audit their own work.
-The responsibilities and requirements for
planning and conducting audits, and for
reporting results and maintaining records
shall be defined in a documented
procedure.
Audit Programme
ISO 19011 defines it as:
‘arrangements for a
set of one or more
audits planned for a
specific time frame
and directed
towards a specific
purpose’
ISO 19011:2018
Manage Audit Programme
• PLAN
Establish audit programme objectives and audit
programme
• DO
Implement the audit programme –
competence and evaluation of auditors
performing an audit
• CHECK
Monitoring and measuring audit programme
effectiveness
• ACT
Reviewing and improving the audit programme
Information Needed in the Audit Programme
• objectives for the audit programme;
• risks and opportunities associated with the audit
programme and the actions to address them;
• scope (extent, boundaries, locations) of each
audit within the audit programme;
• schedule (number/duration/frequency) of the
audits;
• audit types, such as internal or external
• audit criteria;
• audit methods to be employed;
• criteria for selecting audit team members;
• relevant documented information;
• resources
Audit Programme Objectives
• identify opportunities for the improvement of a management
system and its performance;
• evaluate the capability of the auditee to determine its context;
• evaluate the capability of the auditee to determine risks and
opportunities and to identify and implement effective actions to
address them;
• conform to all relevant requirements, e.g. statutory and
regulatory requirements, compliance commitments, requirements
for certification to a management system standard;
• obtain and maintain confidence in the capability of an external
provider;
• determine the continuing suitability, adequacy and effectiveness
of the auditee’s management system;
• evaluate the compatibility and alignment of the management
system objectives with the strategic direction of the organization.
Audit Programme Contents
Essentially contains:
– Audit objectives
– Extent/number/types/locations/schedule
of the audits
– Main audit procedure
– Audit criteria – including combined
audit(s)
– Audit scope
– Audit methods
– Selection of audit team(s)
– Necessary resources
– Other concerns such as risks, uncertainties,
process for handling confidentiality,
information security, etc.
Audit Objectives, Scope and Criteria
Audit methods depend on the defined audit
objectives, scope and criteria, including
duration and location(sites).
• On site: interview, document review
• Off site: remote video auditing
Human
interaction
• On site: documentation review
• Site visit, sampling
• Off site: document review
Desktop
review
Audit Plan
Audit plan - description of the activities
and arrangements for an audit
-ISO 19011:2018
 Scope
 Criteria
 Objectives
 Schedule/Location/Timeline
 Program of activities
 Auditors assignment
 Auditees
Audit Plan: XYZ Company
Scope of application: Manufacturing of XYZ product
Applicable standard(s): ISO 9001:2015 AND ISO 14001:2015
Date / Time
(1)
Organizational Unit and /
or Processes
Auditor /
Abbrev.
Auditee Procedure - Element -
Standard Chapter
2016 September 23
9:00 Opening Meeting Management
Representative,
Department Head,
Coordinators
Introduction of the company, explanation of processes
& procedures,
fine-tuning of audit plan
9:15 Top Management Juan de la
Cruz
Pedro Penduko 4.1, 4.2, 4.3, 4.4, 4.6 , 5.1, 5.2, 5.3, 6.1, 6.2,6.3, 7.1,
5:30 Human Recourse 5.3, 6.0, 7.0. 8.0, 9.1, 10.0
WORKSHOP
FORMULATION OF AUDIT PLAN
CHECKLIST
CHECKLIST
-provide detail for each step of
a process
-allow us to stay organized
-Can be used as a visual
reminder
-Prioritize things we need to
ask
-Avoid missing important
items
WORKSHOP
Make your checklist
Implement the Audit Plan
– Actual conduct of audit activities
» Opening Meeting
» Collection and verification of
information
» Analysis of findings versus audit
criteria
» Closing meeting
Implement the Audit Plan
Opening Meeting – confirms the
audit plan and team introduction
• Auditee management and
process owners (auditees)
• Confirmation of audit
objectives, scope and criteria
and other arrangements
Communication during the audit
- exchange information
- assess audit progress
- reassign work between audit
team members
Conduct of Audit Proper
CONDUCTING INTERVIEW
• Should be held with individuals from
appropriate levels and functions
performing activities or tasks within the
audit scope
• Be conducted during normal working
hours and, where practical, at the normal
workplace of the individual being
interviewed;
• Be made to put the individual being
interviewed at ease prior to and during the
interview
• the reason for the interview and any
note taking should be explained;
• interviews may be initiated by asking
individuals to describe their work;
• the type of question used should be
carefully selected (e.g. open, closed,
leading questions, appreciative
inquiry);
CONDUCTING INTERVIEW
• awareness of limited non-verbal communication in
virtual settings; instead focus should be on the
type of questions to use in finding objective
evidence
• the results from the interview should be
summarized and reviewed with the interviewed
individual
• the interviewed individuals should be thanked for
their participation and cooperation.
