Internal Auditor Training ISO

Transcription

1 Internal Auditor Training ISO

2 2002. This training material is reserved for use by Prism esolutions, LLC and its customers. This material may not be copied, transmitted, or otherwise used without the explicit permission of Prism esolutions, LLC. In order to obtain copies of this material or permission to use this material outside of the environment it was distributed to you in, please contact Prism esolutions, LLC at 700 American Avenue, Suite 104, King of Prussia, PA or via the web at or via phone at (610) PN revision 3.0 Page 2

3 TABLE OF CONTENTS This page intentionally left blank.section 1: Introduction to Internal Auditing... 4 Section 1: Introduction to Internal Auditing... 5 Introduction Exercise... 5 Student Evaluation Criteria... 6 Audit Exercise Section 2: ISO Standard Requirements Open Book Quiz - Sections 4, 5 & Open Book Quiz - Section Open Book Quiz Section Procedures and Records Exercise Clause Identification Exercise Section 3: Phases of Internal Auditing Develop an Audit Matrix Exercise Identification of Nonconformities Exercise Section 4: Appendices Ten Commandments of Internal Auditing Sample Audit Checklist Page 3

4 This page intentionally left blank. Page 4

5 Section 1: Introduction to Internal Auditing Introduction Exercise Name: Years with your organization: Description of job responsibilities: Class expectations: Key question you want answered: Where would you rather be? Page 5

6 Student Evaluation Criteria Contribution to course discussions Attitude toward material Clarity of written assignments Verbal / presentation skills Team participation Student Evaluation Criteria Contribution to course discussions Positive Indicators + Effectively able to conduct an audit interview + Willingness to ask questions + Willingness to contribute personal experience + Responding to questions + Listening Negative Indicators - Dominate discussions or group activities - Unable to effectively conduct an audit interview - Lack of involvement or interest - Not responding to questions - Distracting the class Page 6

7 Attitude toward material Positive Indicators + Probing questions + Positive attitude toward material Negative indicators - Cynical attitude - Inappropriate questions Clarity of written assignments Positive Indicators + Clear, concise points + Understandable + Legible Negative Indicators - Unclear Verbal / Presentation skills Positive Indicators + Clear voice + Correct language Negative Indicators - Unclear Team participation Positive Indicators + Work as part of the team + Cooperate and contribute Negative Indicators - Monopolizes the group - No participation in the group Page 7

8 Course Purpose & Objectives Purpose: To provide you with theory and practical experience to become an effective quality management system auditor Process: Class interaction, exercises, discussion, participant presentations, student evaluation, and when all else fails, lecture Objectives: Provide participants with a basic understanding of the quality management system auditing requirements as well as the tools and techniques used in auditing NOTES: Page 8

9 Terminology and Definitions Quality System The organizational structure, procedures, processes, and resources needed to implement the quality management system (includes all departments, documents, & the entire standard) Quality Policy The overall intentions and direction of an organization with regard to quality as formally expressed by top management Terminology and Definitions Quality Management All activities of overall management used to determine the quality policy, objectives, responsibilities, and processes of the QMS and to ensure adequate implementation and maintenance (includes internal auditors) Quality Manual A formal and authorized document setting out the quality policies, systems, procedures, and practices of an organization; a bridge between the standard and the QMS Page 9

10 NOTES: Page 10

11 Terminology and Definitions Procedure or Process A specific way to perform an activity such that it achieves uniformly acceptable results Corrective Action Action taken to eliminate the causes of an existing nonconformity, defect, or other undesirable situation in order to prevent recurrence Certification The process by a duly authorized body of determining, verifying, and attesting in writing to the qualifications of a QMS in accordance with applicable requirements Quality Management System Documentation Page 11

12 NOTES: Page 12

13 ISO Hierarchy and Background What is ISO? The International Organization for Standardization ISO is a United Nations to create common sets of standards for trade and communication ANSI American National Standards Institute - represents the United States ANAB ANSI/ASQ National Accreditation Board administers ISO in the United States ISO Hierarchy and Background ISO 9000 Quality Management Systems Fundamentals & Vocabulary ISO 9001 Quality Management Systems Requirements ISO 9004 Quality Management Systems Guideline for Performance Improvements Page 13

14 NOTES: Page 14

15 ISO 9001 May Be Required Regulatory Requirements Regulations, laws, or agreements Industry standards (chemical, transportation, automotive, etc.) Product requirements (high pressure containers, scales, implantable medical devices, etc.) National or local regulations Customer Requirements Organizations may decide ISO certification will benefit them when purchasing from a certified supplier The practice has proven successful in dealing with suppliers Generally accepted practice within industry and country Time or distance make supplier visits an expensive option Quality Management System Definition ISO 8402 defines Internal Quality Auditing as: a systematic and independent examination to determine whether quality activities and related results comply with planned arrangements and whether these arrangements are implemented effectively and are suitable to achieve objectives. Page 15

