1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice
You must be a registered member in order to post messages and view/download attached files in this forum.
Click here to register.

Newbie Audit schedule & cross reference

Discussion in 'ISO 9001:2015 - Quality Management Systems' started by mike whittingham, Jan 9, 2020.

  1. mike whittingham

    mike whittingham Member

    Joined:
    Jan 9, 2020
    Messages:
    11
    Likes Received:
    3
    Trophy Points:
    2
    Hi everyone I am new to this forum and have looked around and found that you folks are very helpful with some very good advice and information. My name is mike and I am from the United Kingdom, I am new to the ISO 9001:2015 standard. I have been involved in this for a year now and have now been given the responsibility to look after the standard within the business. I am familiar with all my business processes that have been set but now I need to start auditing to fulfil the requirements of the standard. I have completed my internal auditor training but I can get my head around how I structure an audit schedule and cross reference them to the clauses of the standard and if I should be auditing all the sub clauses as well. Any advise on this or any audit schedule templates would be very much appreciated.

    P.S We are a paper and board converter and have 28 processes and 14 procedures listed.

    Thanks Mike
     
  2. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Hi Mike and welcome! I'm an ex-pat Brit and have felt the pain of this situation many times. I'm not sure where you got your auditor training, but from what you've written, you didn't get effective guidance on this topic, if you are still grappling with it! In most cases, internal auditor training a) doesn't deal with this (important) topics at all (it's simply basic auditor skills) or b) if it is mentioned, it's often inaccurate and based on hearsay/innuendo/oldwivestales.

    Added in edit: One thing you have to have to kick off with is a good grasp of why internal audits are in the ISO 900 requirements. Don't let the "oh you have to do them if you want to be/keep certified" brigade muddy the waters. You can use ISO without being certified. What do you understand as being the PRIMARY purpose of audits?

    OK, while you muse over that, let's take a look at the requirements in the standard regarding the word "schedule"... SHOCK! HORROR! It's not in there! :eek: Yes, it mentions "planned intervals" but that doesn't mean a schedule. It also talks about an audit programme (one or more audits) and the "frequency". Again, that's NOT the same as a schedule. Is it typical that people put together a calendar of audits? Yes! Is it typical that CB auditors ask for such a thing? Yes! Are they usually satisfied that things are "on schedule"? Yes! Is that what is required HECK NO!:confused:

    All of this isn't answering the question, so here's what I do/suggest:

    Consider the parts of 9.2.2 which talk about the audit programme being based on the importance of processes, changes affecting the org and previous audit results. Rarely is the first part considered. What makes a process "important"? Ask management! Important means it's not working, or it's new or it's changed - all things which make them lose sleep at night (or should). Changes? New products? New customers? New people? New technology? New Equipment? When do these things happen? Does it align with some kind of calendar (exactly) HECK NO!

    I'd suggest using a 30 day "window" of planning which looks at new/important/changed things which are happening in the next 30 days and schedule audits (with management's input/agreement) to look at those. Or look back over the past 30 days and see if there was anything which didn't go to plan. As you do audits you'll also see signs of other things which need attention and can be used to schedule the "next" audit.

    BTW - don't be auditing "clauses" of the standard. If you got THAT from your training, demand your money back! The training should have explained that PROCESSES are what should be audited.

    If you use this "30-day sliding window" approach, then you won't look stupid, issuing a calendar/schedule and then keep updating it (the new chap can't make up his mind!) AND, more importantly, management will see benefit from your audits! And they are YOUR customer!
     
  3. Golfman25

    Golfman25 Well-Known Member

    Joined:
    Nov 6, 2015
    Messages:
    816
    Likes Received:
    402
    Trophy Points:
    62
    Since you asked about cross references to the standard, my suggestion is create a table with each clause and then identify where in your system you address that clause. In many cases, you'll find the clause addressed in more than one process. You can then use that table to identify the clauses you deem applicable to the process your auditing. It's a lot of work, but once complete it is a great tool. We go one step further and use a "turtle" diagram on each process which lists the applicable clauses, procedures, forms, etc. All my auditors really have to do is pull that diagram and work from there. Good luck.
     
    Jennifer Kirley likes this.
  4. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    I'm unclear as to why you'd do this. I certainly wouldn't be spending too much time and effort on such a thing. If your QMS is effectively in compliance with ISO 9001:2015 requirements, then if you find a non-conformity with your own QMS, it's not a huge leap of faith to relate that to a relevant ISO 9001 clause. People go too far making this a bigger deal than it really needs to be. Plus, who really cares? Not your management. You might want to be able to relate it to an ISO clause (for management review) and your (hapless) CB auditor might get excited and think they have a non-conformity, but otherwise, save your energy for focusing on the big(ger) fish which make/save money and keep the customer happy.
     
