Weather and Environmental Services - QMS Manual

Transcription

1 1 of 7 pages 1.0 PURPOSE This work instruction prescribes procedures for planning and carrying out internal audits. It supports the Q , Internal QMS Audits. 2.0 SCOPE The procedures apply to all internal audits carried out in support of the WES QMS APPLICATION The focus of internal quality management audits is to verify compliance to: a) Common procedures established for the WES quality management system (refer to the Quality Manual Library on the QMS ECollab site). b) Processes and procedures established under the authority of the Process Owner or delegate(s). c) Regulatory requirements. The ISO 9001:2008 standard serves as a secondary reference. Auditors need only audit directly to this standard when the common procedures established for the WES quality management system do not fully address the requirements. 4.0 WORK INSTRUCTIONS 4.1 Audit planning cycle a) The Quality Management Office (QMO) will prepare a continuing three-year plan for carrying out internal audits. The following update schedule applies: i. By October 1 of each year, the QMO will post an initial document on ECollab (private site for Auditors) that will address internal audit plans for the upcoming calendar year and for the following two years. This document will also be sent to the cadre of lead auditors along with a request that they identify those audits which they would be interested in leading. Note: This initial document will indicate audit scheduling in terms of three-month windows (January-March, April-June, July-September and October- December). Lead auditors will be asked to identify one-week or two-week periods within these windows when they would be available to conduct audits for the upcoming year. This information is due to the QMO by October 15. Approval Authority: Manager, Quality Management Office Approved by: Date: WES refers generally to the programs under Environment Canada s Strategic Outcome #2 in the PAA. However, in the context of the QMS, WES also includes the Water Survey of Canada (which is part of Strategic Outcome 1)

2 2 of 7 pages ii. The QMO will confirm the lead auditors for the coming year and finalize the plan by November 1. The QMO will post the plan on ECollab and also send it to the various process owners with a request that they confirm their availability within the one or two week windows for the coming year to the relevant lead auditor(s). Process owners should also identify any concerns with the internal audits planned for years 2 and 3 of the plan. iii. The applicable lead auditors will be responsible for coordinating with the process owners and local managers to ensure that the audits take place as planned and for advising the QMO regarding any changes to the plan. iv. Approximately every two months, the QMO will post updates to the internal audit plan to reflect any additions and changes. b) This plan incorporates the following information: i. Location of audits (city, and, where there are multiple locations within a city, the specific locations) ii. Timing of audit (one or two week window for the current planning year; three-month windows for the second and third years of plan) iii. Processes to be audited iv. Process Owners v. Local Managers who will represent the Process Owners on-site (if known) vi. Lead Auditors vii. Other Auditors (when identified) viii. The plan will be bilingual and posted on the public section of the QMS ECollab site. An expanded non-bilingual version with additional information, comments and some cost estimates will be posted in the auditors private section on the ECollab site. 4.2 Audit planning considerations a) Every Lead Auditor should lead at least two audits per year. b) All processes should be audited at least once every three years. c) IT operations (e.g. 24/7 Incident Management & Change Management) processes should be audited at two locations annually (subject to acceptance by Shared Services Canada). d) Two overarching processes should be audited annually. e) Because the QMO is included in every external audit, internal audits are normally not planned for this process. f) Two Storm prediction Centres (SPCs) in two different regions should be audited every year. These audits should include a National Lab when one is co-located with an SPC. In addition, the aviation forecast centres (CMAC-W and CMAC-E) should also be included in an audit of the co-located SPC. g) Given the number of processes in these regions, the National Capital Region, Montreal/Dorval and Toronto should be audited twice annually.

