Nigel Bauer & Associates AUDIT TOOLS & TECHNIQUES Detailed Planning & Check List development Searching for Evidence Conducting Interviews and Asking Questions Auditor and Auditee Tactics Recording the Results wasIT Section 67 Page 1Nigel Bauer & Associates DETAILED PLANNING & CHECK LISTDEVELOPMENT. Preliminary preparation. ‘The auditorneeds to havea very good understanding of the objectives and the "scope" of the audit. Thismustalso be understood by those thatare to be audited. Once the audit task has been allocated, the auditor must obtain information as necessary to developan understanding of the audit argetarea. Thisis best done by gathering documentation and studying as appropriate and even by having preliminary discussions with the appropriate auditee management andin some cases those witha technical knowledge applicabletothetargetarea. (Insomecases itmay bebeneficial toinclude technical expertsin heauditteam). Thusthe auditor evelopsanunderstanding of WHO, WHAT and HOW relative othe targetarea aswellasphysical layout, staff numbers, technologiesinvolved,etc.,ete THIS UNDERSTANDING IS VITAL !! Itisalsonecessary to communicate with auditeemanagement whatistohappen, ‘when, by whom, and whatparttheauditeesmustplay intheprocess. Thefill scope oftheauditmustalso beagreedandagaina preliminary meeting between uditor(s) andauditeemanagement wllassistthe communication process. Itistheresponsibility oftheauditteam leader (evenifitisateam ofone!) to ensure adequate communication between the audit team and the organisation to be audited, and the setting up of the necessary communication channel. Itis also ‘important to ensure adequate communication between audit team members, particularly at the start ofthe audit process when itis helpfulto call the proposed ‘team together to explain the objectivesand scope of theauditand whatis required ofeach team member. 33704709 Section 67 Page 2Nigel Bauer & Associates ‘Oncethe preliminary preparation has been completed and the auditorhas a good understanding of the audit task ahead then itisnecessary toundertake detailed planning activities. The methodology that will be adoptedisasfollows: STEP 1: Identify Management Criteriathat aretobe verified. STEP2: Determine how criteriarelate to activitiesundertaken. STEP3: Identify what theauditormust establish, STEP4: DevelopHighLevel Check List STEPS: DecidePlan of Action. STEP6:DevelopLowLevel Check List. Weshall ook atthesein um andusingasimplified company activity demonstrate how themethodology isapplied. Step 1 Step 2 Detailed Audit Planning QM33/04709 Section 67 Page 3Nigel Bauer & Associates Example: Consideratypicaltravel company thatisinvolvedin the provision ofholidaystothe public. Itisassumed thatthe company is organised on fairly standard linesand that the Assessment Team Leaderhasallocated thetask of auditing oneofthehigh treet retail operationsto one of the audit team members with the instruction to verify ‘conformanceto ISO 9001, 7.2 "Customer elated processes" inrelationtothe provision ofstandardholiday packages, Thesepackages, although standard, may bemodifiedtoalimitedextentin order to cater forspecificcustomer requests (for example, hotel rooms accessible by lift for elderly people). The auditor is now responsible forundertakingthenecessary planning. es = Eater Publicise Enquiry : 4 ty 1] booking holidays handling availability details Holiday || Fotowup delivery | {questionnaire} STEP 1: Identify Management Criteria Applicable ‘The audit sample’ hasbeen pre-determined by the auditteam leader andallocated tothe auditor. The auditor therefore understands that itis necessary to verify the 1809001 requirement 7.2 "Customerrelated processes’ STEP 2 : Determine How Criteria Relate to Activities Inrelationto theactivitiesthatare undertaken within he audittargetarea the auditor mustnow decide how the sample of ISO 9001 requirements apply, and whether in partorin full. In this example if we have decided that the auditor sto verify conformity with7.2of1S0 9001 "Customerrelated processes" inthe high street retail operation Department, weneed to decide how it applies, and whetherin part or in full. After analysing the process (or due to familiarity with the process) the auditorcan clearly seethat thereisa complex interfacebetween theretail operation and potential customers, 33704709 Section 67 Page 4Nigel Bauer & Associates STEP3: Identify What the Auditor Must Establish ‘The Auditor must now decide what it is that is to be verified in relation to the requirement7.2"Customerrelated processes". In very simplistictermstheauditor isrequiredto verify: IS THE INTERFACE WITH CUSTOMERS MANAGED IN ACCORDANCE WITH THE REQUIREMENT OF 7.2 "CUSTOMER RELATED PROCESSES" ? However, this statement is very unspecific and it must be translated into more specific questions that relate tothe ISO 9001 requirement 7.2. Wenowneedtoexamine closely the ISO 9001 requirement for "Customerrelated processes" ,andunderstandhow each part ofthatrequirement appliestotheactivity (rocess)ofpubliciingholidays, handling enquiriesandbookingholidays.Itisatthis stage that it isimportant for the auditor to understand the process andnotblindly expect the organisation to meet each part of the requirement regardless of it's applicability. The auditor must use common sense and judgementtodecidehow appropriateitis tomeet each par ofthe quality managementsystem requirement Somepartsmay be totally inappropriate! (QM33/04/09 Section 67 Page 5Nigel Bauer & Associates In this example most of 7.2 is applicable to the process being audited, however there needs to be a careful interpretation of the wording of the requirement in relation to the process, STEP 4 : Develop High Level Check List Therelatively unspecific statement may now be developed into more specific questions that MUST BE ANSWERED BY THE AUDITOR. Thisisachieved bytaking each clement ofthe ISO requirement and turningitintoaquestion, The auditor must obtain information atthe time of audit to prove (verify) that the oremisationiscompliant with therequirementsinrelationtothe processundertaken, Hence we develop theauditors "HIGH LEVEL" checklist. Working with the 1809001 requirement 7.2.1 Provides High Level Check Listquestionsas follows: Does the organisation determine the requirements specified by the customer, including the requirements for delivery and post-delivery activities ? Does the organisation determine requirements not stated by the customer but necessary for specified or intended use, where known ? Does the organisation determine statutory and regulatory requirements related to the product ? Does the organisation determine any additional requirements considered necessary by the organisation ? Clearly the answers to those questions will be YES or NO. ‘ftheauditoris provided with sufficientinformation toanswer YES toeach question then the company meetstherequirements of SO 9001 7.2. Ifthereis insufficient information to answer YES then the auditor musthave foundanonconformity, Note: In this example most of 7.2 is applicable to the process being audited, howeverthereneedstobeacarefilinterpretation ofthe wording ftherequirement in relation to the process. "post delivery" activities are not relevant. The term “contract” is notrelevantin thisinstanceas customers donotprovide a "contract" (although the company is goingto enter into alegal contract with the customer). wa304T Section 67 Page 6Nigel Bauer & Associates The High Level Check List that has been produced is based on ISO 9001 7.2 "Customerrelated processes" aid draws only from the details contained within that requirement. Inmany casesitisalsonecessary totakeinto account specificpolicies and practices that have been adopted by an organisation in order to meet the rrequirementsofa Quality System standard, Theauditorinvolvedin Secondor'Third Party audits willneed to examine the organisation's Quality Manual andextract organisational specificrequirements thatneed tobe included in the High Level Check List. Itisnecessary for the auditornot