    John C. Abnet likes this.
  5. mike whittingham

    mike whittingham Member

    Joined:
    Jan 9, 2020
    Messages:
    11
    Likes Received:
    3
    Trophy Points:
    2
    First of all thank Andy/Golfman for your time and assistance its very much appreciated. I do understand that i will not be auditing the clauses i will be tackling the processes. I was involved in last years audit which we was successful only being given x2 OFI's. As a business we are trade only and dont deal with the end user so we have a consistant chain of customers and suppliers that being said does not bring about very much change in products or customers. I am not standing by and thinking that everything is fab here and not wet behind the ears enough to think that why change anything that is not broken but i think getting to grips with the auditing can highlight areas for improvement or even change to push the business forward. I like the 30 day sliding window idea so will look at that first and see how this goes but as Golfman states i need to learn where the processes meet the clauses.
     
    Andy Nichols and John C. Abnet like this.
  6. John C. Abnet

    John C. Abnet Well-Known Member

    Joined:
    May 23, 2017
    Messages:
    709
    Likes Received:
    510
    Trophy Points:
    92
    Location:
    Upper Midwest- USA
    As always @mike whittingham , @Andy Nichols and @Golfman25 have provided good and wise council.

    I understand how a visualized schedule with "cross reference" can assist...especially in an organization where you may be training/assigning new internal auditors, etc..etc...
    IF you decide to create a schedule (ensuring it is adjusted as described by @Andy Nichols ), consider a simple matrix listing the organization's processes across the top "X" axis.
    Then, down the vertical "Y" axis, you can list all of the individual clauses. Audits can then be (must be) planned according to the processes, but this will allow you to simply place a check mark (below/within the process) in all of the clauses that are touched on in the audit plan. I have some examples I can share if interested.

    Hope this helps.
    Be well.
     
  7. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    One thing that does "fit" a 12 month calendar that CAN be treated this way is your CB audit visit. You could schedule an internal audit to cover what the CB auditor will look at a month before they arrive. Their audits are a bit like some events during the year which don't move. Christmas for example. Some business are subject to seasonal variations, due to holiday schedules etc. but for the most part, everything else doesn't work to such a rigid time-frame.
     
    Last edited: Jan 9, 2020
  8. mike whittingham

    mike whittingham Member

    Joined:
    Jan 9, 2020
    Messages:
    11
    Likes Received:
    3
    Trophy Points:
    2
    Thank you for the additional good and wise council John C another way of auditing I would consider and any examples would be appreciated. CB auditors in the UK tend to like the annual schedule and I have 28 processes so it could be a lengthy audit process?? I also have inherited a BRC accreditation which also requires an audit of their standard clauses annually luckily many of the clauses run along side each other so can be cross reference but my head is a bit of a mash trying to work out the best way to tackle this!!. The most difficult thing I am finding is working out which clauses will meet each process but I will reap the benefits once this is done for future auditing.
     
  9. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    I see nothing has changed since I left Blighty in 1992! Funny how something which isn't an actual requirement has become their audit criteria. What are the UKAS auditors doing? Check your conversations, Mike. I have a gift for you!;)
     
    Last edited: Jan 9, 2020
  10. John C. Abnet

    John C. Abnet Well-Known Member

    Joined:
    May 23, 2017
    Messages:
    709
    Likes Received:
    510
    Trophy Points:
    92
    Location:
    Upper Midwest- USA
    Frankly it doesn't matter what the "...auditors...like...". The ISO 9001 standard says very little in regards to specificity for HOW something is done. Instead it simply states what is to be accomplished. Attached is an example of an audit schedule that uses the example of making a pizza as its process steps.

    Hope this helps...be well.
     

    Attached File(s): 1. Scan for viruses before using. 2. Report any 'bad' files by reporting this post. 3. Use at your own Risk.:

  11. mike whittingham

    mike whittingham Member

    Joined:
    Jan 9, 2020
    Messages:
    11
    Likes Received:
    3
    Trophy Points:
    2
    Thanks for that John C. I understand the concept of the audit schedule and the example pizza making but i am trying to get my head around auditing the processes and then linking them to what clauses they have met due to the jargon used within these clauses. I have 28 processes that have been created by my predecessors and i wounder if some of these are necessary or could they be grouped into 1 process? I have attached my processes if you would not mind taking a look and passing your judgement.

    Mike
     

    Attached File(s): 1. Scan for viruses before using. 2. Report any 'bad' files by reporting this post. 3. Use at your own Risk.:

  12. Golfman25

    Golfman25 Well-Known Member

    Joined:
    Nov 6, 2015
    Messages:
    816
    Likes Received:
    402
    Trophy Points:
    62
    Yeah. It looks like you can combine some of those sub-processes into a larger process. For example, all the printing related process can be under one major process. Do you really need 3 processes for non-conforming issues? Etc.
     
  13. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Mike - I'll share what I promised - all will be revealed. Don't worry about it. It's not rocket science. I'll get you something to look at with your roast beef and yorkshires on Sunday
     
  14. mike whittingham

    mike whittingham Member

    Joined:
    Jan 9, 2020
    Messages:
    11
    Likes Received:
    3
    Trophy Points:
    2
    Thank you I will look at grouping some processes next week. Thanks Andy that will be brill you have not forgot the brit delight I see, yes had Sunday roast last week lol

    Mike
     
  15. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Your predecessors were confused. And they made things difficult for you (and them probably) as a result. I'd wager they did this in isolation of any of the management team who wouldn't have understood because they wouldn't have had an education as to what iso 9001 is about. You don't have 28 processes. You've got a mixture. You don't have 28 process owners. You might have 12 process, owned by 6 process owners or some combination. The point is, they should sort it out - not you!
     
