QP-822 "Internal Audits" does not jive with "Internal Auditor Checklist"

Welcome to QFO, Steve, and congrats on your first post!

Let me get the obvious out of the way first...you should probably have some training on how to conduct an audit. This can be done in-house (especially if you have a seasoned auditor there) or externally (lots of courses out available and finding the "right" can be a bit of a task, but I'm sure you can receive plenty of suggestions on here! )

***

Problem 1: Auditing seems to be all about "areas". To me, an area is either Production, Management, Finance, Engineering, or Quality. Am I correct?? How many processes must be audited?

We can't really speak to your "areas" or "departments" because it can vary from company to company. And some organizations include non-traditional Quality Management System areas because they've developed a BUSINESS Management System. Still, you're on the right track in terms of "area".

That said, "process" is a bit different. Document Control is a process. Management Review is a process. Product Design is a process. What I typically for a management system is develop a matrix that shows all of our areas/departments along one axis and all of the processes along the other. Then I indicate if there is a Direct/Owner or Support/User link between each area and process.

For example, Production, as an area, is probably a User of Document Control...whereas the Quality area maybe the Owner of the Document Control process. This means Quality has defined the activities and controls within Document Control and Production, as a User, is audited to how well they conform to Document Control. In my experience, Production has their own document authors who are trained on ensuring their documents are properly maintained within the document control software that my organization uses and is responsible for coordinating the training on such documents.

Problem 2: When I attempt to audit a process, the questions in the Internal Audit Checklist don't seem to be a basis for auditing a process. What am I missing???

Without knowing what the questions look like on the checklist (sorry, I didn't look at your attachments), it may be difficult to say but using my example from above, let's try pretend we're auditing Document Control out in Production

Checklist Question 1 - Is there a document control process?
Production - How do they create their work instructions?

Checklist Question 2 - Are documents are made available to people?
Production - How do people know how to do their job? Are docs available to personnel via computer or hard copy? How do they know they're using the most relevant document?

Checklist Question 3 - Are records considered as documents?
Production - What kind of records with product information are generated? How are they maintained/safeguarded? Why does this matter?

***

Checklists are all well and good. They're a great starting point for an audit, however, part of successful audit is understanding what you should be seeing and how the checklist questions apply to the area you're going to audit. I refer to audits as "tea-time conversations". If I read off of the checklist, it would annoy me and confuse the person to whom I was asking questions. Consider how the questions can be reworded into normal, every day language that your organization will understand (presuming the questions are simply a repeat of the standard).

 

Steve: Welcome and I feel your pain. Have you had any practical training in auditing? If you mean you're trying to figure out what to do from reading the attachments, I'd suggest (as my colleague Roxane does) that you stop and instead find some hands on training. Such templates rely heavily on you having understanding (or not) and, in fact, the checklist is simply the ISO 9001 requirements turned into questions and, as such are merely one way to do audits (and not really what internal audits are about, which is your OWN QMS).

To answer your question DIRECTLY, the "scope" and/or criteria of the audit can be:

• a process
• an area
• a project
• a contract
• a regulation (if applicable)
• an ISO requirement (especially if new)
• a procedure/instruction
• or any combination of the above

It depends on what management consider to be important...

Bottom line - get some training in a class with a real, experienced instructor who knows the difference(s) between internal audits and CB audits and knows how to do real internal audits.

 

Sadly that's a practical impossibility. Most worthwhile courses are 18 - 24 hours in duration.

Exactly!

Are you located in the USA?

 

In essence, Steve, to do a process audit you take a look at:

• The plan for the process (for a manufacturing process, the quantity of product to be produced that shift, day, week etc)
• The inputs to the process
• The controls for the process
• The product and process measurement - and/or monitoring carried out
• The output of the process, then compared to the plan.
• The way non-conforming product is handled
• And so on...

For a bit of reading, try here: https://www.nqa.com/en-us/resources...-implementing-iso-9001-step-5-internal-audits

and here: https://www.nqa.com/en-us/resources...01-2015-using-your-qms-part-5-internal-audits

and I had also written an article on doing process audits but can't find it on the NQA blog (my last employer). If I can find the original I'll post it to my personal blog.

Since you are in AL, why not try the AL MEP (I'm with the Michigan MEP) and try their training: http://www.atn.org/OurServices.aspx?sid=6