CONDUCTING INTERVIEW
Conduct of audit proper
Observe
Collection and verification of information
Audit triangle
Audit methods
• Inspection
• Observation
• Inquiry
• Face to Face
• Virtual
Conduct of audit proper
Sources of information:
 Interviews with
employees
 Observation of
activities,
surrounding work
environment and
conditions
 Documents
 Records
VIRTUAL INTERNAL AUDIT
- Allowed by some certifying bodies during the
pandemic
- Use internet platform such as Zoom, Microsoft
Team, Messenger, email and Calls
- Conduct capability test (check the internet
connection, camera, sending email and evidence)
- Should ask the documents (e.g. risks, objectives,
procedures, requirements and
- Take SCREENSHOTS
SCREENSHOTS
Conduct of audit proper
Interview Techniques
 Themed questions
 Expansive questions
 Opinion questions
 Investigative questions
 Non verbal questions
 Repetitive questions
 Hypothetical questions
 Closed questions
 Leading questions
Examples of audit questions
“THOUGHTFUL APPRECIATIVE QUESTIONS”
Poor leading question
“DO YOU CONTROL NONCONFORMITY”
Open – ended question
“WHAT DO YOU DO IF THERE’S NONCONFORMITY”
appreciative question
“TELL ME ABOUT YOUR EXPERIENCE WHEN YOU
DISCOVERED A NONCONFORMITY”
Appreciative audit
“THOUGHTFUL APPRECIATIVE QUESTIONS”
Poor leading question
“DID YOU GET AN ON-THE-JOB TRAINING”
Open – ended question
“HOW WERE YOU TRAINED TO DO YOUR JOB”
appreciative question
“WHAT ARE THE TOP 3 THINGS ABOUT THE
TRAINING THAT GAVE YOU CONFIDENCE TO DO
YOUR JOB”
- Often times request for supplies are labeled as ASAP, I’m
astonished that you are able to meet the demands of
operation. Can you share your experience on how you do it?
- I know it hard to organize stuffs, can you show how you
organize the inventory of supplies and can you throw in
some tips that I can apply it my daily routine.
- Can you describe an experience where you went beyond the
directives to have a more advantageous or beneficial
purchasing process
Other sources of information
Consider also checking:
 Data analyses, performance index
 Reports from other sources
 Database and website(s)
Audit findings
Recording individual audit findings of conformity,
consider the following:
 Requirements of audit client
 Follow up of previous audit records and
conclusions
 Findings exceeding normal practice
Audit Findings
Recording non conformities; must
include the following:
 Requirements of audit criteria
(description)
 Declaration of nonconformity
 Audit evidence
 Related audit findings
Classification of Audit Findings
1. Positive Observation
Good practices implemented by
Organization.
2. Opportunities for
Improvement/Observations –
Requirements are fulfilled but can also further
improve the Management System
implementation
Classification of Audit Findings
3. Nonconformity
A. Major - Finding that would result in a failure of one or
more system processes that may have an effect on the
finished product/services, catastrophic to the organization.
It affects the capability of the management system to
achieve the intended results.
If there are number of minor nonconformities associated
with the same requirement or number of issues that could
demonstrate a systemic failure
 B. Minor – Finding that would result in a failure of a
process in the system that may have a minor effect on the
finished product/service. It does not affect the capability of
the management system to achieve the intended results
SAMPLE OF STATING POSITIVE
FINDINGS
1 Business
Continuity
The organization was able to continue the
virtual operations (training) in serving their
clients in the midst of pandemic
2 New
Branch
A new branch in Cebu was opened last
year to expand the business
3 New
business
There were new clients which contributed
to the increase of profits
4 Product
Line
A new product was developed and
introduced in the market
SAMPLE OF STATING OPPORTUNITIES OF IMPROVEMENT
No. Unit/Department
Site
Recommendations and opportunities for improvement
1 Management Review The conclusion of the effectiveness, adequacy and suitability of management
system may be included in the minutes of management review which can be
enhanced by setting measures of different criteria (e.g. effectiveness of risks,
customer satisfaction, objectives and etc)
2 Maintenance There a need to increase the frequency of mixers maintenance due to
frequent shutdown
3 Internal Audit May consider the following:
-training of more auditors
-identify risks associated in internal audit process
-add some item to trigger the update or review the management systems in
Corrective Action Report.
4 Documented
Information
Old versions of document may be further controlled since it can still be
accessed in the cloud
5 Human Resource The following may be ensured:
-retention of hiring documents
-tool in evaluating the effectiveness of coaching and mentoring
-checklist to be used in classroom observation)
WRITING NCs
• REQUIREMENT – Clause of standard, procedure,, work
instruction, legal requirements and etc
• PROBLEM – deficiency, deviation, statement of nonconformity
• LOCATION – where the deficiency/conformity was found (e.g.
receiving area, warehouse, office, etc)
• OBJECTIVE EVIDENCE – what documents are involved (e.g.
procurement specifications, engineering number)
EXAMPLE
• REQUIREMENT: Handling a Difficult Customer, mandatory
training before job assignment for a Customer Service Clerk
• DOCUMENT TITLE & REF NUMBER: Training Guideline (XYZ-
HRM-01) Rev. 1, Effective Jan. 5, 2020
• DEFICIENCY 12 Customer Service Clerks did not attend
training last Jan. 20-25, 2020 but have been handling
customers for one year.