    John C. Abnet likes this.
  16. mike whittingham

    mike whittingham Member

    Joined:
    Jan 9, 2020
    Messages:
    11
    Likes Received:
    3
    Trophy Points:
    2
    Wow Andy you certainly hit the nail on the head there! I have always thought that the processes didn't sit right with me and the process documents read more like a method of work and not a process? I will look at trying to break them down it to something more manageable and with a bit more experience might figure it out soon

    Mike
     
  17. Andy Nichols

    Andy Nichols Moderator Staff Member

    Joined:
    Jul 30, 2015
    Messages:
    5,086
    Likes Received:
    2,553
    Trophy Points:
    112
    Location:
    In the "Rust Belt"
    Get with your management team, the next time they meet and do a quick process mapping session (NOT a flow chart with all kinds of shaped boxes) - just take it from receipt of a customer RFQ/quote request, to shipping the finished packaged product. Capture the "big box" processes - RFQ>Order Entry>Design>Manufacture>Warehouse>Pack & Ship - or whatever actual sequence is. You should already have this, but my guess is it's a train wreck. Get your management team to describe it. If they can't, you'll have something to work on (and polish up your cv in the meantime):D

    Once you have the big boxes captured, it's be clearer what the "sub or secondary processes are and then just the activities within the processes. Also, whomever though that "non-conformance" needed 3 different documents is crazy. One process and some clever form design to capture information.
     
  18. mike whittingham

    mike whittingham Member

    Joined:
    Jan 9, 2020
    Messages:
    11
    Likes Received:
    3
    Trophy Points:
    2
    Andy you have broken this down a treat and as it is said knowledge sure is power :) I will get to work on this which will make a world of difference to the way I will now be tackling my audits this year (ISO, BRC, FSC) hopefully get the train back on the track.

    Thanks
    Mike
     
  19. mike whittingham

    mike whittingham Member

    Joined:
    Jan 9, 2020
    Messages:
    11
    Likes Received:
    3
    Trophy Points:
    2
    Hi Andy I have left the requested in conversation.

    Thanks
    Mike
     
  20. tony s

    tony s Well-Known Member

    Joined:
    Sep 10, 2015
    Messages:
    1,350
    Likes Received:
    1,054
    Trophy Points:
    112
    Location:
    Laguna Philippines
    Internal auditing should not be scheduled in reference with the applicable clauses. Many organizations do this because they want to demonstrate to a CB auditor that all clauses were covered for each cycle of audit. This is not a requirement. Even ISO/TS 9002:2016 (Guidelines for the application of ISO 9001:2015) mentioned this:

    "While the organization should always try to ensure that its quality management system complies with all the applicable requirements of ISO 9001, there is no requirement for every clause of ISO 9001, or process in the quality management system, to be evaluated during every audit".

    Schedule the audit of the processes base on the needs/expectations of the organization. Then audit the processes base on the needs/expectations from the processes. Aside from the organization's needs/expectations, clause 4.4 have given us the general guidelines on what to look for in a process. This will also helped an auditor to check specific requirements from the other clauses of the standard. For example, I will check first each process whether:
    1. the expected outputs are produced (4.4.1a);
    2. the established criteria and method are implemented (4.4.1c);
    3. the resources needed are available (4.4.1d);
    4. there are actions to address risks and opportunities (4.4.1f);
    5. there are documents to be maintained and retained (4.4.2)...
    If an organization would need to audit against the relevant clauses, I still make use of the general requirements of clause 4.4 as the basis for determining the other relevant clauses. Since 4.4. mentioned in its 1st paragraph this statement "in accordance with the requirements of this International Standard", I can further audit the numbered items above against the other clauses. For example:

    For item#1: check also 8.7 and those with specific requirements on outputs of a particular process e.g. 9.3.3;
    For item#2: check also those with specifics on criteria and method e.g. 8.1b, 8.1d, 8.4.1;
    For item#3: check also any applicable requirements in 7.1 and also 8.1c, 8.5.1d, etc.;
    For item#4: check also 6.1 and 8.1 ("implement the actions determined in clause 6");
    For item#5: check conformity with 7.5 and those with specifics on documented information e.g. 8.1e, 8.5.1a.​

    Many organizations and CB auditors believe that by having a matrix of processes vs clauses will satisfy the statements below:
    • "establish, implement, maintain and continually improve a quality management system, including the processes needed and their interactions, in accordance with the requirements of this International Standard" (4.4.1);
    • "conduct internal audits at planned intervals to provide information on whether the quality management system...conforms to...the requirements of this International Standard" (9.2.1a.2)
    But, if organizations know what are needed and expected from the processes and have understanding on the relevant clauses of the standard, satisfying the statements above can be adequately and more effectively demonstrated not by a matrix or schedule - but by the recorded results of the audit (i.e. audit reports) including the checklists/notes used by the internal auditors.
     
    Andy Nichols likes this.