Recently, my mother told me a story about how I was as a young student.  Essentially, I was a stickler for the rules.   I was the pesky one that identified when things weren’t equal or fair.  I identified inconsistencies and activities that just weren’t logical.  I was probably annoying about it too.

I have always been that, even yesterday.  I am at the aiport, they announce boarding starting at the back of the plane.  Just about everyone gets in line.  I think to myself, why did they bother announcing and asking people to get on in order when they were not going to enforce it.  Not only do I notice this, but it bothers me to my core.  I was born this way.

But I like doing this, being observant.  I like the details.  But a person can’t be a success by just focusing on the details.  Knowing to step back and look at the big picture is important too.  Understanding where the discrepancy identified fits into the big picture is important.  This is how an auditor classifies nonconformities and makes sure that they are creating value for their client.  Over prescribing nonconformities can overburden an auditee, particularly if they are not useful or helpful.

I’m not saying do not identify everything, but there is a time to group findings, or to downgrade to an opportunity for improvement.  Also, be careful to stay within the scope of an audit.  How does an auditor know when to do this?  It comes from experience.  It also depends on the auditee.  Part of the classification can also be used to make a point.  For example, if I have a good client, who addresses everything through appropriate root cause analysis and goes beyond the specific examples that I identify in the nonconformity, then I tend to be easier in the grading of the findings.  If the auditee doesn’t go beyond the specifics, focuses on correction not corrective action, then I tend to raise all detail in the report and make the nonconformity more generic, which forces them to dig a little more.

You are asking, how do you know which type of auditee this is if this is the first time auditing them and their first audit?  Well, that’s a tough one, I like to give people the benefit of the doubt.

Another factor that is considered is the quantity of nonconformities raised.  If there are big issues, like a lack of procedures for significant aspects or risks, then there are bigger fish to fry in the system if a couple of inspections were not conducted exactly as scheduled.  For the client, addressing bigger issues will help them more in the long run, instead of dealing with the one off isolated issues.  But this doesn’t mean that I have forgotten those issues either.  I would mostly likely raise a strongly worded minor or major nonconformity for the lack of procedures and an opportunity for improvement regarding the poorly scheduled inspections.

So, a combination of personal traits and experience has done me well with my auditing.  I am constantly working on refining the best approach to help my auditees.  Because even though I usually come in as an outsider auditor, I still consider myself part of their team for improvement.

The most common example is ensuring issues are fully addressed.

During a recent audit, I was revieweing the management review meeting records. There was some really well documented issues from the discussions based on the KPIs reviewed. A number of action items were identified. Some of the actions had responsibilities identified and others the owner was still to be identified. The action items sat in the meeting minutes. This organizations’ management review meeting was scheduled for an annual frequency. My audit was about 6 months later and I followed up on the status of the action items.

Of the 9 action items identified, 5 had owners assigned to them, 0 had a due date. From the 9 action items, only 2 were closed, most likely because they were easy to address and were. Another 2 had gotten started, but because of a lack of a due date, other things got in the way. The remaining 5 were untouched. They were all good ideas, but they were not tracked.

At another audit, I was reviewing recomendations from a spill drill report. These were good action items and there was full intention to implement them. However, the action items never left the report. They were in the coordinators head to follow up on. While auditing, I was able to verify that some of the actions were addressed. However, some of the action items were not. The reason was that the report was in a file.

In both circumstances, everyone had good intentions. There was data and information that was reviewed effectively, but there were no systematic processes to follow through on the items. Without the follow through, the hard work done up to that point is lost and continual improvement slows down. An audit helps put a spot light on where good intentions are let to die.

As an auditor, make sure that your audit trail follows every step in the path, look for sufficient evidence to be satisfied that things are getting done.

How do you do that? How do you ensure that the intent of the meeting was met?