only to verify conformity with the ualtymanagementsystem standardrequirements, butalsotheparticularapproaches thatthe organisation has taken in order tomeet these requirements. Thisisoften more appropriate for Second Party audits when thereis aneedto establish thatthe ‘g00d practices detailed in the Quality Manual are indeed being appliedin orderto provide the purchasing organisation with confidencein thesupplier'sabilitiesto control processesin acost effectivemanner. ‘TheHighLevel Check List will therefore need to be further developedto include specific detail taken from an organisation's Quality Manual, The Quality Manual ‘communicates the organisations intended way of meeting therequirements. The auditor starts by producing an High Level Check List using the quality ‘management system standard on which the audits based, and then examinesthe Quality Manual toidentify specific policies, responsibilitiesand practicesthatthe organisation uses to meet these requirements, These specific items are then incorporated into the check lst. For our example, if we now examine the organisation's Quality Manual in the section(s) thataddresses "Customerrelated processes" wemight findthe following statements: The company will identify the exact requirements of the customer andprovide the closest match of available productoffering. Wherever possible the company will try to meet customer requests for special Sacilities and services (e.g special diet, disabled or elderly persons, ‘hotel room locations etc.). Where the company has negotiated discounts with specific hotels, airlines, other agencies etc. these should always be the first choice when processing a customer booking. QM33704709 Section 67 Page?Nigel Bauer & Associates ‘The auditor should verify that these requirements are being met, and wouldneed thereforeto include the ollowinginto the High Level Check List: Does the company identify the exact requirements of the customer and provide the closest match of available product offering ? Doesthe company wherever possible try to meet customer requests for special facilities and services (e.g special diet, disabled or elderly persons, hotel room locations etc.) ? Where the company has negotiated discounts with specific hotels, airlines, other agencies etc. are these always the first choice when processing a customer booking ? nase. cuir Foree Seciton 67 Page 8Nigel Bauer & Associates ‘Thecombined check list would containthe following questions, all of which would need to beansweredby the auditor after obtaining the necessary information atthe time ofaudit: Does the organisation determine the requirements specified by thecustomer, including therequirementsfor delivery and post-delivery activities ? Doesthe organisation determinerequirementsnotstated by the customer but necessary for specified or intended use, where known ? Doesthe organisation determinestatutory and regulatory requirements related to the product? Does the organisation determine any additional requirements considered necessary by the organisation ? Does the company identify the exact requirements of the customer and provide the closest match of available product offering ? Does the company wherever possible try to meet customer requests for special facilities and services (eg special diet, disabled or elderly persons, hotel room locations ete.) ? Where the company has negotiated discounts with specific hotels, airlines, other agencies etc. are these always the first choice when processing a customer booking ? YES/NO CI Co | co ees] Ed 0 Thissimple exampleillustrates the process used to developaHigh Level Check List. For undertaking a process approach audit there will be a need to develop comprehensive High Level Check Lists that address he variousclauses of ISO 9001 thatarerelevant to the process approach as well as any specific ISO 9001 requirementsthatrelate directly tothe processitself(7.4 forthe Purchasingprocess forexample). Ww33/0409 jection 67 Page 9Nigel Bauer & Associates STEP 5: Decide Plan of Action ‘Theauditor mustnow plan how to obtain information andevidenceto beableto ‘answerHigh Level questions. Whereto start the audit, who to talk to first. Where togonext,andwhoto alk tonext. How/whereto observe the process, how/where to test the system. THUS A PLAN OF ACTION IS DEVELOPED (Audit strategy), Fortheabove exampleitmightbenecessary toadoptthe followingplan andallocatetimeas follows: Manager Smins Entry 2Smins Establish Responsibilities & practice Travel consultant 45mins Verify Sales assistant 30mins Verify ‘Manager 1Smins_ Exit Total time 120 mins Clearly itisnecessary fortheauditortohavean understanding ofhow thecompany. isorganisedandwho the key staffareinrelation tothe activity being audited. The "Plan of Action" (stategy) is very necessary toensure effectiveuseofthelimitedtime thatisavailableto theauditor,andalsoto ensurethat information sgainedinalogical and systematicmanner that causes the least disruption totheauditees.Itshouldalso beremembered thatitisnormal practice to start andend an auditof an area ofan ‘organisation with themostseniorperson, out of common courtesy andalso because they arelikely to wanttoknow if anythingimportanthasbeen foundby the auditor intheirareaofresponsibility ! Plan of Action (33704709 Seetion 67 Page TONigel Bauer & Associates STEP 6 : Develop Low Level or "Detailed" Check List ‘Now theauditorisinaposition to developa "Low Level" orDetail CheckList. This willbeacombination of questions that the auditor will wish toasktheauditees as partofthe auditinterviewpprocess together with thosethingsthatthe auditor wishes tolookatand examinein orderto obtain thenecessary objective evidencetoenable theanditortoansewr the High Level Check List questions. DETAILEDCHECK LIST: Questions What to observe / examine Thus forourexample, the detailed check listmight include: With the Manager: Could you explain how customer enquiries arehandled ? May I see the forms that are used to record customer requirements ? How do you ensure that customers specific requirements are met ? ‘May Isee the appropriate procedures? neck: Could ges exflain the procedure With the Travel consultant: First observe the processing of a customer order, then repeat the above questions and also examine a sample of 10 forms used to record customer requirements (for customer requirements processed one week ago) Obtain details ofholiday product options available and compare with options offered to the customers. Look at airlines used compared to preferred airline listing, With the Sales Assistant: Observe the processing of customer orders followed by examination of records of the customer orders. Compare options offered to customers with available options. Qw33704709 Section 67 Page 11Nigel Bauer & Associates Itshouldberemembered thattheaudit process shouldinvolvea' gentle’ conversation between theauditorandauditee andnot.an interrogation". Inadditiontothese’get youstarted questions the auditormay wish tonote down cn the detailed check list any documents that will need to be examined, any materials, products, foolsetc. that will be observed, together with samplesizes asappropriate. Responses o the Low Level questions, together with observations made shouldenable the auditor toanswer the High Level Check List questions, Itshouldalsoberemembered that observation ofthose performing workactivities ‘may sometimes be abetter approach toobtaininginformation rather thanasking questions, however such observation shouldbe performed in amanner that does not cause those being observed to fel that they arebeing’spiedupon' witha view tofinding out whoisnotworkingashardas they shouldbe ornot doing the work correctly. The"LowLevel" orDetail Check Listisin practiceaseries of reminders tothe auditor about the questions that need to be asked, things to be examined (documents, products, materialsete.), andrecords of previousactionsandresults thatneed to bereviewed, in order to obtain thenecessary objective evidenceto enabletheauditorto answerthe HighLevel Check List questions. The "Low Level" check listwill also detail the samplesizesthat the auditorintendsto take (the actual quantity ofdocuments, etc. to beexamined). LOW LEVEL (DETAIL) CHECK LIST QUESTIONS TO BE ASKED TOGETHER WITH AUDITSAMPLE Itisimportant that the auditor obtainssufficient ‘evidence’ to conclude that the requirementsare beingcomplied, ornot complied with. In particularitis very wrong for an auditor toreach anegative conclusion without obtaining positive proof of nonconformance, and relying instead on a general feeling that there may bea problem. Thereare somelazy auditors who donot make theeffortto find theso called" Objective Evidence" ofnonconformity, andinsteadassume from comments ‘made that there is a problem which they then report to management without obtaining thenecessary factual evidence to prove their point. Ifevidence of nonconformity cannotbe found by the auditor then the auditees shouldbe given the benefit of the doubt. 