3 3 of 7 pages h) Two Water Survey and two Atmospheric Monitoring locations should be audited in two different regions annually. i) To the extent possible, internal audits of a process at any given location should precede or follow an external audit by at least one year. j) Where travel is required, audit nearby locations and multiple processes over a one-week period using an audit team, in order to minimize travel costs. 4.3 Audit planning - Lead Auditor responsibilities The Lead Auditor shall: a) At least 60 working days before the scheduled audit, discuss the planned audit with the Process Owner and/or the local manager to determine the exact timing of the audit (window identified in the three-year plan). b) Request an audit number from the QMO, then issue an Audit Initiation Form (QF ) at least 20 working days prior to the first day of the audit. Liaise with the Process Owner or delegate to ensure that the information specified in Section 4.4 of this document is provided. c) Determine the requirement for an opening meeting (see Section 4.6 for guidance). d) Update the Audit Initiation Form as changes or additional information become available and provide copies of the update to the Process Owner and delegate(s); finalize the form at least five working days prior to the scheduled audit date. e) Coordinate with any additional auditors or observers who have been identified to participate in the audit (auditors should be identified at least sixty working days prior to the audit). f) Liaise with the on-site management representative to ensure that person understands the internal audit process and to verify that logistical requirements have been met. g) Liaise with the QMS Working Group representative associated with the audit to ensure that the representative is aware of the audit and that any necessary coordination is identified. h) Track the time (number of hours) spent in planning, conducting and reporting on the audit, for later communication to the QMO. This input helps in planning subsequent audits. 4.4 Audit planning and participation Process Owner responsibilities The Process Owner or his/her delegate shall: a) Provide the name and contact information of the person who will serve as the on-site management representative for the Process Owner at least twenty working days prior to the first day of the audit. b) Provide the following information to the Lead Auditor at least fifteen working days prior to the first day of the audit: i. The names of people who will participate in the opening and closing meetings. The choice of participants lies at the discretion of the Process Owner. If the Lead Auditor has specified an opening meeting, it is recommended that any managers, supervisors, or operational staff expected to actively participate in the audit attend. ii. An organization chart indicating the individuals at the location to be audited and identifying those who will be available to be interviewed.

4 4 of 7 pages iii. Copies or links to the Record Management Table (Q ) and Document Control List (Q ), or equivalent(s). iv. The location for the opening and closing meetings. Note that these rooms should be equipped with a speaker phone to enable off-site participants to dial-in. v. Review the facility s security requirements and arrange for any needed passes or clearances for all audit team members. Any other matters that the auditors need to be aware of (e.g. need to wear protective equipment in a workshop or warehouse). c) Ensure that all management and staff who will be affected by the audit understand the QMS internal audit process as well as the timing and availability requirements specific to this audit. d) Book a meeting room or office for use by the audit team throughout the course of the audit. e) Ensure that staff members are available to meet with audit team members during the period scheduled for the audit. If staff members are not available in person, alternative arrangements such as telephone or video conferences are acceptable. While the audit team will make every effort to respect anticipatory time slots assigned for these meetings, audits often require team members to follow up on specific issues. This factor may necessitate adjustments to the scheduled time slots. f) Ensure that quality documents likely to be required during the audit are identified and readily available to the audit team. If it is unclear as to what documentation is needed, the Process Owner should consult with the QMS Office or Lead Auditor prior to the audit date. g) Review records of previous audits for the process and assess the status of corrective or preventive actions in preparation for the audit. 4.5 Audit execution - Lead Auditor procedures a) Review available documentation to prepare for the audit. Examples include previous internal and external audits, open CPARs and CPARs closed over the past year, and process documents (including subordinate documentation referenced in the process document). b) Chair the opening meeting (if required); provide an agenda to attendees and maintain a record of attendance; if issues are identified during the meeting, maintain a record of the issues and any relevant decisions or action items. c) Arrange for interviews with management, supervisors, and staff as appropriate. Assign audit team members and observers to each of the interviews. d) Take and maintain detailed notes from the interviews. e) Where feasible, obtain evidence of compliance or non compliance to requirements (e.g. paper or digital documents, photographs). f) Meet with the audit team to determine findings and prepare for the closing meeting. If time permits, draft the audit report for review at the closing meeting. If there is not enough time to draft the report, as a minimum, provide general comments and identify any non conformances, opportunities for improvement, or observations that will be included in the final report. g) Determine whether non conformances require a Corrective or Preventive Action Request