16 NOTES: Page 16

17 Types of Quality Audits Quality Management System Process Product or Service Compliance registration and surveillance 1 st party internal 2 nd party internal or external 3 rd party external Quality Management System Audit Goals Verify documents address all requirements Manual, Procedures, Instructions, Records Verify activities are consistent with documents Verify process effectiveness Identify opportunities for improvement Provide value-added feedback to auditees Page 17

18 Audit Performance Relies on Objectivity Gathering information Read (applicable documents) Listen (ask questions) Observe (watch activities) Comparing information Objective evidence to known requirements Drawing conclusions Does a gap exist? Is there an inconsistency? Internal Auditor Training ISO NOTES: Page 18

19 Audit Exercise While performing an audit of the Management Review process, the auditor observed that in the meeting minutes of the most recent Management Review Meeting the VP of Operations did not attend while an Operations Director did. The procedure, which the auditor had reviewed during preparation, stated that required attendees included the VP of Operations. Further, all previous minutes of Management Review reviewed indicated she was in attendance. The auditor asked the quality system Management Representative, the Process Leader, if he was aware of the required attendees. The Management Representative responded correctly and explained that the VP was absent because she had another meeting to attend. He also informed the auditor that he had made out a deviation form to allow a substitute and showed the auditor where the deviation form was filed. 1. Can you identify the three methods used by the auditor to gather information? 2. Are the activities observed consistent with the documents? 3. Is the Management Representative in compliance with the documented quality management system? 4. Why did the auditor ask the Management Representative of his awareness of the procedure? Page 19

20 How to Implement an Internal Audit Program Internal Auditor Training ISO Understand internal audit requirements Write internal audit procedure(s) Select and train auditors Prepare and publish a schedule Conduct audits Track results and take action Report results to Management Review NOTES: Page 20

21 QMS General requirements QMS Document requirements Management commitment Customer focus Quality policy Planning Responsibility, authority & communication Management review Provision of resources Human resources Infrastructure Work environment Planning of product realization Customer-related processes Design & Development Purchasing Production and service provision Control of monitoring & measuring equipment Measurement, analysis & improvement - General Monitoring & measuring Control of nonconforming product Analysis of Data Improvement Internal Auditor Training ISO Audit Schedule Sample # January X X X X February X X X X March X X X X April X X X X May X X X X June X X X NOTES: Page 21

22 Audit Schedule Sample #2 Area JAN FEB MAR APR MAY JUN JUL AUG SEP OCT NOV DEC Sales Engineering Purchasing Production Servicing Shipping Material Control Quality Human Resources Team 1 Team 2 Team 3 Team 4 Team 5 Team 1 Team 2 Team 3 Team 4 NOTES: Page 22

23 Tracking Mechanism Audit # Audit Date Responsible Manager Response Due Follow-up Date Date Closed Jan. 5, 2009 J. Heely Feb. 12, 2009 April 1, 2009 April 7, Feb. 17, 2009 M. Ropsen April 6, 2009 May, 1, 2009 May 5, Mar. 11, 2009 P. Carrol May 1, 2009 July 1, April 20, 2009 J. Hassing June 6, 2009 NOTES: Page 23

24 Auditor Qualifications Common sense Understand ISO 9001 Understand your organization s quality management system Understand auditing tools and techniques Possess communication skills NOTES: Page 24

25 Auditor Characteristics/ Aptitudes/ Attributes The auditor must be able to work alone and in teams The auditor must gather information, often from people who are nervous The auditor will sometimes work in areas where they have little or no technical knowledge The auditor will have to manage time well Auditor Characteristics/ Aptitudes/ Attributes Auditors should be: Curious inquisitive observant Independent trained good listeners Unbiased impartial objective Perceptive focused analytical Thick skinned non threatening personable Honest professional highest integrity Page 25

26 Auditor Characteristics/ Aptitudes/ Attributes Internal Auditor Training ISO Auditors should not be: Argumentative Rash (jumping to conclusions) Opinionated Rigid Poor communicator Lazy NOTES: Page 26

27 Roles and Responsibilities Audit Administrator Coordinate/participate in internal audits Maintain audit schedule and track results Report findings to management review Auditor Be independent of the process(es) to be audited Prepare for assigned audits Perform objective internal audits in accordance with training and procedures Complete all required reports Roles and Responsibilities Lead Auditor The lead auditor is ultimately responsible for all phases of the audit Assist in selection of auditors Prepare audit plan Submit the audit report / share with auditee Audit Team The audit team may include experts, trainees, observers, etc. who are acceptable to the lead auditor Page 27

28 Roles and Responsibilities Others that may be included in an audit Observer Learner Witness Verifies audit activities Expert Specialized background Guide Escorts auditors, does not answer for auditee NOTES: Page 28

