Ncoc sample slides

1. NCOC AUDIT TRAINING COURSE
AUDIT AS RISK MITIGATION
For audit programs and particularly audit schedule
development, it is not always easy to understand the specific
mitigations that audits provide.
Stated another way, identifying what hazards could occur and
the probability they occur if an audit is or is not performed is
difficult and can lead to wasted effort and a false sense of
security.
Often it is best to view audits as “good business”.
However, this may not provide sufficient detail for a robust audit
program and schedule.

2. NCOC AUDIT TRAINING COURSE
AUDIT AS A RISK MITIGATION
Risk mitigations can be thought
of as barriers. If these barriers
have gaps or holes, failure
occurs. It is useful to
understand what barriers exist
• To evaluate the added risk
mitigation auditing provides
• To understand which risk
mitigations need to be
audited to ensure they are
working

3. NCOC AUDIT TRAINING COURSE
DISCUSSION: QUALITY RISK MITIGATION
1. Select a process
• Welding
• Purchase order development
• Supplier selection
• Design change
2. Use the Swiss Cheese model to
identify several barriers and a
reason why a hole might exist.
Can you tell how much auditing
lowers quality risk for the process
you evaluated?
Audit
________
________
________

4. NCOC AUDIT TRAINING COURSE
6
2
3
4
5
1
DEVELOPING AN AUDIT SCHEDULE
Begin with end in mind! Develop a good audit schedule format
Determine the overall audit scope of responsibility
Understand (or define) audit strategy and your scope of
responsibility
Gather information
Analyze information
Prepare actual audit schedule

5. NCOC AUDIT TRAINING COURSE
BEGINNING WITH THE END IN MIND
Essential /
Must Include
Need to have
when information
is available
Nice to have
but not
necessary
Information for each audit
· What organization to be audited
· What activities to be audited
· Who will lead the audit
· Technical auditors needed on audit
team
· Timing of audit
· Where audit will be performed
· Type (routine, readiness,
qualification)
· Other?
General Information
· Audit program scope of
application (e.g., project, internal
and/or external)
· Management endorsement /
approval
· Date approved / revision
· Other?
Does all this information need to be on the actual approved
schedule document?

6. NCOC AUDIT TRAINING COURSE
AUDIT STRATEGY
Audit strategy defines audit scope for Corporate / Project team
when it defines:
 Audit scopes for Corporate, Project, Contractors
 How much to depend upon Contractor and subcontractor audit
programs
 Use of hybrid audit approaches such as integrated Corporate /
Project / Contractor audit programs
 How risk will be used to guide the audit program
How to develop the audit strategy will be covered later in the
course.

7. NCOC AUDIT TRAINING COURSE
USING AUDIT STRATEGY: STEP 1
Audit strategy defines audit scope for Corporate/Project team when
it defines:
•How much to depend upon Contractor and subcontractor audit
programs (more on this later in the course)
•Use of hybrid audit approaches such as integrated
Corporate/Project / Contractor audit programs
Audit universe
for entire
project (NCOC,
Contractors,
etc.)
Audit Strategy
Potential
audit topics
for NCOC

8. NCOC AUDIT TRAINING COURSE
Next, the strategy should use risk to identify:
•Which organizations, activities, locations within the
Corporate/Project’s audit universe should be audited
•When these audits should be performed
USING AUDIT STRATEGY: STEP 2
Audit universe
for entire
project (NCOC,
Contractors,
etc.)
Audit Strategy
Potential
audit topics
for NCOC
NCOC
audit
schedule

9. NCOC AUDIT TRAINING COURSE
ROUTINE VS. NON-ROUTINE
The Risk Envelope approach is based on the principle that risk of
nonconformance is higher when people or organizations do something
non-routine. This calls for extra effort.
Non-routine Quality risk Is typically higher
outside the “envelope
Routine
Quality risk typically lower in
routine situations

10. NCOC AUDIT TRAINING COURSE
The Risk Envelope checklist is
a tool to help identify whether
the audit topic is:
•Managed with proven,
routine approaches
•There is something non-
routine that the quality
program needs to address.
Equipment Risk Envelope
Topic Typical “Routine” Example “Non-routine”
Design Standard, proven design New or unproven design
Design verification (for
engineered equipment)
Performed by Supplier +
EP Contractor and
Project team
Supplier only - not
required by EP Contract
/ minimum staff / limited
sampling
Shop drawings Spot checked by EP
Contractor
No EP Contractor
involvement
Code compliance Internationally
accredited (e.g., ASME)
Not accredited per
recognized international
body
Materials of fabrication Standard, proven
materials
New, unproven or
difficult-to-fabricate
materials
Personnel qualification Internationally
recognized / per
specification
Questionable
qualification program
(e.g., new to supplier, in-
house qualifications)
Qualification Qualified by Company
and / or reliable EP
Contractor
Not qualified per
approved qualification
program; new facility;
qualification outdated or
pending
Subcomponent / material
subsuppliers
Critical subcomponents
& materials from
suppliers per Project
approved list or per
approved / robust
supplier’s qualification
program
Critical subcomponents
not from qualified
suppliers / no subsupplier
qualification program in
place
Source inspection (for
critical equipment or high
volume purchases)
Source inspection
program by EP
Contractor with
adequate field & office
supervision
Source inspection below
normal approach due to
constraints
FAT testing Performed with EP
Contractor engineer
FAT testing below normal
approach due to
constraints
ROUTINE VS. NON-ROUTINE

11. NCOC AUDIT TRAINING COURSE
RISK ENVELOPE EXERCISE
Same Scenario as used for Tension Analysis:
• Pressure vessel purchase order given to local content fabricator in a country
with poor quality performance
• No previous Company or Contractor experience with fabricator
• Low and medium criticality pressure vessels, standard fabrication materials
and methods
• No international certification such as ASME
• Remote location
Use the Risk Envelope
• Go through the topics and decide which are routine or non-routine
Discuss the following:
• What non-routine topics did you find?
• What areas (organizations and activities) would you want to audit?