.
LOCATION: Human Resource Department
EXAMPLE
• REQUIREMENT: Handling Difficult Customer, mandatory training before
job assignment for a Customer Service Clerk
• DOCUMENT TITLE & REF NUMBER: Training Guideline (XYZ-HRM-01)
Rev. 1, Effective Jan. 5, 2020
• DEFICIENCY 12 Customer Service Clerks did not attend training last Jan.
20-25, 2020 but have been handling customers for one year.
. LOCATION: Human Resource Department
STATEMENT
The organization shall ensure that these persons are competent on the
basis of appropriate education, training, or experience; . However, the 12
customer service clerks did not attend Handling Difficult Customer training
, a mandatory requirement before assuming the job as stated in Training
Guideline (XYZ-HRM-01) Rev. 1, Effective Jan. 5, 2020. Moreover, these
personnel have been handling customers since last year.
[Discussed with Human Resource Manager]
Clause ISO 9001:2015 : Clause 7.2
Classification: Minor
When it will be a major nonconformity?
EXAMPLE
• REQUIREMENT: Management Review
• DOCUMENT TITLE & REF NUMBER: Management Review
Procedure XYZ-QMR-01
• DEFICIENCY : No Management Review Conducted
• LOCATION: Top Management
• NC Statement?:
• Classification ?
EXAMPLE
• REQUIREMENT: Management Review
• DOCUMENT TITLE & REF NUMBER: Management Review
Procedure XYZ-QMR-01
• DEFICIENCY : No Management Review Conducted
• LOCATION: Top Management
• NC Statement:
• The standard requires that the organization shall review the quality
management system at planned interval . However, it was not
evident that the management review was conducted annually as
required by the established procedure Management Review
Procedure XYZ-QMR -01 at the time of the audit
• Clause 9.3.1
Classification: Major
EXAMPLE
• REQUIREMENT: Bidding is required for the procurement of
supplies
• DOCUMENT TITLE & REF NUMBER: Procurement Procedure
(XY-004) Rev. 2, Effective Jan. 2, 2019
• DEFICIENCY :
There was no bidding conducted for the procurement of 1.0
M pesos of face shields and face masks from XYZ Co. last Sept. 2,
2020
• LOCATION: Purchasing Dept.
• NC Statement: ?
EXAMPLE
• REQUIREMENT: Bidding is required for the procurement of supplies
• DOCUMENT TITLE & REF NUMBER: Procurement Procedure (XY-004)
Rev. 2, Effective Jan. 2, 2019
• DEFICIENCY :
There was no bidding conducted for the procurement of 1.0 M pesos of
face shields and face masks from XYZ Co. last Sept. 2, 2020
• LOCATION: Purchasing Dept.
• NC Statement: ?
• The organization shall ensure that externally provided processes remain
within the control of its quality management system; However, there was no
bidding conducted for the procurement of 1.0M pesos of face shields and
masks from XYZ co last sept. 2, 2020 which is of Procurement Procedure XY
004 Rev. 2, effective 2, 2019
Clause ?8.4.2
Classification ?
EXAMPLE
• REQUIREMENT: Work environment
• DOCUMENT TITLE & REF NUMBER: Cleaning checklist
• DEFICIENCY : Presence of cobwebs in the corners
• LOCATION: Reception Area
• NC Statement: ?
Clause ?
Classification?
EXAMPLE
• REQUIREMENT: Documented Information
• DOCUMENT TITLE & REF NUMBER: Distribution/Retrieval of
Documents (QM-DCO-05 )
• DEFICIENCY : No proof of distribution and retrieval of the following
documents: Not listed in Distribution/Retrieval of Documents:
Distribution and Retrival of Evaluation of External Providers : QM-
P-06 Rev. 2 /Rev. 3
• LOCATION: Document Control
• NC Statement: ?
Clause
ROOT CAUSE ANALYSIS AND
CORRECTIVE ACTION
1.] FISH BONE DIAGRAM
2.] 5 Why’s
3. ] 8 D (Discipline): Form Team, Describe the
Problem, Determine and Implement
Containment Action, Identify Potential Causes,
Select Likely Causes, Choose and Verify
Corrective Actions, Validate Corrective Actions,
Prevent Recurrence, Congratulate the Team

Internal Audit Training with different .pptx

  • 1.
    Rolly Ceniza Remitar InternalAudit Training with Root Cause Analysis
  • 2.