29 Auditor Techniques and Skills People skills Interviewing & listening Politeness please and thank you Maintain eye contact at auditee eye level Leadership skills You are a guest in their area Manage interruptions Special skills Talk to correct people Be objective NOTES: Page 29

30 An Overview of ISO 9001 ISO 9001 is written from the perspective of the customer Conformance to customer requirements and continual improvement are methods to ensure customer satisfaction NOTES: Page 30

31 What is a Quality Management System NOTES: Page 31

32 Triangle of Commitment MANAGEMENT REVIEWS Evaluate performance in relation to purpose (Quality Policy) CORRECTIVE & PREVENTIVE ACTIONS Prevent problems or fix problems if prevention didn t work INTERNAL AUDITS Monitor processes for compliance with requirements NOTES: Page 32

33 Section 2: ISO Standard Requirements Page 33

34 Classification of Elements Primary Elements Have clear, auditable requirements that must be met Typically addressed by a level 2 document (but not always) Classification of Elements Reference Elements Reinforce requirements that are more clearly and exactly specified in another Primary element Typically addressed only in the quality manual When addressed in a level 2 document, usually in the level 2 for the Primary element they reinforce Only one Reference Element adds a requirement, 4.2.1, documented statements Page 34

35 Classification of Elements To facilitate understanding and application of the ISO-9001:2008 standard, elements are classified into two general types: Reference (elements 4.1, 4.2.1, 5.1, 5.2, 5.4.2, 5.5.1, 5.5.3, 6.1, 8.1) Primary (elements 4.2.2, 4.2.3, 4.2.4, 5.3, 5.4.1, 5.5.2, 5.6, 6.2, 6.3, 6.4, 7 (all), 8.2, 8.3, 8.4, 8.5) NOTES: Page 35

36 4.2.2 Quality Manual (Primary Element) A Quality Manual shall be established and maintained that includes the following: a) The scope of the QMS including details of and justification for any exclusions b) Documented procedures or reference to them c) A description of the sequence and interaction of the processes included in the QMS NOTES: Page 36

37 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 37

38 4.2.3 Control of Documents (Primary Element) A documented procedure (#1) shall be established: a) To approve documents for adequacy prior to use b) To review, update as necessary and re-approve documents c) Identify the current revision status of documents d) Documents remain legible, readily identifiable and retrievable e) Relevant versions of documents are available at points of use f) Documents of external origin are identified and distribution is controlled g) To prevent the unintended use of obsolete documents and identified if they are retained for any purpose Procedure Required NOTES: Page 38

39 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 39

40 4.2.4 Control of Records (Primary Element) A documented procedure (#2) shall be established for identification, storage, retrieval, protection, retention and disposition of records Procedure Required NOTES: Page 40

41 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 41

42 5.3 Quality Policy (Primary Element) Appropriate to the purpose of the organization Commitment to meeting requirements and to continual improvement Provides a framework for establishing and reviewing quality objectives (i.e., the policy must be measurable) Communicated and understood at appropriate levels in the organization Is reviewed for continuing suitability Documented statements of quality policy and quality objectives (ref ) NOTES: Page 42

43 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 43

44 5.4.1 Quality Objectives (Primary Element) Establish quality objectives at relevant functions and levels within the organization Objectives must be measurable & consistent with quality policy & commitment to continual improvement Documented statements of quality policy and quality objectives (ref ) NOTES: Page 44

45 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 45

46 5.5.2 Management Representative (Primary Element) Member of the management who has responsibility for: a) Ensuring that processes of the QMS are established and maintained b) Reporting on performance of QMS including needs for improvement c) Promoting awareness of customer requirements throughout the organization The Management Representative must be a member of the organization NOTES: Page 46

47 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 47

48 5.6.1 Management Review (Primary Element) Review of the QMS by top management at planned intervals to: a) Ensure QMS suitability, adequacy & effectiveness b) Evaluate the need for changes to the QMS including policy & objectives c) Assess opportunities for improvement d) Retain records Records Required NOTES: Page 48

49 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 49

50 5.6.2 Review Input (Primary Element) Input to management review shall include: a) Results of audits b) Customer feedback c) Process performance and product/service conformance d) Status of preventive & corrective action e) Follow up actions from earlier reviews f) Changes affecting the QMS g) Recommendations for improvement NOTES: Page 50

51 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 51

52 5.6.3 Review Output (Primary Element) Output from management review shall include actions related to: a) Improvement of the effectiveness of the QMS and its processes b) Improvement of products/services related to customer requirements c) Resource needs NOTES: Page 52

53 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 53

54 6.2.1 Human Resources (General) Competence, Training & Awareness (Primary Elements) Those who have responsibilities defined in the QMS shall be competent on the basis of appropriate education, training, skills and experience Determine competency needs Provide required training Evaluate the effectiveness of the training provided Ensure staff are aware of the relevance and importance of their activities and contribution to achieving objectives Maintain appropriate records of education, training, qualifications and experience Records Required NOTES: Page 54