The intent of the management review meeting is to review key performance indicators and other information and make a decision as to whether or not the Management System is suitable, adeqaute and effective. This is the last step of the continual improvement cycle, the “Act” of PLAN-DO-CHECK-ACT. Reviewing the performance of the management system and setting new goals and direction.

The first thing that I look for is not just that they reviewed all of the required inputs, but how they reviewed it. Was is it in a lot of detail, or were there discussions on the processes. For example, when they reviewed the status of nonconformities, corrective and preventive actions (a common input in many standards), did they go through all of the listed nonconformities or did they discuss the process? The item by item review shouldn’t be done at the management review meeting, that’s what other meetings are for, to deal with the details. The management review should discuss issues such as timeliness of correcitve actions taken, repetativeness of some nonconformities, or a lack of preventive actions identified. The management team should discuss the potential resolutions to any problems, because these are the people with the authority and the resources to ensure that change occurs.

Second, I interview some of the attendees of the management review meeting. Some are lucky enough to have been interviewed for a different reason during the audit, and then I just throw in a couple of additional questions, some just get asked about their management responsibilities and the management review meeting. What do I ask them? I don’t try and test their memeory of the meeting, this not fair, as the meeting may have occurred anytime in the previous 12 months. I like to ask them about the effectiveness of the management system, their role in it, and what have they done to drive continual improvement.

All management, in fact everyone in an organization, has a role or a function in the continual improvement of the organization. From understanding the policy and supporting a company objecitve to setting objectives and improvement targets and supporting them with resources.

The management review is about looking at the forest’s health and not the individual trees living within it.

During an audit there is a lot of information to process, and inevitably you are going to hit a point where you feel that your brain is full and you can’t go on any longer; you can’t read another line in the procedure, you can’t check another record, you can’t listen to one more word. Usually, this has nothing to do with the subject matter, it doesn’t mean that the person in front of you is droning on and on and is getting tough to listen to (well, sometimes it is), that what you are reviewing isn’t completely interesting. Sometimes you just need a break.

What happens during an audit is that you are usually pressured to get your auditing task completed, so you just keep going, collecting information, more and more of it, until your brain is overflowing. The first thing you need to do is take a little break. I know for me, it is hard to do that. You get started and you just keep going. Because all eyes are you, for the next question, the next audit trail to follow up on. Why? Not because they are that into auditing, definitely, no. Usually, because they want to get this process over with as quickly as possible in order to get on with other stuff, so let’s just keep the pressure on the auditor. It’s tough, it’s mentally fatiguing.

So remember, take a break. You can also just change your view, go follow up on something that changes what you are doing. If you are reviewing records, then go interview someone. If you are interviewing, go tour an area and observe. If you are touring and are tired, go sit down and read some documents or records. Or even, go get a quick drink (non-alcoholic of course), something to change your focus for a minute.

Loosing focus during the audit happens to the best of us. Just make sure you don’t fall asleep and start drooling.

First you need to understand the difference. Breakdown maintenance is when the organization only conducts maintenance on a piece of equipment when the equipment breaks down. Preventive, and even predictive maintenance, is when an organization conducts maintenance activities, including inspections, to help ensure equipment is functioning within their expected parameters and to catch indications of minor issues, so that they can be addressed before a bigger problem occurs.

What is wrong with a breakdown maintenance approach? A management system focuses on being proactive. While this strategy is reactive. Plus this is disruptive to an organization, because you can’t plan when the equipment will break down.

The fall out from a breakdown can be multiple:
- Quality – production stops, resulting in delays in the delivery of the product or service, damage of the product.
- Health and Safety – the method of breakdown could be catastrophic causing injury to employees in the vicinity; for example: natural gas leak causing an explosion.
- Regulatory – if this is equipment that is legally required and then is no longer operating; for example: stack scrubbers required by a certificate of approval for air, light curtains required to protect working entrapment.