33704709 Section 67 Page 12Nigel Bauer & Associates ‘The"Low Level" check istisin practiceaseries ofremindersto the auditor about the questions thatneed to be asked and the objective evidence that the auditor needs to see, LOW LEVEL CHECK LIST: A COMBINATION OF QUESTIONS TO BE ASKED TOGETHER WITH THINGS THAT NEED TO BE EXAMINED The Auditor should always Verify answers given by Observation of actual practice The Auditor needs: “OBJECTIVE EVIDENCE”, ThePlan of Action andthe Low Level Check Listwill beused throughout the audit by the auditor, helping theauditortoremain in control ofthe auditprocess, acting asareminder of where the auditor needsto visit and what the auditor needsto see. However, theauditor willneedtoremain flexible throughouttheaudit process, and both documents will need to be adapted and added to as the audit progresses, ‘The" Objective Evidence" obtainedby the auditor during the auditshouldenablethe auditorto answer the High Level Check List questions. 33704709 ection geNigel Bauer & Associates Plan of Action & Level Check List Manager (5 mins) Entry meeting. With the Manager (25 mins) Could you explain how customer enquiries are handled ? ‘May I see the forms that are used to record customer requirements. ? How do you ensure that customers specific requirements are met ? May I see the appropriate procedures? With the Travel consultant (45 mins) First observe the processing of a customer order, then repeat the above questions and also examine a sample of 10 forms used to record customer requirements (for customer requirements processed ‘one week ago). Obtain details of holiday product options available and compare with options offered to the customers. Look at airlines used compared to preferred airline listing. With the Sales Assistant (30 mins) Observe the processing of customer orders followed by examination of records of the customer orders. Compare options offered to customers with available options. Manager (15 mins) Exit Meeting. Documents to be examined Examine 6 forms that have been used to record customer requirements. Examine the procedure - look at the process 10 identify and record customer requirements. Observe three customer orders being processed. Examine records of 10 customer orders processed one week ago. Examine the holiday options relating to the 10 processed orders. Examine the preferred airline listing. Activities to be observed: Observe the interaction between a Sales Assistant and three customers. 33/04/09 Section 67 Page 14Nigel Bauer & Associates Often, auditors who cannot find the objective evidence they require will resortto passingajudgementbymakingan "Observation’ report, Whilstthismay sometimes be ausefullmeans of identifyingaconcem that duetotime constraintsthe auditor wasunableto fully verify, itcan ead to subjective auditing (auditor's opinionrather than judgement againstrequirements),and conclusionsnot based on facts dueto theauditor’sreluctance (orlaziness) tofollowatrailand find thenecessary objective evidence. REMEMBER THAT THE AUDITOR MUST ALWAYS VERIFY ANSWERSGIVENBY OBSERVATION OF ACTUAL PRACTICE, " OBJECTIVE EVIDENCE" Inconclusion, theauditorhas developedan understanding of the targetareato be audited, has understood how the requirements of the Quality System standard apply totheactivitiesundertaken within that area, andhas then determined exactly ‘whatmustbe verifiedatthetimeofaucit. Aplanof actionhasbeen developed which willenable the auditortosystematically obtaininformation, usingacombination of questioning and examination ofphysical items, orevenjust observation ofactual activities, toenable the auditorto conclude thatrequirements areeither being met ornot, This planning approach has been found to be very effectivein focusing the auditor's mind and forcing the planning process, which isso often neglected due to the lack of time or the view often held "I know how to auditso let's get on with it 1" It has led to effective and efficient auditing, and enabled relatively inexperienced auditors to undertake some very in-depth and searching audits, with minimal disruption to theauditeesso allowing them to continue with their work as quickly as possible. QM33704709 Section 67 Page 15Nigel Bauer & Associates QM337/04709 Auditingin relation to the ISO 9001 "Process approach". Auditors will alsoneed to verify that the processis being undertaken notonly in accordance withprocess specifications orrelevant procedures, but thatthe general process managementandimprovement requirements of 4.1 are being appliedand that the processis delivering an acceptable outcome. Auditing ofthe ISO 9001 process approach will require auditors who are notonly able tounderstand the Process, but also who are aware of the various clauses of IS09001 thatmust also betakenintoaccount. Auditing of Processesto verify conformity with theprocess managementrequirements of ISO 9001 will require verification of the General requirements detailedin clause4.1 Process approach Process improvement objectives = me Process input Process ouput [2 Monitoring and measurement of the process and process outputs Criteria Resources Process Output Methods Information ection 67 PageNigel Bauer & Associates ‘There will also be feedback of performance from both the process and process output monitoring activities (8.2.3. and 8.2.1) that will be used to continually improvetheProcessmanagement activity. Herethereis an important linkinto8.4 “Analysis of data” whichholdsthekey toan organisation’ simprovementfocusand activities relating to process improvement, and subsequently leads in to 5.6.2 ‘(Management Review" where management needto work with theresultsof data, analysis to determine the need for process and quality management system improvement. Auditors wil alsoneedto establish ifthe processunder auditisthe subject ofany improvement focus, and in particular if there are any organisational goals or objectives thatrelateto the process r process output. Customer feedback may need tobe examined closely to see fthere are any significant concemsrelatingto the process or process output. Are objectives being achieved in relation o the process ? Insummary, itwill benecessary for theauditor to verify not only thatthe process conforms to the organisations process requirements, but also that the process approach principles of1S0 9001 are being applied in relation to the process, and check ists will need tobe developed accordingly. 