55 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 55

56 6.3 Infrastructure 6.4 Work Environment (Primary Elements) The organization shall identify, provide and maintain the infrastructure it needs to achieve the conformity of product and/or service, for example a) Workspace & associated facilities b) Equipment (hardware & software) c) Supporting services (transport, communications, information systems) The organization shall identify and manage the work environment needed to achieve conformity of product and/or service NOTES: Page 56

57 NOTES: Page 57

58 Open Book Quiz - Sections 4, 5 & 6 Statement: 1. Top management must meet periodically to review the adequacy of the QMS. Records of these meetings shall be maintained. 2. Where personnel perform work that affects conformity to requirements the required competence of those personnel is determined. 3. Wherever the term documented procedure appears in the standard, this means a written procedure must be created and maintained. Answer: 4. Computers and information systems must be adequately maintained. 5. When processes are outsourced these processes are controlled by the organization and the method of control is defined. 6. When documents that are created outside the organization are used in a way that affects products, these documents need to be controlled. 7. The environment in which personnel perform their work shall be conducive to product conformity. 8. The quality policy and quality objectives must be written down someplace. 9. The management representative must be selected from the organization s management staff. 10. Objective evidence that the quality system is implemented and effective is maintained such that it is easily identified and retrieved. Page 58

59 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 59

60 7.1 Planning of Product Realization (Primary Element) Determine quality objectives & requirements Determine the processes & documents, and provide resources needed Determine required verification, validation, monitoring, measuring, inspection & test activities for the product Determine records needed for evidence of meeting product requirements Records Required NOTES: Page 60

61 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 61

62 7.2.1 Determination of Product Requirements (Primary Element) Organization shall determine customer requirements including: a) Specified customer s requirement s for product and/or service including availability, delivery & support b) Requirements not specified by the customer but necessary for intended or specified use c) Regulatory and legal requirements d) Any additional requirements considered necessary by the organization NOTES: Page 62

63 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 63

64 7.2.2 Review of Requirements of Product (Primary Element) Review identified requirements and ensure before commitment to supply product and/or service that: a) Requirements are defined Records Required b) Differences between tender & contract are resolved c) Organization has ability to meet the requirements Confirm verbal orders Where the customer provides no documented requirements, requirements must be confirmed prior to acceptance of the order Documentation to be amended in case of changes & personnel made aware NOTES: Page 64

65 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 65

66 7.2.3 Customer Communication (Primary Element) Implement arrangements for communication with customers relating to: a) Product and/or service information b) Inquiry & order handling including amendments c) Customer feedback including customer complaints NOTES: Page 66

67 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 67

68 7.3 Design and Development (Primary Element) Design & development planning Design & development input Design & development output Design & development review Design & development verification Design & development validation Control of changes Records Required NOTES: Page 68

69 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 69

70 7.4 Purchasing Information (Primary Element) Records Required Purchasing Process Ensure purchased product conforms Supplier selection, evaluation & re-evaluation Purchasing information Describe the product purchased Verify specified purchase requirements Verification of purchased product Receiving/inspection activities NOTES: Page 70

71 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 71

72 7.5 Production and Service Provision (Primary Element) Production & service provision control Work instructions, equipment, measurement, etc Validation of processes Special Processes Identification & traceability Throughout product realization Monitoring & measuring status Records Required NOTES: Page 72

73 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 73

74 7.5 Production and Service Provision (Primary Element) Customer property Identify, verify, protect and safeguard Preservation of product Identification, handling, packaging, storage & protection NOTES: Page 74

75 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 75

76 7.6 Control of Monitoring & Measuring Equipment (MME) (Primary Element) Determine measurements to be made & MME required Use MME consistent with measurement requirements Measuring and monitoring software must be validated Calibrate and adjust MME at specified intervals or prior to use, (traceability to international or national standards; where no such standard exists, record the basis) Records Required NOTES: Page 76

77 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 77

78 7.6 Control of Monitoring & Measuring Equipment (MME) (Primary Element) Adjusted or readjusted as necessary Identified Safeguard from adjustments that would invalidate the measurement result Safeguard from damage Assess the validity of previous measuring results when equipment is found to be out of calibration NOTES: Page 78