Ultimately, there is no specific requirement in any of the standards for requiring preventive maintenance. Sometimes, as an auditor, there is a legal requirement for preventive maintenance on equipment, but not as many as would be expected. Something to consider is the posting I observed on a Maintenance Supervisor’s wall during an audit recently, which inspired this blog entry:

“Maintenance is not about fixing things that break. Maintenance is about preserving, protecting, safeguarding and looking after the very machines that make business possible.”

So, what does it mean to be an Audit Team Leader or Lead Auditor, as opposed to just an audit team member. Well, number one, you have to have all of the qualities of an auditor: decisive, professional, knowledgeable, determined, compassionate, attentive, etc.

A team leader is all that, plus more. You have to be a manager: primarily a planner, taking into account personalities and skills of each team member in order to plan the audit in the most efficient and effective manner; logistics are an important part, taking into account locations of sites and even travel arrangements of the audit team members and the auditee too; and a diplomat, you are the final word and you have to present it as an opportunity and not punishment.

Are you lead auditor material? What do you need to work on, we all have areas that require improvement.

If you want the life of a professional auditor, be prepared!  Know what you are getting yourself into.

The upside:  I really enjoy my work.  The people, the exposure to so many interesting things, plus loads of other things.  But that’s not my focus right now.

The downside:  The travel and the schedule.  Time is money, literally.  With auditing become more and more cut throat, the rates are getting lower, but the expectations are getting higher.  Which means you have to become more efficient.  I am actually one of the lucky ones.  I work as a sub contractor and consultant, so I have complete control of schedule and a steady stream of work (knock on wood).  Some auditors work as full time employees, so they don’t have control of their schedules, they go where they are told.

The travel:  Oh, isn’t it exciting to go on business travel.  Sure, the first few times in my early 20s.  I actually still like to travel, I like to visit new places, I just don’t like the process of getting there anymore.  Business travel doesn’t mean that you get to be one of those lucky people up in business class.  I wish!  No client wants to pay for that.  I sit in economy class, with the rest of the world.  Oh, you can work on the plane!  Have you ever tried to open up a laptop on one of those fold out trays these days?  Especially when the person in front of you decides to recline and doesn’t have the decency to give you notice.  I can’t even get my screen open enough to be able to see it at that point.  Oh, you get to see new places!  Sure, I get to thoroughly see my client’s site.  But then that covers business hours.  Then there is dinner, checking emails, and sleep.  Not much time for sight seeing.  You can stay an extra day or two, that’s if you employer and/or schedule allows.  Sure, but all of those extra costs are my own.  And it’s just not as fun to see the sights on your own, by yourself.  I’ve done it, usually when it is my first visit to a new place.  But now, as I have a family, I just miss them more.  I usually just try to get extra work done, so I have more free time when I get home.  And depending on what type of work you do, you may not actually go any place interesting enough to make it worth seeing the sights.  Usually you just end up hoping for a comfortable, clean hotel room, and a decent place to eat.  Oh, you get to eat out and try new foods!  I gained 15 pounds in my first 6 months of auditing as a full time job.  I now crave, simple, home cooking types of meals.  And when I get home, it takes every ounce of my being to not scream when my husband asks to go out to dinner.

The schedule:  The audit is the big money, and your schedule reflects that.  What usually isn’t reflected is all of the non-audit time.  What else is there?  Well, for every audit there is the pre-audit work and the post-audit work.  And that has to be done around the audit.  If you are lucky, you build in the allowance for administrative time.  But for the majority of us, administrative time is not usually “billable” and therefore is done whenever we can fit it in inbetween audits.  When is that?  Usually nights and weekends.  Be careful, you willl find yourself a workaholic.

So take heed.  I don’t post this to discourage you from becoming an auditor.  Because it actually is a great line of work, its interesting, challenging and engaging.  I am always learning something new.  It’s after I leave the audit client that reality hits me.  So take this as a lesson learned, because we auditors are all about continual improvement, and make your choices well.  I have.  I have chosen to work hard, and now I have earned my break.  I am heading home from my last audit before I take my vacation (4 weeks!).  I will be back in September with renewed vigor and a fresh perspective and my burn out brushed off.  (As soon as I can get these last reports done, records filed and invoices sent.)

