Need help with small team structure

Welcome ISO9001TD! Yours is a very real question and one with which many, if not all, people struggle - and there is ZERO training available for such an issue: How to Manage an Internal Audit Program. Until the time arrives when that is fixed, here are some things to consider:

Why is your staff (ONLY?) engaged in doing (internal) audits?
Why don't the plant location's management take care/host the DCMA/DCAA auditors?
Why separate CMMI from the ISO 9001/AS9100 audits - don't they share commonality?

I'd be concerned that any organization is looking to just one function - yours - to shoulder the audit burden. It's unwise and tells me a lot about where your leaderships' collective head is regarding the QMS etc.

 

Good questions! Firstly, some organizations - usually very large (multiple sites, significant headcount, complex organizations) do have dedicated people taking care of the regulated side of life. I'm thinking primes, here.

Not only is it feasible but it's also common practice to have a variety of functions offer up their people to be trained and then perform audits. I cannot conceive of running an Internal Audit program without doing this. Not just factory-floor people, but a mix of functions - sales, purchasing, material control, maintenance, lab etc and also supervisors and other levels of management. Most of all, your leadership team need to participate and understand the benefits of an internal audit program. Once that happens and they are seen to actively participate, then everyone takes it seriously.

Of course, to get management support, you have to set up the audit program to a) not emulate the CB process and b) to focus on those issues of business performance which are a concern to the leadership team. The audit is there to reveal if the process is causing the issue.

An effective audit team may only need one, competent person to do audits. The audit program - one or most likely, multiple, audits - will require someone to manage. Doing the audits isn't usually a big deal. Deciding what to audit, when etc is a much bigger - and dare I say challenging - task. It's a case of looking at what needs to be audited - processes, functions, timing, technologies etc and then deciding who you have who could handle that. Chunking down to a specific scope and deciding what the audit criteria are is also part of that.

I point these things out because, typically, internal audit programs default to a parody of what the CB auditors do. Internal audits are often done, once a year by a team of 2, 3 or 4 auditors, covering the whole organization, using an ISO 9001 or AS9100D based checklist ("Has the organization defined it's interested parties?") and the auditor go around reading those questions, no-one knows what the heck is going on and the whole thing becomes a less than effective mess.

You must avoid this part.

 

What does the business performance data tell you (and your leadership team). Deploying staff in isolation of business considerations will win you no friends.