79 NOTES: Page 79

80 Open Book Quiz - Section 7 Statement: 1. Suppliers of materials and services affecting product conformity must be evaluated and re-evaluated adequately to ensure conformance with the requirements specified on the purchase order. 2. Where product conformance cannot be verified by inspection, the relevant processes must be validated. 3. If the customer doesn t provide documented requirements the organization must confirm the requirements with the customer prior to accepting the order. 4. Design outputs must be verified against the design input and approved prior to release. 5. Materials are stored and preserved in a manner that prevents deterioration and assures conformity to requirements. 6. Where necessary, prior to accepting an order, the organization shall consider the documents, records, processes, etc. necessary to deliver the product to the customer. 7. Production personnel must have the information, work instructions, and process and product measuring equipment required to perform their jobs. 8. Customer property may include intellectual property such as proprietary designs. 9. Where test equipment incorporates computer software, this software is verified, as needed, prior to first use and re-verified as necessary. 10. The results of tests, such as product inspection, must be clearly identified throughout the organization. 11. Before quoting a job, the organization reviews all requirements and ensures it has the ability to deliver the product. Records of this review are maintained. 12. Where required to prevent mistakes, materials used to produce the product are clearly identified from the receiving dock to the shipping dock. Answer: Page 80

81 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 81

82 8.2.1 Customer Satisfaction (Primary Element) Organization shall monitor information on customer satisfaction and/or dissatisfaction as one of the measurements of performance of the QMS The methods for obtaining and utilizing such information shall be determined These methods may be both proactive and reactive NOTES: Page 82

83 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 83

84 8.2.2 Internal Audit (Primary Element) Conduct periodic internal audits to determine if the QMS conforms to the requirements of the standard & is effectively implemented and maintained Plan the audit program considering: Status & importance of the activity & results of previous audits Independence of the personnel performing the audit Impartiality and objectivity of the auditors The documented procedure (#3) must cover: Procedure Required Responsibilities & requirements for planning & conducting audits Recording results Reporting to management Records Required NOTES: Page 84

85 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 85

86 8.2.2 Internal Audit (Primary Element) Define audit scope, frequency & methodologies Timely corrections and/or corrective actions by management Follow up to verify & report implementation of corrective actions NOTES: Page 86

87 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 87

88 8.2.3 Monitoring and Measurement of Processes (Primary Element) Apply suitable methods for measurement & monitoring of processes necessary to meet customers requirements These shall confirm the continuing ability of each process to satisfy its intended purpose When planned results are not achieved, take appropriate correction and/or corrective action without undue delay NOTES: Page 88

89 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 89

90 8.2.4 Monitoring & Measurement of Product and/or Service (Primary Element) Measure & monitor product/service characteristics to verify that the requirements of product are met, this shall be carried out at appropriate stages of the product/service realization Evidence of conformance with the acceptance criteria to be documented. Records shall indicate the person(s) authorizing release of the product/service Product/service release shall not occur until all specified activities have been satisfactorily completed Records Required NOTES: Page 90

91 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 91

92 8.3 Control of Nonconforming Product (Primary Element) Procedure Required Documented procedure (#4) for control of nonconforming product/ and/or service to prevent unintended use Nonconforming product and/or service to be dispositioned Re-verify after correction If nonconformance detected after delivery take appropriate action Where required by customer or regulatory body, concession for use must be obtained Records Required NOTES: Page 92

93 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 93

94 8.4 Analysis of Data (Primary Element) Collect & analyze data to determine suitability and effectiveness of the QMS and to identify where improvements can be made Include data from measurement & monitoring & other relevant sources Analyze data to provide information on: a) Customer satisfaction and/or dissatisfaction b) Conformance to customer requirements c) Characteristics of processes, products and/or services and their trends d) Supplier performance NOTES: Page 94

95 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 95

96 8.5.1 Continual Improvement (Primary Element) The organization must plan and manage processes necessary for continual improvement of the QMS Facilitate continual improvement using: a) Quality policy b) Objectives c) Audit results d) Analysis of data e) Corrective actions f) Preventive actions g) Management review NOTES: Page 96

97 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 97

98 8.5.2 Corrective Action (Primary Element) Documented procedure (#5) for corrective action to eliminate the causes of nonconformance and prevent recurrence Procedure Required Actions appropriate to the impact of the problems encountered a) Identification of nonconformances including customer complaints b) Determine the cause of the nonconformity c) Evaluate the need for actions to ensure nonconformities do not recur d) Determining & implementing the corrective action needed e) Recording the results of actions taken f) Reviewing the effectiveness of corrective action taken Records Required NOTES: Page 98

99 Guidelist What do I look at? Who do I talk to? What do I look for? Where do I look for it? Page 99

100 8.5.3 Preventive Action (Primary Element) Documented procedure (#6) for preventive action to eliminate the causes of potential nonconformances to prevent occurrence Procedure Required Preventive action taken shall be appropriate to the impact of the potential problems a) Identification of potential nonconformances and their causes b) Determining and ensuring the implementation of preventive action needed c) Recording results of action taken d) Review the effectiveness of preventive action taken Records Required NOTES: Page 100