    • Interpret andapply the elements of the ISO Standards • Plan and prepare for an internal audit • Develop a practical checklist • Develop and use audit documentation • Conduct an internal audit • Develop an internal audit report • Present audit findings in a constructive manner • Determine the roles and responsibilities of an internal auditor • Conduct root cause analysis
  • 3.
    Program Overview of ISO Standards Principlesand Process  Differentiating internal from external audits Internal and external audits  Conducting internal audit Conducting virtual audit  Auditor’s competence and evaluation Day 1  Evaluating audit situations Writing audit findings Review Standard’s Requirements and how to audit these requirements  Simulating internal audit – opening to closing meeting; Root Cause Analysis 2-hour examination Day 2
  • 4.
    PRE-REQUISITE OF THISCOURSE You have attended the ISO 9001:2015 Awareness Seminar covering all the 10 clauses of the standard Go over with your ISO 9001:2015 Standard
  • 5.
    Determine the applicableclauses in your area. Open your ISO 9001 standard
  • 6.
    OVERVIEW OF ISO19011:2018 Scope Normative references Terms and definitions Principles of auditing Managing an audit programme Establishing the audit programme objectives Establishing the audit programme Implementing the audit programme Monitoring the audit programme Reviewing and improving the audit programme Performing an audit Initiating the audit Preparing audit activities Conducting the audit activities Preparing and distributing the audit report Completing the audit Conducting audit follow-up Competence and evaluation of auditors Determining auditor competence to fulfil the needs of the audit programme Establishing the auditor evaluation criteria Selecting the appropriate auditor evaluation method Conducting auditor evaluation Maintaining and improving auditor competence Annex A (informative) Guidance and illustrative examples of discipline-specific knowledge and skills of auditors Annex B (informative) Additional guidance for auditors for planning and conducting audits
  • 7.
  • 8.
    DEFINITION Systematic, independent and documented(verification) process for obtaining audit evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled by ISO 19011:2018 As defined in ISO 19011:
  • 9.
    •Systematic – PDCAApproach; organized, methodical, planned •Independent – Auditors shall not audit their own work •Documented – accompanied with documentation; recorded in writing •Verification process – information is confirmed, cross-checked and validated
  • 10.
    DIFFERENCE BETWEEN INSPECTION ANDAUDIT Inspection is checking of documents, records, facilities and any other resources to verify a certain set of requirements which is usually conducted by regulatory agencies Auditing is systematic, independent checking, examining and analyzing the processes and performance based on standards and specific guidelines
  • 11.
  • 12.
    Why we conductan internal audit? • check before the customer • remind us of the way of doing and make sure that problems are avoided • monitor conformance/compliance to any standards or established system within the organization • evaluate the management system that can be used in action plans • mandatory requirement of any management system
  • 13.
    Who are involved? 1.Auditor – collects evidence and determine findings 2. Auditee – entity being audited 3. Client – party commissioning the audit
  • 14.
  • 15.
  • 16.
    TOOLS FOR DECISIONMAKING Intuition Common sense Professional judgment
  • 17.
    Guidelines for evaluatingquality of audit evidence 1. Relevance 2. Objectivity 3. Documentation 4. Integrity 5. Sample size
  • 18.
    Audit Objectives andCriteria Set of policies, procedures or requirements Why an audit is being conducted; Define what is to be accomplished
  • 19.
    WORKSHOP Determine the applicableaudit evidence 4.0 Context of the Organization 4.1 Understanding the organization and its context 4.2 Needs & Expectations of Interested Parties 4.3 Scope of Quality Management System 4.4 Quality Management System and Processes
  • 20.
    5.0 Leadership 5.1 Leadershipand Commitment 5.2 Policy 5.3 Roles, Responsibilities & Authorities 6.0 Planning 6.1 Risks and Opportunities 6.2 Quality Objectives 6.3 Planning of changes WORKSHOP Determine the applicable audit evidence
  • 21.
    7.0 Support 7.1 Resources 7.2Competence 7.3 Awareness 7.4 Communication 7.5 Documented Information WORKSHOP Determine the applicable audit evidence
  • 22.
    8.0 Operation 8.1 Operationalplanning and control 8.2 Requirements for products and services 8.3 Design and Development 8.4 Control of External Providers 8.5 Production and Service Provision 8.6 Release of products and services 8.7 Control of Nonconforming Outputs WORKSHOP Determine the applicable audit evidence
  • 23.
    9.0 Performance Evaluation 9.1Monitoring, Measurement, Analysis and Evaluation 9.2 Internal Audit 9.3 Management Review 10.0 Improvement 10.1 General 10.2 Nonconformity and Corrective Action 10.3 Continual Improvement WORKSHOP Determine the applicable audit evidence
  • 24.
    Audit Objectives Why anaudit is being conducted; Define what is to be accomplished
  • 25.
    Audit Criteria Set ofpolicies, procedures or requirements. Used as a reference against which audit evidence is compared
  • 26.