5 5 of 7 pages (CPAR) or whether a follow-up verification of action taken would be sufficient (see Section 4.6 for guidance). h) Chair the closing meeting; provide an agenda to attendees and maintain a record of attendance; if issues are identified during the meeting, maintain a record of the issues and any relevant decisions or action items (including actions and agreed-upon dates for resolving any non conformances that will be handled through a follow-up verification). i) Announce that the QMO wants auditee feedback on the audit; the QMO will formalize this request when it sends the formal audit report. The preferred form for this feedback is Form QF (posted on ECollab). Consult with the auditee to assign a reasonable due date, and communicate it to the QMO. j) Prepare the final audit report (QF ), and report to the QMO on the time spent on planning, conducting and reporting on the audit just completed k) If significant non conformance issues are identified in the report, draft relevant CPARs by completing Section 1 of QF , in collaboration with the QMO. l) If any opportunities for improvement (OFI) were identified during the audit and deemed by the Process Owner as requiring a CPAR, draft the applicable OFIs by completing Section 1 of QF , in collaboration with the QMO. m) Collate and send to the QMO all documents and evidence collected during the audit. This includes but is not limited to notes and records from the opening and closing meetings, interview notes, and documents collected as evidence. n) Within five working days after completing the audit, advise the QMO and Chief Auditor of the status of the audit report and provide a summary of any major issues identified during the audit (note that if Step o has been completed within the five-day period, this step is not required). o) Send the draft audit report along with any draft CPARs and OFIs to the QMO via to the ISO mailbox or other mutually acceptable means not later than ten working days following the closing meeting for review and approval. The supporting documentation identified above shall either be mailed to the QMO or scanned as necessary and sent electronically. p) With help from the QMO, monitor progress on actions taken in response to CPARs. If the Lead Auditor identifies problems in the root cause analysis or action plan, the Lead Auditor should raise these concerns with the Process Owner or delegate. If the Lead Auditor has unresolved concerns, these should be raised with the Chief Auditor. After the Process Owner has signed off on the action plan (Section 3 of the CPAR form), the Lead Auditor shall complete the CPAR verification (Section 4 of the CPAR form). Any concerns should again be raised with the Process Owner and, where appropriate, with the Chief Auditor. q) If issues requiring follow-up verification have been identified in the audit report: i. Follow up as appropriate with the Process Owner or delegate(s) to verify that the required actions have been taken and are effective. ii. Notify the QMO Manager of the results of the verification (include references to the audit date, non-conformance being verified, the actions taken, and the steps taken to verify that the actions were completed and effective). iii. If unable to verify that the actions were taken and were effective by the agreed-upon

6 date, notify the QMO Manager via . 6 of 7 pages 4.6 General guidance on carrying out internal audits a) An opening meeting is normally scheduled but may be replaced by a telephone meeting prior to the audit at the discretion of the Lead Auditor. b) The number of interviews required depends on factors such as the number of staff covered by the audit, the number of management/supervisory layers, and the complexity and diversity of tasks and responsibilities. In general, an interview is appropriate for each layer of management or supervision. Where required, the interviews should include sufficient sampling at the working level to assess compliance to both WES common procedures and to work instructions internal to the process being audited. c) All significant non-conformances require initiation of a CPAR to ensure the required level of diligence in tracking and verifying compliance. To be significant, a non-conformance would potentially allow a non-conforming service or product to be delivered to or cause a breakdown of system control. Non-conformances that do not meet the above criteria may be tracked and verified using a less formal procedure. If the Lead Auditor and the Process Owner agree on a course of action (including completion dates), the issue and action should be documented in the audit report and the Lead Auditor should follow up to verify that the actions were taken and were effective. d) The audit may also reveal opportunities for improvement. Examples include actions to: Reduce the risk of potential non conformances Improve compliance to the requirements of the QMS Note that while an auditor may recommend such actions, the decision on whether to proceed lies with the Process Owner. If the Process Owner decides to proceed with a CPAR, he/she should notify the Lead Auditor who will initiate the CPAR documentation. e) Remote audits (i.e. using teleconference, web meeting, or video conference) may be carried out at the discretion of the Lead Auditor with the concurrence of the Chief Auditor. This course of action is normally appropriate for smaller locations where it is too costly to carry out inperson audits or where there is a more efficient way to complete an audit. f) Observers should not actively engage in the audit interviews unless the Lead Auditor asks for their input. 4.7 QMO Procedures Upon receipt of a draft audit report from the Lead Auditor, the Quality Managent Office will have ten working days to review and approve the audit findings and the report. The QMO manager or his/her delegate will then associate the appropriate audit number to the audit report and related documentation, and assign numbers to any associated CPARs and OFIs, and send these documents along with an audit evaluation form (QF ) to the Process Owner for consideration and action. The Process Owner will then normally have 10 working days to respond to any CPARs or accepted OFIs.

7 DOCUMENT HISTORY Detailed History of Changes Rev# Date State Initials Description of Changes 1Dv Draft EAB The document is initiated. 7 of 7 pages 1Dv Draft EAB Added place holders/references to new HIGH Level Q2 s being developed 1A Approved EM Approved 2A Approved PT Changed name of document owner to Alain Boisvert 3Dv Draft DD Some of the procedures were revised for clarification and to reflect new timeframes and responsibilities. 3Dv Draft DD Revised some procedures, added new time QMO time frame and provided additional clarification. 3Dv Draft DL Revised procedures following detailed review at Lead Auditor Meeting 3Dv Draft DI/PT Various edits/updates. 3A Approved PT Correction to typos and approval 4Dv Draft LCD Revised; correction of the French version and minor changes. 4A Approved AB Approval Approved AB Approval.