101 This page intentionally left blank. Page 101

102 Open Book Quiz Section 8 Statement: 1. Records of the product inspection process include the identity of the person or persons responsible for releasing the product for shipment to the customer. 2. Internal auditors are impartial and objective and do not audit their own areas of responsibility. 3. Where risks are identified that may cause the failure of a product or process, appropriate action is taken to eliminate or minimize the risk. 4. When processes are not achieving the intended objectives suitable corrections or corrective actions are implemented to remedy the issue. 5. Product that does not conform to customer requirements, and is reworked, must be reinspected to verify that customer requirements are met. Records of this reinspection must be maintained. 6. Nonconforming products and processes are utilized as sources for corrective actions. 7. No product is shipped to the customer until all planned inspections and tests are completed unless approved by appropriate management, and the customer where warranted. 8. Nonconforming material and product must be clearly identified as nonconforming to ensure it is not used by accident. 9. All deficiencies, identified by internal audit, are corrected either through the corrective action process or some other documented form of correction. 10. Supplier performance data is determined, collected and analyzed to evaluate qualification. 11. Methods such as customer surveys and warranty information are used to determine how the customer feels about the overall quality of the organization. 12. All appropriate resources are utilized to identify opportunities for continually improving both products and processes. 13. Records must be maintained that demonstrate that the product shipped to the customer meets all acceptance criteria. Answer: Page 102

103 4.1 General Requirements (Reference Element) Determine processes necessary for QMS (ref ) Determine the sequences and interaction of processes (ref ) Determine criteria & methods to ensure effective operation & control of these processes (ref , 8.4) Ensure availability of resources & information needed to effectively operate & monitor processes (ref. 6) Measure, monitor, analyze processes (ref , 8.4) Act as necessary to achieve planned results and continual improvement (ref. 7.1, 8.5.1) Control outsourced processes (ref. 7.4) Documentation Requirements (General) (Reference Element) Documented statements of quality policy and quality objectives (ref. 5.3, 5.4.1) A quality manual (ref ) Documented procedures and records required by the International Standard (ref , documented procedure, see ) Documents and records needed to ensure effective planning, operation and control of processes (ref. 7.1, 7.5.1) Page 103

104 NOTES: Page 104

105 5.1 Management Commitment 5.2 Customer Focus (Reference Elements) Shall provide evidence of commitment to the development and improvement of the QMS by: a) Communicating the importance of meeting customer and legal/regulatory requirements (ref ) b) Establishing quality policy (ref. 5.3) c) Ensuring that quality objectives are established (ref ) d) Conducting management reviews (ref. 5.6) e) Ensuring availability of resources (ref. 6) Customer requirements are determined and met to the satisfaction of the customer (ref. 7.2, 8.2.1, 8.2.4) Quality Management System Planning (Reference Element) Top management shall ensure that the QMS is carried out in order to meet requirements as well as quality objectives (ref ) Top management shall ensure that the integrity of the QMS is maintained when changes to the QMS are planned and implemented (ref ) Page 105

106 NOTES: Page 106

107 5.5.1 Responsibility and Authority Internal Communication (Reference Elements) Top management shall ensure that the responsibilities, authorities and their interrelation are defined and communicated throughout (ref , 6.2.1) The organization shall ensure communication between various levels and functions regarding the processes of the QMS and their effectiveness (ref , 5.4.1) 6.1 Provision of Resources (Reference Element) Determine & provide resources needed to: a) Implement and improve the processes of the quality management system b) Address customer satisfaction (ref. 6.2, 6.3, 6.4) Page 107

108 8.1 Measurement, Analysis & Improvement (General) (Reference Element) The organization shall plan and implement monitoring, measurement & analysis activities to assure conformance and achieve improvement (ref , 8.4) This includes determination of the need and use of applicable methodologies and statistical techniques (ref. 8.4) NOTES: Page 108

109 Procedures and Records Exercise Quality System Element documented procedure see QMS General requirements QMS Document requirements 4.2.1, 4.2.2, 4.2.3, Management commitment 5.2 Customer focus 5.3 Quality policy 5.4 Planning 5.5 Responsibility, authority & communication 5.6 Management review 6.1 Provision of resources 6.2 Human resources 6.3 Infrastructure 6.4 Work environment 7.1 Planning of product realization 7.2 Customer-related processes 7.3 Design and development 7.4 Purchasing 7.5 Production and service provision 7.6 Control of monitoring & measuring devices 8.1 Measurement, analysis & improvement - General 8.2 Monitoring & measuring 8.3 Control of nonconforming product 8.4 Analysis of data 8.5 Improvement Page 109