  • 27.
    Audit Findings • Fulfillmentof requirements Conformity / Compliant • Non fulfillment; deviation • Catastrophic/Critical, Major, Minor Nonconformity / Non compliant • Fulfilled requirements however, there is a better way to do things Opportunities for improvement (and/or good practices) / Positive findings
  • 28.
    Classification of AuditFindings (ISO 19011:2018 Clause 6.4.8) Nonconformities can be graded depending on the context of the organization and its risks. This grading can be quantitative (e.g. 1 to 5) and qualitative (e.g. minor, major). They should be reviewed with the auditee in order to obtain acknowledgement that the audit evidence is accurate and that the nonconformities are understood
  • 29.
    Audit findings =Audit conclusion Outcome of an Audit: AUDIT CONCLUSION After consideration of the audit objectives and all audit findings
  • 30.
    Audit Types • 1stparty – internal audits of the system • 2nd party – supplier audits • 3rd party – independent or certification audits (external)
  • 31.
    Internal Audit Objectives 1stparty audit (rationale) Verify corrective action Applicability of procedures and work instructions Identify potential danger spots Verify implementation and results Organizational changes (establish/ identify minimum competency requirements)
  • 32.
    Audit Types • Customeraudits supplier with their staff • Beneficiaries – supplier and customer • Style – can be formal or informal depending on whether the contract is at stake or whether for improvement • Planning – varies depending on relation with supplier • Depth –detail depends on the contract • Follow up – depends on the contract EXTERNAL AUDIT – 2nd party Auditors – independent Beneficiaries – company Style – formal according to protocols Planning – done in detail per protocol Depth – sufficient to check compliance and effectiveness Follow up – CA is always verified EXTERNAL AUDIT – 3rd party
  • 33.
    Audit Approach Vertical -looks in depth at a particular function or department; monitors the use of all relevant procedures as they are used. E.g. auditing the Purchasing Dept. covering training, document control and etc Horizontal – follow a process from start to end; looks at procedures as they support process; E.g. Document Control in different areas or training records
  • 34.
    7 Audit Principles INTEGRITY Foundationof professionalism; auditors perform their work with honesty, diligence and responsibility (character, not uncontrollable factors that could exert influence) FAIR PRESENTATION The obligation to report truthfully and accurately; Audit findings, conclusions and reports should reflect truthfully and accurately the audit activities (personal issues) DUE PROFESSIONAL CARE The application of diligence and judgment in auditing; Auditors having the ability to make reasoned judgments in all audit situations
  • 35.
    7 Audit Principles CONFIDENTIALITYSecurity of information; Prudence in the use and protection of information acquired in the course of their duties; information should not be used inappropriately for personal gain by the auditor or audit client or manner detrimental to auditee’s interest (personal attributes) INDEPENDENCE The basis for the impartiality of the audit and objectivity of the audit conclusions; Auditors should be independent of the activity being audited (size, qualified persons) EVIDENCE-BASED APPROACH The rational method for reaching reliable and reproducible audit conclusions in a systematic audit process; audit evidence is verifiable; based on samples (and sampling) (negligence)
  • 36.
    7 Audit Principles Risk-basedapproach: an audit approach that considers risks and opportunities The risk-based approach should substantively influence the planning, conducting and reporting of audits in order to ensure that audits are focused on matters that are significant for the audit client, and for achieving the audit programme
  • 37.
    RISKS • planning, e.g.failure to set relevant audit objectives and determine the extent, number, duration, locations and schedule of the audits; • resources, e.g. allowing insufficient time, equipment and/or training for developing the audit programme or conducting an audit; • selection of the audit team, e.g. insufficient overall competence to conduct audits effectively; • communication, e.g. ineffective external/internal communication processes/channels; • implementation, e.g. ineffective coordination of the audits within the audit programme, or not considering information security and confidentiality; • control of documented information, e.g. ineffective determination of the necessary documented information required by auditors and relevant interested parties, failure to adequately protect audit records to demonstrate audit programme effectiveness; • monitoring, reviewing and improving the audit programme, e.g. ineffective monitoring of audit programme outcomes; • availability and cooperation of auditee and availability of evidence to be sampled
  • 38.
    OPPORTUNITIES • allowing multipleaudits to be conducted in a single visit; • minimizing time and distances travelling to site; • matching the level of competence of the audit team to the level of competence needed to achieve the audit objectives; • aligning audit dates with the availability of auditee’s key staff.
  • 39.
    AUDITOR’S CHARACTERISTICS • ethicalbehavior • open-mindedness • diplomacy • observational skills • perceptive (insightful) • versatility • Tenacity/persistent • decisiveness • self-reliance/get things done • Fortitude (strength in mind) • openness to improvement • cultural sensitivity, and • collaboration
  • 40.
  • 41.