33/0409 Section 67 Page 17Nigel Bauer & Associates SEARCHING FOR EVIDENCE Audits involve the collection of evidence in order to verify that what shouldbe happeningisactually happening, Thatpracticeisin line with intent. AUDITORSTASK VERIFY THAT THE DEFINED SYSTEM ELEMENTS EXIST, ARE IMPLEMENTED AND ARE EFFECTIVE Guidance contained in ISO 19011 suggests that evidence should be collected through interviews, examination of documents and observation of activities and conditionsin theareas of concem. COLLECTINGEVIDENCE by: CONDUCTING INTERVIEWS EXAMINATION OF DOCUMENTS/PRODUCTS OBSERVATION OF ACTIVITIES OBSERVATION OF CONDITIONS/HOUSEKEEPING ‘Theauditor’sdetailed checklistsandassociated plans ofaction will generally steer the audit process through arange of activitiesaimed at searching outevidenceto confirm conformance with the High Level checklist. Thetask oftheauditoristo verify that whatisprescribedin thedocumented quality system ishappening in practice, whatis statedby management tobehappeningis happening. Information gained through interviews shouldbetestedby obtainingthe same information from otherinterviewsorindependentsourcessuchasobservation of practice, materials/produetsand records, Theauditoralwaysneeds"ObjectiveEvidence”, however wemustalso takethe view that the auditees re innocent until proven guilty, so we are searching for objective evidence ofnonconformity tostatedrequirements, QM33704709 Seciion 67 Page TSNigel Bauer & Associates Auditor's Task INTERVIEWS + EXAMINATION (QUESTIONS —>_ [van |] onstRVATION ‘OBJECTIVE EVIDENCE Throughout heauditacertain degree of flexibility needstobemaintained. Wemust adhere as much as possible to ourauditplan andremain trueto ouraudit sample asdetailed in our checklist. However wemustnotbecomeastavetothe checklist. Auditors should always decide in advance the sampleof documents, products, materialsetc. thatthey examineatthetime ofaudit,thisisknownastheaudit'sample’ andisarecognised approach to obtaining objectiveevidence. However, there will clearly be some limitationsin elation toaudit samplingand thismustberecognised byttiose whoreceiveauditresults, Theauditormayhaveselectedarandom sample which revealed no evidence of nonconformity, although ifthe auditorhadtaken a largeror different sample such evidencemay havebeen revealed. Itisthe auditor's taskto determine areasonablesample,makingiitlargerifthere isan indication of aproblem, butnotto take such alarge (100%!) thattheauditorspendsanundue amount of time undertaking the audit. The principle of auditing isto take a reasonable samplein order to gaina level of confidencein asystem. QM33704709 Section 67 Page 19Nigel Bauer & Associates What doweexamine? Auitorswillneedtodecide what they will examinein ordertoobiainthe necessary ‘objective evidenceto beable to answer the questionson their High Level Check List. They will need to decidehow many they lookat andhow they willaccessthe necessary documents /records/items et Documentation Thereiisoftena vast quantity of paperwork thatmay be examined by an auditor, eg. Procedures/Work Instructions QualityPlans ProjectPlans Inspection/TestData Specifications ‘Drawings Contracts/Orders MinutesofMeetings FailureReports Vendor Performance Data VerificationResults DesignReviewMeeting Minutes ete.,et. Proceduresmay be examined for.A vailability, Application, Interpretation, Issue Status, and general employee understanding, However wemustbecareful notto betoocritical oftheadequacy ofaprocedureunlessthereisevidence of things going ‘wrong duetothelack of detail provided to staffin the procedures. Remember, procedures are providedto communicate company requirementsto theauditees staff ,and not for the auditors ! When auditing itis not good practiceto simply ‘request variousdocuments for examination on the off'chance'that youmnind find something wrong, Youshould decide which documents will provide youwiththe evidence thatyourequireto answer the questions on your High Level Check List andthen ensure hat you obtain a sample of your choosing. QM33/04709 Section 67 Page 20Nigel Bauer & Associates ‘The following provides examples of typical items that auditors might wish to ‘examine duringan audit, dependent upon the type of organisation they are auditing. Goodauditorswillalwaysremainalerttopotential problemsinrelationtothese, and afewreminders arealsoprovided (although auditors shouldnot get sidetracked fromtheirprimary objectivesas detailed on the HighLevel Check List, they should nevertheless remainalertto such potential problems). Theauditormay decideto examinethe following: Tools: Material Products: People : Correcttools Storage facilities Operatinginstructions Calibrated/ Adequately maintained Correetlyused Company issue Identified Responsibilities (forstorage, calibration, maintenance, etc.) : Correctmaterials Handling/storagefacilities Tentitied Correctly used Disposalfaciltes Shelfliferequirements Appropriate instructions Safety wamings Retumnto stores ‘Identification Storage Handling Packaging Testresults/Inspectionresults Traceability Conformance Paperwork Competence (Training /Qualificationsete:) Attitude Physical attributes Suitableeavironment Sufficientnumbers Familiarity with Proceduresand Instructions Awarenessof responsi Availabilty Q33704709 Section 67 Page 21Nigel Bauer & Associates Auditing Technique. Atthetime ofauditwemay usea combination of auditstrategiesand techniquesin order to verify conformance torequirements, Theauditor shouldalso maintain a degree of lexibilityandbepreparedtofollowaudittrailsasthey arise. The following of audit trailsmay of course prove helpful or a complete waste of time, and the auditor must use judgement in deciding when to follow trails that may require considerable deviation from theaudit sampleoriginally deemed necessary. ‘Theauditor followsalogical sequence of audit progression through an activity. The auditor may start at the beginning of aprocess and observe the processas each process stepis undertaken, asking questionsat appropriatetimes or requestingto seevariousdocuments, examiningmaterials,toolsetc. Alternatively theauditormay start at the output of the process and work backwards to establish how the organisation has rrivedatthe outputs that have been obtained. ‘Theauditormay decideto start with managersand work down' the organisation toworking level, ormay first observe the process and then work up through the organisation talkingto supervisorsandthenmanagers. Example: Information contained within aClient File. ‘Theanditormay decidetoexamineaclient file and select some of the contents for examination. The auditor could check the file index to verify that what has been selectedshouldbe contained within theclientfile, and then examine theprocedure to verify that the index and whathasbeen selectedisrequiredtobecontained within thefileby theprocedure. Theauditor could then question management (orprocess owner) toestablish the view of what isrequiredtobecontained within the lientfile, Theanditor hasundertaken a'backwards trace. Analternativeapproach wouldbeto talk with management (orthe process owner) first to establish needs, then examine the procedure to see that the needs were reflected, andthen examine theindex ofaclientfilefollowing which thecontentsof the file would be examined to verify that what was supposedto bein the file was indeed present ‘Theadvantage of the firstapproach is that the auditormay findsome very interesting details contained within he client file that mightnot befiledin the correctplace,or may indicate apossible problem inan aspect of operation thatrelatesto general ‘mattersinvolving the interface withclients. Ww33704109 Seciion 67 Page 2A second example involving a "Goods Receiving Process” ‘The auditor may decide to observe the process of receiving goods into the ‘organisation, beginning with the goodsin thereceiving area and observing the progress of these into a stores area (or directly to the point of use). The auditor ‘would observe activities undertaken, asking questions of staff as appropriate, examining work instructions, inspection/test toolsand equipment ete. An alternative approach, working "backwards' would be to begin the audit in the stores area, selecting some items, requesting to see the paperwork that relates to them, identifying the inspector, obtaining the inspection records, viewing the inspection instructions and verifying that the records are as the instructionsrequire. Theanditor could then verify that the instructionshavebeen producedtoreflect the requirements of associated design specifications, and have been correctly authorised. The auditor could also identify the supplier