I am often asked the question "Do I have to do process auditing?" ASR has had many discussions concerning this topic. So I would like to analyze the requirements and try to reach a logical conclusion that adds value to your quality management system and sets out ASR's expectations for your internal audit program.
Let's start by looking at what ISO 9001:2000 requires:
"The organization shall conduct internal audits at planned intervals to determine whether the quality management system
a) conforms to the planned arrangements, to the requirements of this International Standard and to the quality management system requirements established by the organization, and
b) is effectively implemented and maintained.
An audit program shall be planned, taking into consideration the status and importance of the processes and areas to be audited, as well as the results of previous audits."
So at least clause 8.2.2 does not explicitly require process auditing. However, this clause does require that we audit
"whether the QMS conforms to planned arrangements". Many of these planned arrangements are concerned with the management of the processes and the links between the processes as outlined in clauses 4.1 (a – f) and 8.2.3.
In order to audit whether the system conforms to planned arrangements and whether the QMS is effectively maintained, we need to audit the management of the processes and the effectiveness of the processes.
Let's start by looking at the management of processes.
Managing ProcessesA process can be described in several ways; procedures, work instructions and flowcharts. Many organizations have found turtle diagrams to be a very effective way to describe the management of their processes (see figure above).
All processes have inputs, a set of activities to produce the outputs of the process, shown in Steps 3-5 of the turtle diagram. The inputs and outputs can include both tangible raw materials and components and intangible information. The management of the process is shown in the boxes at the corners of the turtle:
Step 1 - Manpower/training/competence - for each process the manpower requirements including the necessary training, competence and evaluation of competence should be defined; and a process owner should be identified so that someone has clear responsibility for the process.
Step 2 - Infrastructure (machines, facilities) - the machines and facilities necessary for the process should be defined and managed, that is maintained and improved as needed; this also includes any software necessary for the process.
Step 6 - Control Methods - methods for controlling the process include:
Documentation -each process should have some minimal documentation, more important or difficult processes may require additional documentation. The documentation could include process flowcharts, procedures, work instructions and forms
Set-up approval – some processes are controlled by approving the set-up of the process to established operating conditions
Monitoring/inspection – some processes have instrumentation that monitors the process, others are monitored by in-process or product inspection activities
Action if the process drifts - the control should include actions if the process deviates from what is planned – these tend to be short term actions which the Standard refers to as corrections (in clause 8.2.3)
Step 7 - Metrics and reporting - the process should be monitored for its effectiveness and actions taken if the effectiveness is not adequate. This monitoring may be based on the control data collected in Step 6 which is evaluated over a longer period of time and used to determine if corrective or preventive action should be taken on the process to improve the process. These actions are not the process adjustments (corrections) in Step 6 but are actions taken to change the way the process is performed or controlled.
Some organizations supplement the turtle diagram with a process flowchart since the turtle does not show the sequence of steps that make up the process.
This management of the processes should provide the basis for our internal audit program.
Let's start with the planning of the audit program.
Audit program planningThe audit program should be planned and scheduled around the actual processes that make up the quality management system. We start with the processes that make up our quality management system and the interactions of these processes among each other. This information can come from your process map.
The first step is to list the processes on the matrix below; we have found this matrix to be helpful in identifying which ISO 9001 requirements apply to which process. The second part of the audit program planning is to define the audit schedule. The important points to consider in defining the schedule are to make sure that
- Entire quality management system is audited
- Important processes are audited more frequently that less important processes Processes with key linkages are audited by the same audit team
- Processes with key linkages are audited back-to-back so that the linkages can be audited
Next let's discuss the auditing of the processes.
Auditing processesDo your auditors use the same checklist each audit?
Is the checklist based on the clause requirements in ISO 9001:2000? Do your auditors ask the same questions and look at the same things every time they audit?
If your answers are yes, then consider refocusing the auditors on the process and most importantly on the performance of the process.
The turtle diagram can help. We have found the turtle diagram a useful tool for auditing a process.
The auditor starts with Step 1 and interviews the process owner to obtain a description of the process and discuss the resources necessary (Step 2). Then various participants in the process are interviewed to audit the inputs, activities and outputs of the process (Steps 3, 4 and 5). The control of the process (Step 6) is also audited with the process participants and the process owner. During these interviews the auditor should focus on the data from the process and explore any instances when the data does not appear to meet the needs of the next process in-line or the needs of the customer.
Finally the performance of the process is reviewed with the process owner. Questions such as,
- Have objectives for the process been established? What performance is expected?
- How is the process performing at achieving those objectives? Review the data.
- Are actions being taken to assure that the process achieves objectives?
- What improvements to the process are necessary?
- How are these improvements being implemented?