    Basis of InternalAudit ISO 9001: 2015 9.2 .1 The organization shall conduct internal audits at planned intervals to provide information on quality management system: • conforms to: – the organization’s own requirements for its environmental management system; – the requirements of this International Standard; • is effectively implemented and maintained.
  • 42.
    Basis of InternalAudit -Selection of auditors and conduct of audits shall ensure objectivity and impartiality of the audit process. -Auditors shall not audit their own work. -The responsibilities and requirements for planning and conducting audits, and for reporting results and maintaining records shall be defined in a documented procedure.
  • 43.
    Audit Programme ISO 19011defines it as: ‘arrangements for a set of one or more audits planned for a specific time frame and directed towards a specific purpose’ ISO 19011:2018
  • 44.
    Manage Audit Programme •PLAN Establish audit programme objectives and audit programme • DO Implement the audit programme – competence and evaluation of auditors performing an audit • CHECK Monitoring and measuring audit programme effectiveness • ACT Reviewing and improving the audit programme
  • 45.
    Information Needed inthe Audit Programme • objectives for the audit programme; • risks and opportunities associated with the audit programme and the actions to address them; • scope (extent, boundaries, locations) of each audit within the audit programme; • schedule (number/duration/frequency) of the audits; • audit types, such as internal or external • audit criteria; • audit methods to be employed; • criteria for selecting audit team members; • relevant documented information; • resources
  • 46.
    Audit Programme Objectives •identify opportunities for the improvement of a management system and its performance; • evaluate the capability of the auditee to determine its context; • evaluate the capability of the auditee to determine risks and opportunities and to identify and implement effective actions to address them; • conform to all relevant requirements, e.g. statutory and regulatory requirements, compliance commitments, requirements for certification to a management system standard; • obtain and maintain confidence in the capability of an external provider; • determine the continuing suitability, adequacy and effectiveness of the auditee’s management system; • evaluate the compatibility and alignment of the management system objectives with the strategic direction of the organization.
  • 47.
    Audit Programme Contents Essentiallycontains: – Audit objectives – Extent/number/types/locations/schedule of the audits – Main audit procedure – Audit criteria – including combined audit(s) – Audit scope – Audit methods – Selection of audit team(s) – Necessary resources – Other concerns such as risks, uncertainties, process for handling confidentiality, information security, etc.
  • 48.
    Audit Objectives, Scopeand Criteria Audit methods depend on the defined audit objectives, scope and criteria, including duration and location(sites). • On site: interview, document review • Off site: remote video auditing Human interaction • On site: documentation review • Site visit, sampling • Off site: document review Desktop review
  • 49.
    Audit Plan Audit plan- description of the activities and arrangements for an audit -ISO 19011:2018  Scope  Criteria  Objectives  Schedule/Location/Timeline  Program of activities  Auditors assignment  Auditees
  • 50.
    Audit Plan: XYZCompany Scope of application: Manufacturing of XYZ product Applicable standard(s): ISO 9001:2015 AND ISO 14001:2015 Date / Time (1) Organizational Unit and / or Processes Auditor / Abbrev. Auditee Procedure - Element - Standard Chapter 2016 September 23 9:00 Opening Meeting Management Representative, Department Head, Coordinators Introduction of the company, explanation of processes & procedures, fine-tuning of audit plan 9:15 Top Management Juan de la Cruz Pedro Penduko 4.1, 4.2, 4.3, 4.4, 4.6 , 5.1, 5.2, 5.3, 6.1, 6.2,6.3, 7.1, 5:30 Human Recourse 5.3, 6.0, 7.0. 8.0, 9.1, 10.0
  • 51.
  • 52.
  • 53.
    CHECKLIST -provide detail foreach step of a process -allow us to stay organized -Can be used as a visual reminder -Prioritize things we need to ask -Avoid missing important items
  • 54.
  • 55.
    Implement the AuditPlan – Actual conduct of audit activities » Opening Meeting » Collection and verification of information » Analysis of findings versus audit criteria » Closing meeting
  • 56.
    Implement the AuditPlan Opening Meeting – confirms the audit plan and team introduction • Auditee management and process owners (auditees) • Confirmation of audit objectives, scope and criteria and other arrangements
  • 57.
    Communication during theaudit - exchange information - assess audit progress - reassign work between audit team members Conduct of Audit Proper
  • 58.
    CONDUCTING INTERVIEW • Shouldbe held with individuals from appropriate levels and functions performing activities or tasks within the audit scope • Be conducted during normal working hours and, where practical, at the normal workplace of the individual being interviewed; • Be made to put the individual being interviewed at ease prior to and during the interview
  • 59.
    • the reasonfor the interview and any note taking should be explained; • interviews may be initiated by asking individuals to describe their work; • the type of question used should be carefully selected (e.g. open, closed, leading questions, appreciative inquiry); CONDUCTING INTERVIEW
  • 60.