and establish that the goods have been received from a supplier that is "Approved" and has been formally ‘evaluated’. Clearly backwards tracing can be very probing and leads the auditor quickly into the possibility of following trails, however itismuch easier for an auditor tobe distracted from the original objective when working in this manner, and 80 careful control over the process needs to be exercised if the auditor is to complete the intended audit tasks without unnecessary distraction, Methods & Techniques FORWARD TRACE BACKWARDS TRACE pay 33/04/09 Section 67 Page 23Nigel Bauer & Associates TrailFollowing ‘During the course ofanaucittheauditoruncoverssomethingthatis worthy offarther investigation, however thisnow leadsaway from the original planofaction andmay eveninvolveprogressingtheauditinto other areas ofthe organisation notoriginally intended for audit or areas that have been/areto beaudited at some other time. WESHOULD ALWAYSBE PREPARED TOFOLLOW TRAILS. Sometimesitis better totakenotesand follow the trail atamore convenient time ‘or when the audit moves to the area where the trail leads. Itmay even be more appropriateif time is limited toreportthe concem tothe auditeesin orderthat they may investigate. (This doesnotmean writingan "Observation Report!) ‘Throughout theauditacertain degree of flexibility needstobemaintained. Wemust adhereasmuch as possible to our audit plan andremain true to ouraudit sample asdetailedin ourchecklist. However wemust not becomea slaveto the checklist. Ifatrail arises thatis relevant to the overall objectives of the audit, or relates to something of major concem (safety, health etc.),then consideration shouldbegiven toinvestigating fully. ‘The followingofaudittrailsmay of coursefail reveal nonconformitiesand waste alargeamount ofaudit time, and theauditormustusejudgementin deciding when tofollow trails that may require considerable deviation from the audit sample originally determined, Insomecasesitmay benecessary torefer such decisionsto the auditteam leader. Atthe time ofauditwemay usea combination of auditstrategiesandtechniquesin order to probe the system and verify conformance torequirements, The auditor shouldmaintain a degree of flexibility andbe prepared ofollow audittrailsasthey arise andifrelevantto the audit objectives. Itshouldberemembered thatthe audit is being conducted to provide both the auditees and the auditor's client with information witha view to overallimprovement. Qws3/04709 Section 67 Page 24Nigel Bauer & Associates CONDUCTING INTERVIEWS AND ASKING QUESTIONS Interview Techniques From ourplan faction weknow who weshouldinterview and what information ‘weare searching for. The persons we wish tointerview willrange from very senior ‘managers throughto those who actually undertake the day today activitiesinthe organisation and clearly the information we seek from the different levelsinthe hierarchy willbe possibly differentand will need tobe soughtafterin different ways. ‘Weneed tobeawarenot only of whowe wish tosee, whatwearetryingtoestablish and therefore what questions to ask, but we need also to be aware of the psychological aspects of this process. Remember also that even asking one question of anauditeeiseffectively conducting shortinterview. Forseniormanagers we will inevitably adoptamore formal style of interviewing techniquethan with otheremployees. Seniorstaffaremorelikelyto feel comfortable with tisstyle, andit canbe modifiedto suit the circumstancesandtherelationship between both partiesthat either existsatthestart of theinterview orasitprogresses. Both the interviewerand interviewee appreciate that timeisalwaystheenemy and well preparedinterviewer will beabletoextract the necessary information inthe shortest time and allowabusy manager to geton with his work A Interview Techniques M33/0409 Section 67 Page 75Nigel Bauer & Associates Weselect the right people during the preparation and planning stages, and the generation of check lists ensures that we are well prepared, Interviewersmustrememberthateveryoneishuman, and thattheintervieweemay notfully understand what wearetrying toachieveandmay havesomefearsabout theprocessand the eventual outcome. We willachievefarmoreiftheinterviewis conductedinarelaxed atmosphereand one whereneither party feelsthreatenedor intimidated. Good interviewers learn to adjust their style dependent upon the response to the process from theinterviewee. Theinterview process: ‘Thereare fourbasicstagesto conductinginterviews. Preparation Preparation iseverything previously addressed for audit/assessment preparation, however, theinterviewee also needs tobe prepared for theinterviewprocess. Clearly for senior managementthere should already bea goodunderstanding of ‘whatanassessmentislikely toinvolve,andone alwayshopesthat appropriatesteps have been taken to convey this to middle management and other company employeesandthe part that they are expectedto play. However, when interviews are conducted with middle management one must expectto spenda short period oftime" preparing” theintervieweeforthequestioningprocess, introducing yourself and explaining what youare about to doandhow you intend to doit. Entry ‘Thefirststep in undertaking a successful interview istoarrive ontime. Introduce yourself to theintervieweeand ensure yourecordthe interviewee’ snameandjob title when they introduce themselvesto you. Itisimportant tospenda shortperiod of time gaining the person’s trust and confidence, if necessary explaining the assessment process and how you intend to proceed. If possible request that {elephone callsand otherinterruptionsbe blocked andindicatethetime that youwill need. When the personis seated comfortably begin by explaining the processand give theinterviewee the opportunity toask questionsabout the process andhow theinformation gainedwill beused. ws304709 Section 67 Page 26Nigel Bauer & Associates Itisnot good practice to use ataperecorder at such interviews, however ifthe interview is to be recorded ask permission to do so. Explain that you are only recordingthe interview so that youcanpay greater attention otheintervieweeand willnothavetotakedetailed notes. Lettheintervieweesee the aperecorder, switch itonand placeitinfull view. Ifthereis clearly anegativereaction, ortheinterviewee isuncomfortableabout theuse of ataperecorder, don’tpush the point, switch it offandreturn totakingnotes. ‘Tfaguidehasbeen allocated by the company, try toensurethatitis the interviewee thatrespondstothe questions. Conduct Interviewsare conducted by basically asking questions of the interviewee and taking appropriatenotes of theresponses. Fora well prepared interviewer the previously prepared check list provides a framework for the interview andenables satisfactory responses tobe recorded against each question. Only points of interest, variances to previousresponses (obtained from previousas wellas this interview) and outrightdeficienciesornon- conformances need to be recorded. Referto section “Questioning Techniques” @w33704709 Section 67 Page 27Nigel Bauer & Associates Exit Onceall questionsontthe check listhave been addressed give the interviewee an opportunity to make any other comments. Now is the time to summarise any concerns or deficiencies that have been noted and ensure that the interviewee agrees with your conclusionsand frequired signstheofficial recordof findings. aguide has been present throughout theinterviewyoumay require thispersonto sign such fonmal documentation. Tell theintervieweewhat youneedto donext(you ‘may needtobe taken toanotherpart of the company orbeintroduced tosomebody clseinthesame department), thank the interviewee fortheir time andco-operation, INFORMATION GAINED THROUGH INTERVIEWS SHOULD BE VERIFIED BY ACQUIRING THE SAME FROM OTHER INDEPENDENT SOURCES, SUCH AS PHYSICAL OBSERVATIONS, MEASUREMENTS AND RECORDS. REMEMBER THAT THE AUDITOR MUST ALWAYS. VERIFY ANSWERSGIVENBY OBSERVATION OF ACTUAL PRACTICE. " OBJECTIVEEVIDENCE" ssa Secilon 67 Page 28Nigel Bauer & Associates Questioning