110 NOTES: Page 110

111 Clause Identification Exercise Statement: 1. Product released for use prior to completion of all required inspections will be approved by a relevant authority, including the customer where needed. Answer: 2. The quality system and its documentation structure are defined in a quality manual that covers the requirements of the appropriate American National Standard. 3. The inspection process includes evidence that the inspections are taking place. These records identify the authority of the employee releasing the product. 4. During the design of a new product, responsible personnel carry out documented meetings, at appropriate intervals, to review progress and compliance with the design plan. 5. Appropriate methods are utilized to monitor and control system processes to ensure they are capable of meeting requirements. 6. Documents that have been superseded by a later revision are either promptly removed from use or clearly identified as obsolete. 7. Management reviews relevant information to confirm that the preventive action process is implemented and effective. 8. Before quoting a job or accepting an order, the organization ensures the customer s requirements are known and that they can be achieved. Records of this process are maintained. 9. Objective evidence that the quality system is implemented and effective is maintained such that it is protected from damage and retrievable within a reasonable period of time. 10. Where the work performed affects quality, the organization ensures that the authority and responsibility of the personnel, who manage, perform and verify that work is defined and understood. 11. Deficiencies, identified by internal audit, are brought to the attention of appropriate management, which initiates timely action to correct the deficiencies. 12. Purchase orders for products that affect the quality of the product are reviewed for adequacy by appropriate personnel prior to release to the supplier. 13. At a frequency based on importance, the organization verifies that quality system activities, and the results achieved, comply with the objectives of the quality system plan. Page 111

112 Clause Identification Exercise Statement: 14. A reasonably senior representative of management is appointed who has the responsibility and authority to ensure the quality system is defined, implemented and achieves objectives. Answer: 15. Material or product found to be nonconforming to specifications is clearly identified and controlled to prevent any accidental or unintended use. 16. The correct issue of documents, necessary for producing a quality product, is available to the employees performing the work. 17. Computer software and comparative references used as inspection devices are verified for suitability prior to first use and rechecked at appropriate intervals to ensure continued accuracy. 18. Materials and services affecting the quality of the product are obtained only from suppliers that can meet the requirements specified on the purchase order. 19. Personnel performing quality related tasks are qualified based on training, education or experience. Records of this qualification are maintained. 20. Top management defines its policy, objectives and commitment to quality and ensures these are understood and implemented throughout the organization. 21. Materials and products throughout the organization s operation are suitably identified concerning the performance of required inspections and the results of those inspections. 22. Customer complaints are reviewed to determine whether or not corrective actions are required or justified. 23. Materials and products included in the scope of the quality system are clearly identified throughout the organization s operation from the receiving dock to the shipping dock. 24. Materials or products having shelf life or environmental considerations, such as temperature or humidity, are stored and preserved in a manner that prevents deterioration. 25. Written work instructions are maintained and available in production where the instructions are necessary to ensure the quality of the product. Page 112

113 Section 3: Phases of Internal Auditing Page 113

114 Four Phases of an Audit 1 Planning & Preparation 2 Conducting 3 Closing & Reporting 4 Follow-up Audit Planning & Preparation Determine: Auditing by area, function, element or process Define scope of audit Determine supporting documents needed If working in a team, determine individual responsibilities Determine agenda, time, and locations Assemble other paperwork Page 114

115 Audit Planning & Preparation Notify area of audit Send notice to area, functional manager Give adequate lead time Schedule Opening Meeting Tour of the facility or area as necessary Closing meeting NOTES: Page 115

116 Audit Scope Entire Quality Management System: Manual Instructions ISO Elements (5.3, 6.2, 7.1, etc.) Procedures Forms Organization Areas (Sales, Purchasing, etc.) Benefits of a well defined scope: An efficient audit Reduced time for all Better coverage of the area to be audited Determine and examine the supporting elements for the audit Stay within the defined scope unless a lead is discovered Then follow the lead outside of the scope to determine the effect on the system Preparation Hints Review all documents The standard Your organization s documents Review previous audits Results People interviewed Review corrective actions Closed Open Page 116

117 NOTES: Page 117

118 How to Use a Checklist The audit checklist is one of the most helpful tools and is used to: Prepare for the audit Ensure audit coverage Record notes, evidence, findings, and observations Manage time Report the audit Use to prepare a guidelist NOTES: Page 118

119 QMS General requirements QMS Document requirements Management commitment Customer focus Quality policy Planning Responsibility, authority & communication Management review Provision of resources Human resources Infrastructure Work environment Planning of product realization Customer-related processes Design and development Purchasing Production and service provision Control of monitoring & measuring equipment Measurement, analysis & improvement - General Monitoring & measuring Control of nonconforming product Analysis of data Improvement Internal Auditor Training ISO Develop an Audit Matrix Exercise Department Page 119

120 Developing a Guidelist Begin with an audit checklist a) A generic one of your organization Advantages: a) Keeps objectives clear b) Standardizes audits c) Simplifies the audit process Disadvantages: a) Time consuming preparation b) Discourages initiative Define three things: a) Who do I talk to? b) What do I look at? c) What do I look for? NOTES: Page 120

121 Stages of Conducting the Audit Stage 1 (Management) Hold an opening meeting Introduce audit team Review audit objectives and scope Review audit schedule Confirm time and location of closing meeting Tour if necessary NOTES: Page 121