Have a great summer!

The question arises, what if the scope of the activities in a facility includes research and development and customer requirements include meeting the destination legislation of the customer, which are environmentally related. Do these new legal requirements have to be considered as part of the environmental management system?  For example: RoHS or WEE-EEE, both electronics recycling regulations in the EU.

Anything that has to do with the product with respect to its final delivery has to be considered a quality requirement and therefore part of the quality management system.  An environmental management system based on ISO 14001 is developed to control and minimize the environmental impacts of an organization’s activities, products and services within a defined scope.  The environmental management system based on ISO 14001 is not meant to certify that a product or service is environmentally friendly or is meeting any product specification.

Customer requirements that are applicable to the site do need to be considered as part of the environmental management system.  For example, some customers do not want certain chemicals to be used in the production of a product.  This can be considered an Other Requirement.

It’s definitely an interesting discussion.  What do you think?  Are there other examples out there that are not as cut and dry?

So how do you test that the auditee has actually met this commitment?

First of all what does this commitment actually mean?  It doesn’t mean that they are committed to meeting all of the applicable legal requirements all of the time, to be perfect and never at fault.  It does mean, that they are striving for that ideal.  We know that no one can be 100% in compliance 100% of the time.  Once you recognize that, then you are on the road to achieving it.  So we need to see a commitment to finding and addressing compliance issues immediately.

Second, just because they say they are committed doesn’t mean that they are.  In order to demonstrate commitment, your actions have to reflect this commitment.  And in the standards, there are elements that are there to do just that.  First the element of identifying your organizations Legal and Other Requirements.  You need to know what is applicable to your organization and more specifically your site.  A number of companies have those registries that list all of their legal requirements.  Great, that’s a start, but then how does it apply to your organization’s activities.  So the second element to help demonstrate your commitment is the Evaluation of Compliance.  They need to regularly check their performance against those applicable legal requirements.  In essence, a compliance audit, where the criteria is legislation.  And if there are any issues, then they need to be addressed immediately, preferably through a corrective action process.

So this is just one of the areas that you can concretely audit in order to determine if the policy has been implemented.  Because the policy is not just a piece of paper with words on, it is a sign post leading everyone to where the organization wants to go.  And the commitment to legal compliance is one of the key foundations (in addition to identifying aspects/hazards) to the management system.

An auditor has to be the bad guy, more often than I’d like to admit.  I equate it to giving my kids medicine, it may not taste good and I will do my best to sweeten it up, but in the end it’s for their own good.

I truly believe that an audit is an opportunity for an organization and its people to improve and grow and just be better at what they do.  And finding little things to fix, which is par for the course, happens all of the time and the auditee usually accepts it without too much hesitation.  Its when you have to deliver the bad news that they are receiving a major nonconformity, that’s hard.  But it’s never as hard as during that initial certification audit.  Why?  Because it delays certification.  I try and tell them that they will still get certified, as long as they respond to the finding within 90 days.  But when I know that they have been working so diligently and hard and earnestly, it makes it a bitter pill.

But as an auditor, you have to do what you have to do.  Ask yourself a couple of questions:

• Will this finding help them improve the way that they are doing things?
• Is this a finding because they just didn’t meet the requirements of the criteria?
• Do you have strong supporting evidence (not just a gut feeling, or one unverified information) to help defend your position?

Communicating the nonconformity is also important.  Do your best to stick to the key points of the nonconformity and be clear about it.

• Clearly identify the criteria and any other references (i.e. their own procedures).
• Step by step go through each piece of evidence factually.
• Clearly identify the gap between the evidence collected and the expectations for meeting the criteria.
• Do not exaggerate, minimize or guess.
• Do not offer suggestions for fixing it or dive into the root cause analysis

In my 15 years of auditing, it doesn’t get any easier.