Techniques: Anauditorneedstobea good communicator. However, communication mustbe inboth directions, anditisnecessary forthe auditorto seck information by asking aquestion, and then to await and fully understand theresponse to that question. ABAD AUDITOR ISONE WHO CULTIVATES ONE-WAY COMMUNICATION. Eitherby: ‘Asking closed questions. (Thoserequiring only a YES/NO response). ‘Asking and answering own questions. Notgiving theinterviewee sufficient timetorespond. Notasking questionsatall, ustcontinuing to chator expressing opinions ‘Theauditor must leamhow'to formulate and ask questionsthat promote feedback of information, and also how to gather additional information when the initial feedback includes generalisations or distortionsorhas omissions. ‘Weuse language to communicate thoughtsand ideas which existin ourbrains, however the words weuseare only arepresentation of those thoughtsandideas. ‘Wedonotcommunicatetheful extent oftheimage/thoughts/feelingsorunderstanding thatexistsin ourmind, and some people findit very difficulto convey in words what they really mean, Hence the language that weuse may notbe translated back into thesameimage/thoughts/feclings/understandingby therecipient. Oncettherecipient isawareof this problem he/she can work to build up abetterpicture by testing the information givenandretrievingmissinginformation. ‘Thus communication from an intervieweemay include generalisations, omissions and distortions, anditis thejob ofthe interviewer toretrieve thismissing information toprovidea clearer ormore complete representation. Aninterviewer, and hence assessor or auditor, mustknowhow toaskaquestion in he firstinstanceto gain information, andin the secondinstancetoask further questionsto clarify or obtain moreaccurate or complete information, Thefollowingareexamplesofthis technique 3304709 Section 67 Page 29Nigel Bauer & Associates | Missing Information ‘Theinterviewermustsupply omitted information or, recognising thatitismissing, ask formoreinformation, Q. Whatisthe biggest problem with the order entry process? A. Theprocesstakestoolong. Q. Toolongcomparedtowhat? Q._ Whatprevents customerinvoicesbeing sentouton time? A. Thecomputersystem isalways going down. Q._ Howoftendoesthe computersystem godown? ‘Whatisan acceptablelevel of down-time? 2. Unspecified Nouns “Vehicle”islessspecificthan “car”, “Car”isless specificthan “BMW” “BMW” islessspecificthan “320i”, WordslikeIT, THIS, THEY arealso very unspecific terms. Q A Q PPro Whatisthe biggest problem inthe department? Theyarealwaysoutsick. Whois often absent because of sickness? Howoftenare they absent? ‘Why are transport costs high? Unreliablevehicles. Whichvehiclesareunreliable? W33704709 Section 67 Page 30Nigel Bauer & Associates 3. Unspecified Verbs Some verbsaremore specific than others¢.g. “carry” ismore specificthan “move”. ‘To getmore information an interviewer will use the word “HOW”, Thus: ere aro ‘Whathappensto thecardboardwhenitleaves the corrugator? Wemoveit tothe Work-in-Progress Store. How doyoumoveit othe store? ‘Whathappens when thealarm bellrings? We shut-down the process. How do you shut-down the process. 4, Words SpecifyingNecessity Very often an interviewee will use words that imply a lack of choice, such as CANNOT, SHOULDNOT, MUST, SHOULD; thereisactually achoiceandon further questioning the interviewers often ableto establish why thereisalackof choiceorwhattheactual choicesare. ‘Thus ‘Thecustomerneedstoknow the pricing structure forthisproduct,can youprovideit? ‘Weshouldnot give customers that information. Whatisthereason fornotgiving the customer this information? What wouldhappen if youdid? (Wecouldalso establish ifitis“all customers” or just some customers ‘who shouldnot get thisinformation). ws370409 Section 67 Page 31Nigel Bauer & Associates 5. Universal Quantifiers Words such as “NEVER”, “ALL” and “EVERYBODY” are universal quantifiers and are usually used asa very broad generalisation. The interviewer should not accept these generalisations and should try to obtain additionainformation. ‘Thus: How doyouensure traceability of thesepiece parts? ‘Wenever need to trace where these parts go. ‘What wouldhappen if you supplied defective items? 2ro How dothe management feel about undertaking Quality Audits? ‘They areall enthusiastically in favour oft. All? Whomightpossibly bemost defensive about theresultssoasnot tobein favour? pre Key Words Intheprevious sectionyou will have noticed the frequent use of certain key words. ‘Words which may be used in a question to force aresponse (i.¢. open questions), way WHEN WHERE, WHO WHAT HOW ‘These words may beusedto very good effect, but particularly when used with SHOW ME are very powerful in gaining not only information but enabling verification of whatissaid, Thos Q Howdoyoustore flammablematerials? A. Theyarestoredinaseparatesecure area provided with appropriate ‘wamingsandfirefighting mechanisms. Q._Couldyouplease SHOW ME! QN33/04709 Section 67 Page 32Nigel Bauer & Associates Testing the System Sometimesinorderto “test” the system the auditor will usehypothetical questions such as Whathappensif oun Howwould yourespond when Letus supposethat Occasionally the auditor will notunderstand heresponsetoa question; thereisno shameinrequesting the auditeetorepeat or expandupon thereply. Sometimesthe auditormay pretend not tounderstand, and sorequire the auditee torepeat their answer. The auditee will then respond by providingamore detailed answerand possibly givinginformation that indicatesasystem weakness, orprobl Tamsomry, didnot quite understand that, could youexplainthatagain please? Repetitive questions can be very usefillto verify conformance toprocedures. Thesame question may be asked of different people, toseeifthe responseisthe same, Thesamequestionmay beasked ofthe same person, withanintervaloftime, to seeiif theresponse is the same. The same question may be asked of the same person, butaskedina different way, oseeiftheresponseisthesame, Inall cases if there isadifference in the response then the auditor needs toinvestigatein more depth ofindifthereisanonconformity. Sometimesitis useful to find outthe opinion thatan auditeehasof aprocedure,or system, If they appear to consider the procedure to be complex, or even unnecessary, then it may indicate o theauditorthat the procedureisnot always followed andso further investigationisneededto seeifthere areinstances when therehasbeenafailuretocomply with theprocedure Remember also, the power of silent questions. Nonverbal questions, suchas heauditor slookof disbelief, thepuzzled expression, theraising ofeyebrows, etc.,all encourage theauditeeto continuetotalkandso providethe auditor with moreinformation, The auditor should not avoid asking the obvious questions, and this can be a particular problem for auditors who have technical knowledge about the audit subject, andwhomay feel that by askingan obvious question they areinsome way revealing their own weaknessin knowledgeto theauditee. Ws304709 Section 67 Page 33Nigel Bauer & Associates In Summary, theauditorneedstobesystematic. All questionsthatoughttobeasked should beasked; fitison the check lst, then it must beaddressed. Weshoulduse various questioning techniquesaimedatestablishing whatis happeningand which encourage the free flow ofinformation. Such questions may be: ABOUTATHEME SEEKING OPINIONS REPETITIVE HYPOTHETICAL CONFIRMATORY NON VERBAL, Once wehave askeda question wemustthen give theauditeean opportunity to respond, and mostimportant ofall wemustlisten carefully to theresponse AUDITORS MUSTLEARN TO LISTEN WITH THE MIND AS WELL AS THE EARS ! Points to remember a Talk to the person who does the job. Don't talk down. Tallc the language ofthe audites, Speak clearly. Re-phrase the question if not understood. Don’t confuse - pose one question ata time. ‘Come back if information is not immediately available. Q33/04/09 Section 67 Page 34Nigel Baner & Associates ___ Anditetiquette: a Itisworth noting that herearenorulesthatrelatetothe generalactivities of auditors