122 Stages of Conducting the Audit Stage 2 (Workforce) Introduce yourself Explain purpose of the audit Explain that an internal quality audit is an audit of: Systems Processes Methods Not people Gather information Read Listen Observe NOTES: Page 122

123 How to Conduct Yourself Be punctual Be polite please and thank you, ask permission Be professional, yet friendly Maintain eye contact at auditee eye level Keep an open mind Be flexible Be persistent, yet pleasant Put people at ease Avoid arguments move on to the next person Establish non-threatening environment 8 Step Interviewing Method Make the auditee comfortable 2. Explain the purpose of your visit 3. Ask auditee to summarize his/her responsibilities and typical activities 4. Record major steps and analyze what was said and/or not said 5. Review procedures and samples 6. Record observations, examples, samples, nonconformities, (don t make a lot of copies) 7. Review your findings 8. Explain the next step(s) Page 123

124 NOTES: Page 124

125 Types of Questions Opinion How would you go about? Investigative Are there any more? Repetitive Tell me again Hypothetical What if? Leading You know how? Informative And then what? Imperative Please show me? Don t lose sight of the power of a DIRECT question. Types of Questions All questions can be phrased in a way that makes them OPEN ENDED or CLOSED ENDED questions Open ended questions begin a conversation Closed ended questions can be answered with a simple yes or no Both open and closed ended question have their uses Who, what, when, where, how, why & show me Page 125

126 Information Gathering Techniques Please explain what you are doing What procedures and or work instructions do you have for this? Please show me the procedures or work instructions for what you are doing? How do you know this is the current procedure? What happens when this procedure changes? What training have you had? Information Gathering Techniques What happens when you are not here? How do you know if the measuring device you re using is calibrated? Please show me the records you keep for this operation? Please show me your job description? What, in your own words, is the company quality policy? How do you initiate corrective action? Do you train others? Do you keep records of this training? Page 126

127 Sampling Sample definition: A part of a population studied to gain information about the whole Auditors sample: Procedures People Departments Records An audit sample needs to be representative The audit sample is chosen by the auditor NOTES: Page 127

128 This page intentionally left blank. Page 128

129 Closing and Reporting - Work Papers Auditors are required to retain records Records can take the form of work papers Work papers may include: Notes: used for interviews, visual confirmation and record of items reviewed. Guidelist: used for recording specifics such as people talked to and items reviewed Checklist: used for recording actual questions asked during the audit Previous audit reports: used in follow-up activities Objective evidence: recorded during the audit Objective Evidence Information which can be proved true, based on facts obtained through observation, measurement, test, or other means Qualitative or quantitative information, records, or statements of fact, which is based on observation, measurement, or test and which can be verified JUST THE FACTS! Page 129

130 NOTES: Page 130

131 Evaluation Process 1) EXISTENCE: Quality Manual Procedures Work Instructions Specifications 1) Does a documented quality management system exist? 2) ADEQUACY: ISO 9001 Other Requirements 2) Does the documented QMS meet the requirements of ISO 9001? 3) Are we doing what we say? Does practice match the documentation? 3) COMPLIANCE: Requirements implemented Authority defined Documents followed Records acceptable 4) Are the practices achieving their goals? 4) EFFECTIVENESS: Achieving goals Satisfying customers Perception of Facts Perceptions of the same facts may differ Highlights the critical need to discuss audit findings with: Other auditors Auditees Audit management Area management Avoid: Misunderstanding of facts Misinterpretation of facts Page 131

132 NOTES: Page 132

133 Nonconformity Rules What is a nonconformity? The non-fulfillment of specified requirements Start with the requirement: Management System Procedure, Program, Protocol, Schedule Management System Work Instruction Standard (ISO 9001, ISO 14001, AS9100, etc.) Customer contract, or purchase order, bill of material, etc. Nonconformity Rules Just the facts, objective evidence, not opinion Each nonconformity should be written independently Each nonconformity forms a problem statement for corrective action Use good, clear and concise English Review with management of the area audited Page 133

134 NOTES: Page 134

135 Nonconformity Levels Consider the seriousness when writing a nonconformity What is the impact on the management system? What is the impact on product, service, or customer? Major indicates a critical deficiency Minor indicates an isolated weakness Observation or Opportunity is not a nonconformity but is an issue the auditor wants to point out to management Nonconformity Report ISO 9001 requires that audit results be recorded and retained Each nonconformity must be documented The documentation must include the following information: Requirement (controlling ISO element,organization procedure, Customer requirement, etc.) Nonconformity (deficiency) Evidence (proof) Auditor(s), area audited, auditee(s), date, etc. Ensure connectivity to work papers Page 135

136 Writing Nonconformities Written nonconformities should: State the requirement State the deviation or gap Include evidence (proof) Stand alone as a problem statement Written nonconformities should not: Name names Make unverifiable observations / opinions NOTES: Page 136