Auditors Special: The Universal Method for System Auditing

Many auditors find it in practice challenging to reconcile system audit criteria and practice, and expert audits could be improved.  Leaders feel that the system audits are not delivering the results critical for the organization to get into a continuous improvement process.

Top management often complain that the Nonconformance Reports (NCRs) are fragmented, lack refining, and are unable to guide the organization in performance improvement. On the other hand, auditees intend to regard NCRs as cliché, as they cannot see the benefit behind the requirements by reading the scattered and isolated findings.

The most frequent NCRs found by internal auditors are

• 5.1 Operators do not operate according to the working instructions
• 7.2 People lack training
• 7.5 Documents on-site are of incorrect version or not available
• 7.1.5 No identification for the measuring device or the calibration certificate expired

In fact, if auditors make good use of system audits, it’s an excellent opportunity to bring meaningful value to the business operation. It can be used to identify the causes of poor performance, assess process capability, verify the suitability of the process and its interactions, evaluate the effectiveness of its implementation, identify system risks, and prioritize processes for improvement.

With years of experience in auditing and organizational process analysis thinking an auditor could improve the quality of quality audit from two aspects:
1. The audit trail should have a process perspective.
2. Auditors should understand the intent and purpose behind each requirement of ISO9001.

To support the first 2 efforts, an auditor should ask another question: What kind of skills should a value-adding auditor have?

The audit trail should have a process perspective

Five common audit trails auditors use the most:

• ISO 9001 clauses-based audit trail
• Documented procedure-based audit trail
• 6M-based audit trail
• Problem-based audit trail
• Department-based audit trail

Each one of the five trails has its advantages and disadvantages. Auditors should not be limited to any single one when conducting a management system audit. While these five trails are risk-based by nature. None of them are complete and comprehensive, even all of them were put together. The reason is: What the 5 trails check is the conformity of requirements or risk-prevention efforts, but not touching the process effectiveness. The findings do not link with each other and do not point to the effectiveness of the processes and the system as a whole. That means they do not talk about business performance. In short, these trails ignore an essential perspective: the Process Perspective.

A common language of auditors about QMS within the organization

All organizational operations are about the running of processes. These processes are interrelated and interactive, forming a network of processes. The network’s output is the organization’s business performance (e.g., first-passing rate, quality cost, customer satisfaction, etc.). The audit findings should be mapped to these processes, indicating individual process capability and the effectiveness of their interaction to discover the causes of the underperforming results. The audit report should prioritize the processes that need to be improved, but not count the number of NCRs labeling clauses.

It is the process that makes the way of people work together. When talking about improvement, what should be focused on is not the department nor the people, but the way to get the jobs done. The process perspective allows auditors to discuss the way of cooperation, avoid falling into the trap of “finding the bad guy,” and provide a common language about QMS within the organization.

The Universal Method for System Auditing (UMSA)

Adding the process perspective to the abovementioned 5 audit trails, it comes to the Universal Method for System Auditing (UMSA) as below. Being combined with the five audit trails, the Process-Based audit trail becomes a universal audit trail that can be applied to any organization, even to the auditing of any management system.

The UMSA consists of the five following steps, and with each one, a few auditing tips are attached:

1. Identify processes
2. Match clauses
3. Select evidence
4. Verify evidence
5. Examine process management

Being combined with the five audit trails, the Process-Based audit trail becomes a universal audit trail that can be applied to any organization, even to the auditing of any management system. Under the comprehensive view of the UMSA, the audit findings can be mapped to the processes. The conformity findings can be linked to the effectiveness of the processes and their interaction. Seeing through this way, management could see the causality between findings and the performance. This is the core value and meaning of the system audit. The process owner’s responsibility for process management will also be carefully checked. The UMSA can cover all the activities of the organization’s operation without omission, to provide managers with insight into where to improve the effectiveness of the overall operation. In this way, UMSA greatly complements the shortcomings of single use of any of the 5 common audit trails.

However, the “process-based audit trail” also faces limitations and challenges: Many organizations have inadequate identification of processes. The interfaces between processes, particularly for cross-departmental processes, were not clearly defined.  The process owners are not clearly appointed. This situation would limit an auditor to identify processes when implementing the UMSA. In addition, the UMSA requires auditors to be able to match the ISO 9001 clauses to process steps, which requires understanding the intent and purposes of both process steps and the ISO 9001 requirements. This is a competency challenge for auditors.

Expand practical knowledge for auditors

Do you want to learn more about how auditors really understand the intent and purpose behind each requirement of ISO 9001 and what kind of capability a value-adding auditor should have?Then you should know the webinar “A universal method for system auditing – A few tips to improve the quality of quality audit” delivered in English and Chinese. Here we provide tools and techniques to align the audits and enhance their quality. Learn more about:

• How to link the criteria with processes.
• How to check criteria being applied in a specific process.
• How to see through a process to select evidence that can be projected accurately to criteria.
• Learning path to achieve the higher professional level

Register now for more practitioner knowledge!