    • awareness oflimited non-verbal communication in virtual settings; instead focus should be on the type of questions to use in finding objective evidence • the results from the interview should be summarized and reviewed with the interviewed individual • the interviewed individuals should be thanked for their participation and cooperation. CONDUCTING INTERVIEW
  • 61.
    Conduct of auditproper Observe Collection and verification of information Audit triangle
  • 62.
    Audit methods • Inspection •Observation • Inquiry • Face to Face • Virtual
  • 63.
    Conduct of auditproper Sources of information:  Interviews with employees  Observation of activities, surrounding work environment and conditions  Documents  Records
  • 64.
    VIRTUAL INTERNAL AUDIT -Allowed by some certifying bodies during the pandemic - Use internet platform such as Zoom, Microsoft Team, Messenger, email and Calls - Conduct capability test (check the internet connection, camera, sending email and evidence) - Should ask the documents (e.g. risks, objectives, procedures, requirements and - Take SCREENSHOTS
  • 65.
  • 66.
    Conduct of auditproper Interview Techniques  Themed questions  Expansive questions  Opinion questions  Investigative questions  Non verbal questions  Repetitive questions  Hypothetical questions  Closed questions  Leading questions
  • 67.
    Examples of auditquestions “THOUGHTFUL APPRECIATIVE QUESTIONS” Poor leading question “DO YOU CONTROL NONCONFORMITY” Open – ended question “WHAT DO YOU DO IF THERE’S NONCONFORMITY” appreciative question “TELL ME ABOUT YOUR EXPERIENCE WHEN YOU DISCOVERED A NONCONFORMITY”
  • 68.
    Appreciative audit “THOUGHTFUL APPRECIATIVEQUESTIONS” Poor leading question “DID YOU GET AN ON-THE-JOB TRAINING” Open – ended question “HOW WERE YOU TRAINED TO DO YOUR JOB” appreciative question “WHAT ARE THE TOP 3 THINGS ABOUT THE TRAINING THAT GAVE YOU CONFIDENCE TO DO YOUR JOB”
  • 69.
    - Often timesrequest for supplies are labeled as ASAP, I’m astonished that you are able to meet the demands of operation. Can you share your experience on how you do it? - I know it hard to organize stuffs, can you show how you organize the inventory of supplies and can you throw in some tips that I can apply it my daily routine. - Can you describe an experience where you went beyond the directives to have a more advantageous or beneficial purchasing process
  • 70.
    Other sources ofinformation Consider also checking:  Data analyses, performance index  Reports from other sources  Database and website(s)
  • 71.
    Audit findings Recording individualaudit findings of conformity, consider the following:  Requirements of audit client  Follow up of previous audit records and conclusions  Findings exceeding normal practice
  • 72.
    Audit Findings Recording nonconformities; must include the following:  Requirements of audit criteria (description)  Declaration of nonconformity  Audit evidence  Related audit findings
  • 73.
    Classification of AuditFindings 1. Positive Observation Good practices implemented by Organization. 2. Opportunities for Improvement/Observations – Requirements are fulfilled but can also further improve the Management System implementation
  • 74.
    Classification of AuditFindings 3. Nonconformity A. Major - Finding that would result in a failure of one or more system processes that may have an effect on the finished product/services, catastrophic to the organization. It affects the capability of the management system to achieve the intended results. If there are number of minor nonconformities associated with the same requirement or number of issues that could demonstrate a systemic failure  B. Minor – Finding that would result in a failure of a process in the system that may have a minor effect on the finished product/service. It does not affect the capability of the management system to achieve the intended results
  • 75.
    SAMPLE OF STATINGPOSITIVE FINDINGS 1 Business Continuity The organization was able to continue the virtual operations (training) in serving their clients in the midst of pandemic 2 New Branch A new branch in Cebu was opened last year to expand the business 3 New business There were new clients which contributed to the increase of profits 4 Product Line A new product was developed and introduced in the market
  • 76.
    SAMPLE OF STATINGOPPORTUNITIES OF IMPROVEMENT No. Unit/Department Site Recommendations and opportunities for improvement 1 Management Review The conclusion of the effectiveness, adequacy and suitability of management system may be included in the minutes of management review which can be enhanced by setting measures of different criteria (e.g. effectiveness of risks, customer satisfaction, objectives and etc) 2 Maintenance There a need to increase the frequency of mixers maintenance due to frequent shutdown 3 Internal Audit May consider the following: -training of more auditors -identify risks associated in internal audit process -add some item to trigger the update or review the management systems in Corrective Action Report. 4 Documented Information Old versions of document may be further controlled since it can still be accessed in the cloud 5 Human Resource The following may be ensured: -retention of hiring documents -tool in evaluating the effectiveness of coaching and mentoring -checklist to be used in classroom observation)
  • 77.
    WRITING NCs • REQUIREMENT– Clause of standard, procedure,, work instruction, legal requirements and etc • PROBLEM – deficiency, deviation, statement of nonconformity • LOCATION – where the deficiency/conformity was found (e.g. receiving area, warehouse, office, etc) • OBJECTIVE EVIDENCE – what documents are involved (e.g. procurement specifications, engineering number)
  • 78.
