How different will be CB audits against ISO 9001:2015?

CB auditors will need to apply some imagination in order to recognize RBT as the client organization practices it, and resist the urge to see a documented procedure and/or FMEA for everything. I am happy to see SWOT in the guidance document.

The fact is, I have seen these principles in templates and training materials for Business Plan for many years. It isn't new. It is just finally accepted as a valid approach to organizational definition. If auditors can learn to use terms MBAs understand (like Business Plan) instead of the standard's terms, I think we will have more success and better efficiency in the audit process.

I agree this will be critically needed by internal auditors, it really "ups their game" so to speak.

 

They do Sidney - often because they have no expectations (read experience) of doing them any differently! We all went to Lead Auditor course and drank the CoolAid. Sadly, until the training oversight grasp that there's fundamental differences and only superficial likenesses, things won't change, as you correctly state.

 

Regarding competence of internal auditors: I am not sure how I would write that up based on a review of documents. I can certainly question why they have not seen the things I do, and often do. I save that process for the last day in order to give myself the ability to objectively compare/contrast the results from their 1st party audits and my 3rd party audit. Have you written nonconformances on internal auditor competency? If so, what evidence did you list?

 

Oh, okay. I haven't had the opportunity to interview many internal auditors. I have, however noticed very little nuance in internal audit procedures. Most don't define the difference between NCs and OFIs with adequate clarity for me to decide it was a problem of competency. Internal auditors almost always have to witness and/or demonstrate before being sent out on their own, but competency is determined by the process owner (usually the Quality/Safety/Environmental Manager) who themselves often fall short of competencies I'd like to see. In addition, there are cases where the reports do not get a review by the Manager for the purpose of approving/agreeing with the findings.

To put it more simply, I find it's weakness in process more often than auditor competency.

 

Tough to do, if they only do one or two internal audits a year...

 

I'd suggest it's nothing to do with auditor competency. It's all to do with a grading system being installed when it's totally inappropriate to do so! Also, competency is often defined by passing some class or similar. If internal audits are only done by people who are from another department, once or twice a year, they'll never learn to be competent and then they'll be ambushed by a grading system which is nothing to do with internal audits...

 

Is there a problem with having a grading system such as major, minor and OFI? (I wouldn't have called it a grading system, but I've always recognized that not all issues are of the same severity or urgency.)

I'm on board with your views of the part-time collateral duty auditor. Their poor performance could be incompetence, lack of practice, poor instructions and/or poor training, or time constraints. This is why my last corporate employer did away with the model and hired me to audit internally full time. The decision (and, I would like to think their hiring choice) worked out well. We had major/minor/OFI and that worked out well too. It was also clearly defined. My paper on Risk Based Auditing came from that.

 

Yes, there is Jennifer. I'd suggest that it has absolutely no place in internal audits for multiple reasons, not least of which is that giving a non-conformity a "grade" feeds a game in many peoples' minds to mitigate the message of "big" problems. There are (many) other reason NOT to give a grade.

I'd also suggest that your example is a significant outlier. They got lucky. You are the process owner and they look to you to guide them in all things audit. You work the system and they accept it. I doubt it would work for (very many) others.

 

I feel like I just got complimented - if that is the case, thank you - but I would like to think I am not so special that other organizations can't also raise their game and stop viewing all issues in yes/no terms. It would require more status for the internal audit program than we're used to seeing, but I sometimes do see it in my clients.

I suggest the same rules we adhere to as CB auditors can apply for "elevating" a NC to Major: direct repeats and immediate threats to customer receiving good product/personnel safety/environmental integrity can and should be recognized. Without this or another appropriate approach, how should the internal audit process demonstrate RBT for ISO 9001:2015?

I'd like to add that I was not the process owner. I had a boss with whom audit results were reviewed, and sometimes edited before issuing. I left the organization a couple of years after this boss retired and was replaced by (instead of me) someone with zero education and experience in QA.

 

You were, Jennifer! So, a couple of things occur to me: YOU were the process owner. You boss wasn't. The fact that they edited stuff also concerns me, too.

To answer your question about RBT, firstly, it was already in the requirements, carefully disguised as "status and importance" and was, firstly and foremostly a scheduling issue. This is where the vast majority of internal audit programmes fall flat on their faces. It's actually only in small part, due to the finding and reporting of internal audits, using risk as a consideration. I know I probably turn your world upside down, but risk and internal auditing starts not with a calendar or audits over a year, (what I refer to in my book as a "push" system, but by sitting down with management and looking at their viewpoint on risks and then doing a "rifleshot" audit of the process(es) etc which are related. This is a "pull" system of audit planning.

 

Training in a standard doesn't a) make people competent or b) make them better auditors. If they've got "soft" (whatever THAT is) findings, then you have to diagnose why. A new standard isn't going to make any difference to those internal auditors.

 

Thank you.

I'm with you on the scheduling thing, which is something hardly anyone has been grasping. I had a client recently whose audits were being done by corporate on what has now become a once-in-three-year visit. It didn't take long to confirm that wasn't enough... I do have some clients that work hard at internal audit program effectiveness. Not enough though - I think that largely comes down to upper management support for the function.

But should outcomes really be black and white only? What about repeats? When finding a repeat our process response was to call it a Major and elevate is ownership to the next higher management level. Is that not a worthwhile approach?

I should add that NC owners didn't do any editing, but my boss and I would caucus on audit results and make minor changes at times. Yes I had near complete autonomy but also his backing as he knew what was going on through our meetings.