introduction x thanks specified in any national or international standards, only approaches that have evolved overtimeand been foundto behelpful in ensuring audit objectives are satisfied in a systematic manner satisfactory to the auditees and the client and generally in ensuring no misunderstandings, bad feelingsetc. Thisisthe whole ther cle purpose of ISO 19011. The protocols provided in ISO 19011 relating to Opening, (Closingmeetings, audit preparation, gathering ofinformation, rolesandresponsibilities ~ cemtinher thet ye" S°© — ofauditorsandteam leaders, evaluating findings, reporting of nonconformitiesete. eouest th the euchbees — areregardedas good practice and provide general guidanceora'code ofppractice’ lev™ forauditors. = fe camain pleasent & pote Mame cengect 42° gentle # ‘Themain problem inrelationtoauditingistheselectionoftheright peopletoactas auditors and ensuring that they do not misunderstand their role and associated not Sub Gectves responsibilities, orassume that they have some increased authority asaresultof acting as an anditor. Many auditors have become filled with their own self importance. te remain obsectve froblems Auditors should always remember that they are not auditing for their own el amusement or tokeep themselvesemployed, they are thereto obtain information onbehalfoftheir‘lient. They shouldalwaysconduetthemselvesina frendly,non Ahey ore om elite 9°? threatening mannerremembering thatatalltimesthey area'guest in someoneelse's cg" @uelits Spec'stst” — ouseandsoshould obey the house'rules. They shouldnever accuseortrytomake people eel gulty ofa'crime’. Theirtaskisto find the objectiveevidence without resorting totricks and traps, to focus on important things and nottriviaandnotto jump upand down with ecstatic delight when they findanonconformity'! audites belveve Auditors should always respect confidentiality at all times and be aware of sensitvitcsin thisrespect. tis often thecase thatregulatory auditresultsare entered into thepublicdomain,andany regulatory auditor will need tounderstand that this is the ease and that what they write into audit reports, or documents that they photocopy and take back to their office could be viewed by others on demand. ‘Many organisationsare very concerned that auditors willaudit ompetitorsandthen reveal commercial secrets unintentionally). A typical example ofthisisan auditor ‘who notices an example of good practice in one organisation and then triesto encourageanother organisation to adoptthis practice -thisisusually done byan auditor making "observations" (expressions of personal opinion based on the auditorsown experiences). Some organisationsarenowinsisting that the auditors they see from a ThirdParty organisation arenotinvolvedin carrying outauditsin competitor organisations. Auditors houldkeep their opinionsto themselves, and only give them totheir' client iftheclienthasasked for ther 433704709 Section 67 Page 35Nigel Bauer & Associates Auditors should always be sensitive to the needs and feelings of the people that they are auditing, and have respect for people generally and be aware of and sensitive to cultural issues, particularly when working outside of their usual cultural environment. They should always politely introduce themselves to ‘whoever they meet and explain what they are there to do. Itisnotnormal practice forauditors to demandto see things, orspeak withpeople, always torequest, and to respect the right of the auditee to sometimes refuse a request (it may be for a good reason). They should never remove or keep documents etc. without a formal request and should always askiif they wish to photocopy any item. A fterexamining itemsthey shouldhandthem backand thank theauditee. ‘Upon completion of an auditactivity the auditor should always thank those who haveassistedby responding to questions or providing information, access oareas etc. Auditorsshould always remember that they areina very privileged position and should never abuse that privilege. WIT Section 67 Page 36Nigel Bauer & Associates AUDITOR ANDAUDITEETACTICS ‘ThePsychology of Auditing Itshouldberemembered thatauditors and auditeesare only human andthat both partieshavea clear understanding of what they aretryingto achieve, From theauditorspointof view, theintention isto expose any weaknessthat there ‘may be in he Quality (Management) System, however from theauditees pointof view it may be undesirable for the weaknesses to be observed by an external auditor. Hence agameis often played! Peoplecan often feel threatened when the auditorsappear, they may fear for their jobif'deficienciesare foundin theirarea ofresponsibility. They may be easily upset. Managersin particularmay feel thattheirability tomanageisin question. Peopledonotlikebeing observed carrying outtheirday today tasksby those with acriticaleye. Ifwetaketheabove into consideration, then itishardly surprisingifsometimesthe auditorisnotmadeto feel particularly welcome! Or indeed feelsthat the truthis beinghidden. Weshouldtry andremembera few simple rules thatrelate to the personal sideof auditing: Berelaxed. Behuman. Becourteous. Display interestin theauditeesand their work. Remaincool,calm andcollected Actprofessionally. Remember that auditing is not "interrogation". The auditor should engage all auditeesin gentleandpolite conversation, injecting questions as appropriate, and should not appear to be disappointed when nonconformities are not found and ecstatically excited whenthey are! QM33704709 Section 67 Page 37Nigel Bauer & Associates Auditor Tactics ‘Thetask ofthe auditoris to clearly establish if working practices accord with the appropriate Quality System Standard and are in compliance with laid down procedures, and todo this certain tactiesmay need tobe adopted depending upon thesituation atthe time of audit and the degree of co-operation that prevails, Inordertoremainin control, the auditor shouldrememberthe following: Be well prepared. Beontime. Geton withthe task, Donotargue. Use the check list Discussproblems when they are found. Additionally, the following are points worthy ofnnote: If you cannot get the information that you require in one part of the organisation, seekitelsewhere Ifyouare faced with non-co-operation from one person, try another. Verify statements madeaboutother departments/sectionsin those other departments/sections Always seek evidencetto verify comments made. Follow trailsto theultimate conclusion (ifthey arerelevantto theaudit), ‘Retumto areas/peopleif moreinformation, clarificationorre-confirmation isrequired. Gain agreement with findingsas you go(andsignatureson formsif appropriate). W305 Section 67 Page 38Nigel Bauer & Associates AuditeeTactics Itisworthnoting thata successful auditisdependentnot only upon the skill ofthe auditor, butalso upon the degree of openness and co-operation ofthe auditees. The auditorstaskcan often bemade more difficult when faced with the following, and askilful auditormustleam howto handle successfully these situations: Argumeniativepeople, Outrightaggression ‘Timewasters. Wailers. Flatterers, Senility. One-upmanship. Planned/unplanned interruptions. Cook’s Tours and long explanations. Extended coffee/lunch breaks. Pleading of special cases. MissingDocuments. ‘Remember, themost difficult peopleto auditare very oftenthosewhohave been ‘rained asauditors themselves, they knowall thetricksinthe book! Auditingisaboutlearning to talk toand handle people, and itis worth noting that auditors should be selected from those who exhibit the necessary attributes, as well as those who have received professional training. w33704709 Section 67 Page 39Nigel Bauer & Associates RECORDING THE RESULTS Asanauditorconduets interviews, passes through the various departments of an organisation and generally observes working practices, there will ofnecessity be aspects of operation or commentsmadeby auditeesthatneedtobe recorded for furtherreference. However, justhowmuch shouldberecorded? ‘Theauditorshouldmaintainarecord of areas visited, key