    EXAMPLE • REQUIREMENT: Handlinga Difficult Customer, mandatory training before job assignment for a Customer Service Clerk • DOCUMENT TITLE & REF NUMBER: Training Guideline (XYZ- HRM-01) Rev. 1, Effective Jan. 5, 2020 • DEFICIENCY 12 Customer Service Clerks did not attend training last Jan. 20-25, 2020 but have been handling customers for one year. . LOCATION: Human Resource Department
  • 79.
    EXAMPLE • REQUIREMENT: HandlingDifficult Customer, mandatory training before job assignment for a Customer Service Clerk • DOCUMENT TITLE & REF NUMBER: Training Guideline (XYZ-HRM-01) Rev. 1, Effective Jan. 5, 2020 • DEFICIENCY 12 Customer Service Clerks did not attend training last Jan. 20-25, 2020 but have been handling customers for one year. . LOCATION: Human Resource Department STATEMENT The organization shall ensure that these persons are competent on the basis of appropriate education, training, or experience; . However, the 12 customer service clerks did not attend Handling Difficult Customer training , a mandatory requirement before assuming the job as stated in Training Guideline (XYZ-HRM-01) Rev. 1, Effective Jan. 5, 2020. Moreover, these personnel have been handling customers since last year. [Discussed with Human Resource Manager] Clause ISO 9001:2015 : Clause 7.2 Classification: Minor
  • 80.
    When it willbe a major nonconformity?
  • 81.
    EXAMPLE • REQUIREMENT: ManagementReview • DOCUMENT TITLE & REF NUMBER: Management Review Procedure XYZ-QMR-01 • DEFICIENCY : No Management Review Conducted • LOCATION: Top Management • NC Statement?: • Classification ?
  • 82.
    EXAMPLE • REQUIREMENT: ManagementReview • DOCUMENT TITLE & REF NUMBER: Management Review Procedure XYZ-QMR-01 • DEFICIENCY : No Management Review Conducted • LOCATION: Top Management • NC Statement: • The standard requires that the organization shall review the quality management system at planned interval . However, it was not evident that the management review was conducted annually as required by the established procedure Management Review Procedure XYZ-QMR -01 at the time of the audit • Clause 9.3.1 Classification: Major
  • 83.
    EXAMPLE • REQUIREMENT: Biddingis required for the procurement of supplies • DOCUMENT TITLE & REF NUMBER: Procurement Procedure (XY-004) Rev. 2, Effective Jan. 2, 2019 • DEFICIENCY : There was no bidding conducted for the procurement of 1.0 M pesos of face shields and face masks from XYZ Co. last Sept. 2, 2020 • LOCATION: Purchasing Dept. • NC Statement: ?
  • 84.
    EXAMPLE • REQUIREMENT: Biddingis required for the procurement of supplies • DOCUMENT TITLE & REF NUMBER: Procurement Procedure (XY-004) Rev. 2, Effective Jan. 2, 2019 • DEFICIENCY : There was no bidding conducted for the procurement of 1.0 M pesos of face shields and face masks from XYZ Co. last Sept. 2, 2020 • LOCATION: Purchasing Dept. • NC Statement: ? • The organization shall ensure that externally provided processes remain within the control of its quality management system; However, there was no bidding conducted for the procurement of 1.0M pesos of face shields and masks from XYZ co last sept. 2, 2020 which is of Procurement Procedure XY 004 Rev. 2, effective 2, 2019 Clause ?8.4.2 Classification ?
  • 85.
    EXAMPLE • REQUIREMENT: Workenvironment • DOCUMENT TITLE & REF NUMBER: Cleaning checklist • DEFICIENCY : Presence of cobwebs in the corners • LOCATION: Reception Area • NC Statement: ? Clause ? Classification?
  • 86.
    EXAMPLE • REQUIREMENT: DocumentedInformation • DOCUMENT TITLE & REF NUMBER: Distribution/Retrieval of Documents (QM-DCO-05 ) • DEFICIENCY : No proof of distribution and retrieval of the following documents: Not listed in Distribution/Retrieval of Documents: Distribution and Retrival of Evaluation of External Providers : QM- P-06 Rev. 2 /Rev. 3 • LOCATION: Document Control • NC Statement: ? Clause
  • 87.
    ROOT CAUSE ANALYSISAND CORRECTIVE ACTION 1.] FISH BONE DIAGRAM 2.] 5 Why’s 3. ] 8 D (Discipline): Form Team, Describe the Problem, Determine and Implement Containment Action, Identify Potential Causes, Select Likely Causes, Choose and Verify Corrective Actions, Validate Corrective Actions, Prevent Recurrence, Congratulate the Team

Editor's Notes

  • #67 Expansive…help me understand opinion – what do you see , hypothetical – based on supposition, if you