"Risk Based" Internal Auditing - a discussion...

In preparing for some work, next year, I wanted to run a couple of thoughts by our learned friends for feedback on this subject. In considering the topic, there seems to me to be 2 distinct types of what we might call "risk based (internal) audits":

a) where the audits are planned (strategic) to take a look at some aspect of the management system which management need assurance is under control during some circumstances they consider to be an "opportunity" and also a "risk" - the purpose of the audit being to confirm the controls are in place and functioning as planned, and

b) where an internal auditor "stumbles" over something (tactical) during their audit, such as an out of control condition on a process parameter but no non-conforming product (apparently) resulted (for example) however the condition was only recorded etc. The auditor could pursue discussion about the potential for further processing, results etc reaching the customer (latent defects).

Anyone care to comment?

 

Both can be risk based. I am writing a paper on risk-based auditing but have not made much progress lately...

ISO standards have always inferred risk when telling us to plan audits based on status and importance. Status can mean major changes, a new design, recent employee turnover, previous performance in assessments, etc. This is known risk. Top management could be asked if there is anything they would like us to look at. Sometimes they value an outsider's opinion more than an insider's, and sometimes they just want our analytical skills.

Unknown risk is when we stumble on something and follow an audit trail to arrive at the appropriate element for issuing a nonconformity, or not if the client can show it is a non-issue. This happens to me a lot. I always advocate to "follow your nose" as our view from the unfamiliar, or just "inspector's luck" can help notice something that insiders have just grown used to seeing, or do not realize is an issue.

 

I once had a client who defined "Preventive action" as anything they found internally so I didn't.

 

Just as a quick side note - this is an example of why there really needs to be some type of accredited, professional development/qualification for people who design/implement management systems, not just for auditors.

 

Ah yes. Accreditation would be a good thing, but I've been falsely taught in an accredited class (the phantom requirement to use the core manuals for TS 16949 registration). They didn't put that on the exams though.

 

The ASQ Certified Auditor is pretty good, but once getting the card people can still do what they like.

 

Perhaps you'd give us some background as to why...

 

Understanding the context of the organization becomes the starting point of the risk based internal auditing. In fact it dictates the way your QMS is set up and is moving further. The next area is the changes faced by the organization, includes changes in the context, as well as internal changes.
Processes directly confronting the changes begins to direct changes within the organization. An internal auditor therefore must be so well trained to identify this chain of process interaction and probe its effectiveness. To identify and schedule such internal audits timely is now the part of the leadership initiative. When the leadership do not understand this and further the executive managers get no authority for conducting such checks and balances, the mundane 6 monthly internal auditing of the typical "Say what you do >>> Do what you say" will be done and paper records (rubbish) will be generated. Perhaps what is missing here is the authoritative MR which the new standard does not state as a requirement. Some of the well established QMS who migrate to the new revision will understand and shift the approach towards risk based internal auditing. The others will see no change and do no change. The new breed who take up the new standard afresh must be inducted into such internal auditing and get into the top down approach to internal auditing process...

 

I was hoping to keep away from any references to or about CB auditors. The biggest value for internal audits has little/nothing to do with CB audits. How does an experienced (internal) auditor relate to risk based audits, in your experience?

 

This would be a good practice, in my view. Too often, action requests are written without clarity as to why they matter - what is the value? In the past we have simply pointed to a clause in the standard ("It matters because the standard requires it") but it makes sense to take the trouble to explain the risk the auditor recognizes. The process owner might not have recognized the risk - there is a lot of confusion out there - or might not know that thing is happening. This has been easier with environmental: "See that jug of propylene glycol sitting right next to the floor drain? If that jug was to get kicked over and the stuff go into the drain, would that be bad?" With quality we refer to customer needs or requirements. It seems fitting to include it in a write up.

 

Could you give us an example of how this "justification of risk" was communicated/explained? I can see people reporting "We'll lose our certification" as a risk...