staffinterviewed, and, where it may be necessary to refer to in subsequent discussions or interviews particular observationsmade, itemsofequipment/tools/materialsand documents viewed. Itisnotnecessary torecord the details of all interviews orresponsesto questionsasked, however an auditor quickly leams thatitis very necessary totake goodnotesatthe time of auditas invariably they willneed to bereferredtolaterin theauditor when writingaformal report. Such auditorsnotesare forthe auditor's personal use only and are very rarely retainedas formal auditrecords(although some auditors will keep them until thereporthas been accepted). ‘Asaminimum the following shouldberecorded in aformal manner: Instances of nonconformancetothe Quality System Standard, Instancesofnonconformance tothe Quality Manual or documented working practices. ‘These formal records constitute the output from the auditand should berecorded on official paperwork. ‘Such formal records will inevitably betermed ‘Deficiencies’ or*Nonconformities’. ‘Theactual term used may vary dependentupon the auditing organisation. Forlnternal Audits company auditorsinvariably use the terminology givenabove. Forassessments undertaken by second or third party organisations the following termsmay alsobe encountered: Non-ComplianceReports(NCR) Corrective Action Requests(CAR) Diserepancies 83104709 Section 67 Page 1Nigel Bauer & Associates ‘Theimportantpointtorememberisthattheauditormustdetail clearly andconcisely what hasbeen observedand why itisaconcemn. Theauditeeneeds to know what theproblem isbeforeit can be satisfactorily corrected. The term " Observation" is not preferred by Nigel Bauer & Associates as it is invariably misused by auditors to indicate either a lower order nonconformity or an impression gained but without supporting facts. Itis also often used by auditors as an expression of personal opinion which could be closely linked to the auditor recommending a course of action or encouraging an organisation to adopt a practice which the auditor has learnt about in a competing organisation. Auditors mustremember that they should report only agreed findings based on factual evidence. Itisgoodpracticeto gainthe signature of the auditee (orauditee's representative)on the audit ‘Nonconformity’ report, howevernot ll third party ‘organisations wll dothisat the timeoffindingthe factsbutmay waituntilalatertime when reviewing the aditresults with managementorthemanagementrepresentative, Itisimportanthowever that the facts are agreed before the auditors move onto another area, and good practice tocompleteanonconformity report atthetime of finding thenonconformity and gaining an auditee signature (guideorseniorperson withresponsibility fortheareabeingaudited-nottheactual person atworkinglevel, astheymay feel that they arebeing forced toadmittoacrimeand signing toagree theirguilt!) TheNonconformity statementneedsto be worded so thatitisunderstandableto those whowere presentat the time ofaudit and alsoto those who werenotand who ‘maybe involvedinimplementing corrective actions. ltisameansofcommunication, andiftheauditee cannotunderstanditthen theauditorhas failed tocommunicate effectively! ‘Thus theneed torecord facts: What was found Where was it found Why is it a Deficiency Who was present at the time when the nonconformity was revealed (if this is considered appropriate) 3304109 Section 67 Page 41Nigel Bauer & Associates Statementsshouldbeclear,conciseand meaningful toenabletheauditeeto fully understand the problem andcorrectit, Remember that such statementsneedtobe ‘writtenatthe time of audit andso shouldbeshort, sharp andto the point. Itisnormal protocolnottonamenamesin such statementsasthis could iverisetotheallocation ofblame withoutdetermining thereal (root) cause ofthe problem. Itisbetterto give someone'stitlerather thannameifitis unavoidably necessary. EXAMPLES: 1 Procedure EM008 issue 03 requires that all temperature controlled vehicle trailershavethetemperature monitoring unit checked monthly. Records of such checks viewed in the Logisties Department indicate that Vehicle trailer GB107has been in service forsix months withoutsuchacheck havingbeen performed. Procedure CBD1/91 requiresall out of dateleafletsto be removed fromthe display pointimmediately on receipt of re-issued stock Leaflets BEO3, BEOS and BEISA were displayed at the reception desk alongside versionsBE03A,BE0SA andBE15B, whichhadbeen issued6 ‘months prior tothe date of audit ‘Work Instruction JF1063/1 foundin the possession of laboratory technical assistant Ian Howes was found to be at issue 03. MasterRecord Index MRIO10 indicatesthatthelatestissuethatshouldbe inthe possession ofall relevant staffis 04. Qu33/04709 Section 67 Page aNigel Bauer & Associates ‘Tomakeit easier to write anon-conformance itis suggested that auditors first collect information in the categories WHAT, WHERE, WHY and then try to rearrange the words to provide aclearandconcise statement. Forexample: Issue 03 drawing for Frame Assembly (GT 0816). Inspectionareaof production unitB. Production planning document PP86requiresissue 04 Inspector undertaking inspection of frameassembly. Thiscouldbe written as follows: Inspection of Frame Assembly GT0816wasobserved beingperformed intheinspection area of production unit B by inspectorusingissue 03 of drawing, Production planningdocumentPP86indicatesthat issue 04 drawing shouldbeused. Altematively: Inthe inspection areaof production unit B, frame assembly GT0816 was being inspected to issue 03 of drawing instead of issue 04 as required by production planning document PP86. ‘There are many ways of saying the same thing, whatis important isto convey ‘meaningful informationto the auditee to enableappropriatecorrectiveaction tobe undertaken, and odo sousing the minimum number of words whilstnotlosing informationormeaning. Someauditing organisationsrequire theirauditorstocategorisenonconformitiesas ‘major orminororattach anumericalindicator of severity,i.e. Category 1,20r 3.Itisimportant for an auditorto differentiate between things that are ofaserious natureand those thatmay belessso, however the categorisationsincommonuse (and notidentified in ISO 19011) are consideredtobe somewhat subjectiveand couldresult inmuch debateat the time of audit, particularly iftoreceivea'major’ nonconformity couldresultin thelack of formal approval orlossofan order. Such judgements are bestleftto the Team Leader onceall audit results areavailable, wa3704709 “Section 67 Page 43Nigel Bauer & Associates Insummary, thehuman shorttermmemoryisnotparticularly adeptatretaining large amounts of data when such datais being rapidly received, Inan auditsituation we areinacompletely new and possibly strange environment, itiseasy tobecome overwhelmed by what we see and hear. In this situation itis often difficult to rememberall ofthose interesting things thatneedtobeinvestigated furtherat some latertime orin anothersection ofthe organisation, Itisadvisableandindeed good practice foran auditor torecord thistype of datain workingnotes. Also, notes shouldbemadeof who has been interviewed, where inthe organisation the audit has been conducted and what procedures or documented working practices or drawings tc. havebeen examined. IF ADEQUATE NOTES ARE NOT TAKENIT WILL BE VERY DIFFICULT TO RECALL WHAT HAS BEEN OBSERVED. Donottrust yourmemory, write down informationasyou go. Donot clutter yourmind with trivia Use your check listand record onitifyou wish. Record whatneedsrecording, i.e: Section/areaaudited Person(s)interviewed Documentnumbersandissuestatus Equipmentidentification Product‘material identification General housekeeping conditions Makemental notes or write down impressions gained of: Workloads Attitudes Reactions (Organisation Condition ofequipment Awarenessandunderstanding ofprocedures Remember to listen to what is said and observe at all times, analyse and record whatisimportant,and when nonconformitiesare found. Record the important facts and gain agreement with those facts. WBI04709 Section 67 Page