Process Auditing

Why do people think that this is

something new?

Presented by
Kevin Gilson, Orion Registrar, Inc.

For the ASQ ISO Users Group

October 8, 2008
So where in ISO is Process?

 Clause 0.2
 This International Standard promotes the adoption
of a process approach when developing,
implementing and improving the effectiveness of a
quality management system…. [ISO 9001:2000
page v]

Orion Registrar, Inc. 2

Why are internal audits conducted?

 Obtain factual input for management decisions?

---or---
 Produce data needed to receive certification?
 Improve documentation?
 Enforce conformity?

Orion Registrar, Inc. 3

The Old-Fashioned Way of Auditing

 Quality audits focused on procedures and not on

quality
 Auditors did not examine costs
 “Quality” was how well an outcome met the needs
of those for whom it was provided
 Good quality = satisfied the needs
 Bad quality = failed to meet the needs

Orion Registrar, Inc. 4

The Old-Fashioned Way of Auditing

 Companies ignored outcomes and customer

satisfaction when auditing
 Auditors were looking to “check the box” leaving
performance ignored and unchallenged
 Conformity auditing looking to establish if specific
requirement had been met
 Requirement may have focused on a task, not
performance result or output

Orion Registrar, Inc. 5

Document Review and Approval

 Auditor looked to see if documents had been

reviewed and approved by authorized person
 Did Auditor look for:
 Competency of approver?
 Why change was made?
 Did change improve performance?

Orion Registrar, Inc. 6

More Effective Methodology Needed

 Focuses on performance, not just conformity

 Management needs to know:
 Does performance meet targets?
 Are there opportunities for improving performance?
 Are there processes that do not support the workers?

Orion Registrar, Inc. 7

As an Auditor…

 If I invent your process then I am auditing my

version of your company… and that version
may NOT exist.
 Conflict of Interest!!!

Orion Registrar, Inc. 8

Process Approach to
Internal Auditing

Orion Registrar, Inc. 9

Process Input-Output Model

Orion Registrar, Inc. 10

Performance Process

Orion Registrar, Inc. 11

Performance Process Audit Plan

Orion Registrar, Inc. 12

What does you Quality Manual look
like?
 1. Introduction
 2. Scope and Exclusions
 3. Definitions and Acronyms
 4. Quality Management System Requirements
 5. Management Responsibility
 6. Human Resources
 7. Product Realization
 8. Measurement, Analysis and Improvement
 Appendix -- process maps or outlines

Orion Registrar, Inc. 13

Process Approach to Audit Plans

 Based on processes that achieve organization’s

objectives
 Requires auditor to know what the processes are
prior to conducting audit
 ISO/IEC 17021 (Stage 1 and Stage 2)
 Code of Practice for Registrars

Orion Registrar, Inc. 14

Process Approach to Audit Plans

 Common processes, for example:

 Business management
 Marketing and sales
 Resource management
 Purchasing
 Product / service realization processes are different
for each organization
 Plan shows audit trail through business processes
and across department boundaries
Orion Registrar, Inc. 15
Process Approach to Checklists

 Does not require detailed checklist

 Auditor can be guided by their understanding of
the Standard

Orion Registrar, Inc. 16

Process Audit Worksheet # Verify exclusions (if applicable)
Company : Location : Date:
Process: Standard Clauses: Auditor Name:

Documents Reviewed Audit Notes (addÕlpages as required) Personnel Interviewed (incl. Qualifications)

Inputs and Linkages from Other Processes Outputs (incl. Records Generated)

Evid ence of Measurements Related to Strategic or Resource Requirements (incl. Equipment

Process Objectives (as applicabl e) Requiring Mai ntenance and/or Cali bration)

Orion Registrar, Inc. 17

Customer and/or Regulatory Requirements No nconforming Product Control (incl.
Corrective Actions)

Strengths Opportunities for Improv ement

Maj or Nonconformities Min or Nonconformities

Orion Registrar, Inc. 18

Process Approach to Audit

 Start with top management and business

management processes
 Continue with resource management processes,
establishing linkages
 Effective resource management processes will provide
competent employees and capable equipment to other
processes
 Continue with other processes from marketing to
delivery

Orion Registrar, Inc. 19

Value of the Process Approach

 Focuses on results, not procedures

 Determines effectiveness of the management system
 Evaluates the results the system delivers
 Tests linkages between departments and processes
 Follows flow of work throughout organization
 Determines if operations are under control and controls are
effective
 Allows judgment on significance of findings
 Helps determine depth of problems across organization
 Focuses on benefits of correcting nonconformities related
to improving organizational effectiveness

Orion Registrar, Inc. 20

The Process Approach requires a
change in attitude across the
organization!

Orion Registrar, Inc. 21

What the Process Auditing Approach
Provides
 Process Auditing provides:
 Data for managerial decisions on growth, technology,
staff development, products / processes based on
current performance, not just current conformity
 Information on whether performance meets targets
 Information on opportunities for improving
performance through better control of processes
 Information on making processes more effective and
more efficient

Orion Registrar, Inc. 22

Five Basic Questions

 Basic questions can apply even though the “specific

questions” will be different:
 What are you trying to do?
 How do you make it happen?
 How do you know you are doing it right?
 How do you know it’s the best way of doing it?
 How do you know it’s the right thing to do?

Orion Registrar, Inc. 23

Five Basic Questions at Three Levels

 Business Level – Audit results should make the

auditor confident that the organization:
 Knows what it is trying to do
 Knows how to make it happen
 Knows that it is doing the right things
 Knows that it is doing it in the best possible way
 Is managing performance

Orion Registrar, Inc. 24

Five Basic Questions at Three Levels

 Managerial Level – Audit results should make the

auditor confident that management:
 Knows what the process aims to achieve
 Knows how to design and cause processes to achieve
results
 Knows that it is doing the right things
 Knows that it is doing it in the best possible way
 Is regulating performance

Orion Registrar, Inc. 25

Five Basic Questions at Three Levels

 Operational Level – Audit results should make the

auditor confident that individuals:
 Know what they are supposed to do
 Know they are doing the right things
 Know they are doing them in the best possible way
 Are regulating their own performance

Orion Registrar, Inc. 26

Summary

 Internal auditing using process approach

 Can take internal audit team from mission statement to
employee contributions
 Identifies clear linkages between interconnected
processes
 Ensures requirements of the Standard fit with processes
 Eliminates weaknesses of other approaches
 Enables internal audit team to establish that the
organization is managing processes effectively

Orion Registrar, Inc. 27

Orion Registrar, Inc.
7850 Vance Dr., Ste. 210
Arvada, CO 80003
303-456-6010
www.orion4value.com
Westminster, MD
410-857-1748
kgilson@orion4value.com
410-884-9165
Orion Registrar, Inc. 28