Process Auditing

Why do people think that this is

something new?

Presented by
Kevin Gilson, Orion Registrar, Inc.

For the ASQ ISO Users Group

October 8, 2008
So where in ISO is Process?

Clause 0.2
This International Standard promotes the adoption
of a process approach when developing,
implementing and improving the effectiveness of a
quality management system. [ISO 9001:2000
page v]

Orion Registrar, Inc. 2

Why are internal audits
conducted?
Obtain factual input for management
decisions?
---or---
Produce data needed to receive
certification?
Improve documentation?
Enforce conformity?

Orion Registrar, Inc. 3

The Old-Fashioned Way of
Auditing
Quality audits focused on procedures
and not on quality
Auditors did not examine costs
Quality was how well an outcome
met the needs of those for whom it was
provided
Good quality = satisfied the needs
Bad quality = failed to meet the needs

Orion Registrar, Inc. 4

The Old-Fashioned Way of
Auditing
Companies ignored outcomes and
customer satisfaction when auditing
Auditors were looking to check the
box leaving performance ignored and
unchallenged
Conformity auditing looking to establish
if specific requirement had been met
Requirement may have focused on a
task, not performance result or output
Orion Registrar, Inc. 5
Document Review and
Approval
Auditor looked to see if documents had
been reviewed and approved by
authorized person
Did Auditor look for:
Competency of approver?
Why change was made?
Did change improve performance?

Orion Registrar, Inc. 6

More Effective Methodology
Needed
Focuses on performance, not just
conformity
Management needs to know:
Does performance meet targets?
Are there opportunities for improving
performance?
Are there processes that do not support the
workers?

Orion Registrar, Inc. 7

As an Auditor

If I invent your process then I am auditing my

version of your company and that version
may NOT exist.
Conflict of Interest!!!

Orion Registrar, Inc. 8

Process Approach to
Internal Auditing

Orion Registrar, Inc. 9

Process Input-Output Model

Orion Registrar, Inc. 10

Performance Process

Orion Registrar, Inc. 11

Performance Process Audit
Plan

Orion Registrar, Inc. 12

What does you Quality
Manual look like?
1. Introduction
2. Scope and Exclusions
3. Definitions and Acronyms
4. Quality Management System Requirements
5. Management Responsibility
6. Human Resources
7. Product Realization
8. Measurement, Analysis and Improvement
Appendix -- process maps or outlines

Orion Registrar, Inc. 13

Process Approach to Audit
Plans
Based on processes that achieve
organizations objectives
Requires auditor to know what the
processes are prior to conducting audit
ISO/IEC 17021 (Stage 1 and Stage 2)
Code of Practice for Registrars

Orion Registrar, Inc. 14

Process Approach to Audit
Plans
Common processes, for example:
Business management
Marketing and sales
Resource management
Purchasing
Product / service realization processes are
different for each organization
Plan shows audit trail through business
processes and across department
boundaries
Orion Registrar, Inc. 15
Process Approach to
Checklists
Does not require detailed checklist
Auditor can be guided by their
understanding of the Standard

Orion Registrar, Inc. 16

Process Audit Worksheet # Verify exclusions (if applicable)
Company: Location: Date:
Process: Standard Clauses: Auditor Name:

Documents Reviewed Audit Notes (addlpages as required) Personnel Interviewed (incl. Qualifications)

Inputs and Linka ges from Other Processes Outputs (incl. Records Generated)

Evidence of Measurements Related to Strategic or Resource Requirements (incl. Equipment

Process Objectives (as applicable) Requiring Maintenance and/or Calibration)

Orion Registrar, Inc. 17

Customer and/or Regulatory Requirements Nonconforming Product Control (incl.
Corrective Actions)

Strengths Opportunities for Improvement

Major Nonconformities Minor Nonconformities

Orion Registrar, Inc. 18

Process Approach to Audit

Start with top management and

business management processes
Continue with resource management
processes, establishing linkages
Effective resource management processes
will provide competent employees and
capable equipment to other processes
Continue with other processes from
marketing to delivery

Orion Registrar, Inc. 19

Value of the Process
Approach
Focuses on results, not procedures
Determines effectiveness of the management
system
Evaluates the results the system delivers
Tests linkages between departments and processes
Follows flow of work throughout organization
Determines if operations are under control and
controls are effective
Allows judgment on significance of findings
Helps determine depth of problems across
organization
Focuses on benefits of correcting nonconformities
related to improving organizational effectiveness

Orion Registrar, Inc. 20

The Process Approach
requires a change in
attitude across the
organization!

Orion Registrar, Inc. 21

What the Process Auditing
Approach Provides
Process Auditing provides:
Data for managerial decisions on growth,
technology, staff development, products /
processes based on current performance, not
just current conformity
Information on whether performance meets
targets
Information on opportunities for improving
performance through better control of processes
Information on making processes more effective
and more efficient

Orion Registrar, Inc. 22

Five Basic Questions

Basic questions can apply even though

the specific questions will be
different:
What are you trying to do?
How do you make it happen?
How do you know you are doing it right?
How do you know its the best way of doing
it?
How do you know its the right thing to do?

Orion Registrar, Inc. 23

Five Basic Questions at Three
Levels
Business Level Audit results should
make the auditor confident that the
organization:
Knows what it is trying to do
Knows how to make it happen
Knows that it is doing the right things
Knows that it is doing it in the best possible
way
Is managing performance

Orion Registrar, Inc. 24

Five Basic Questions at Three
Levels
Managerial Level Audit results should
make the auditor confident that
management:
Knows what the process aims to achieve
Knows how to design and cause processes to
achieve results
Knows that it is doing the right things
Knows that it is doing it in the best possible
way
Is regulating performance

Orion Registrar, Inc. 25

Five Basic Questions at Three
Levels
Operational Level Audit results
should make the auditor confident that
individuals:
Know what they are supposed to do
Know they are doing the right things
Know they are doing them in the best
possible way
Are regulating their own performance

Orion Registrar, Inc. 26

Summary

Internal auditing using process approach

Can take internal audit team from mission
statement to employee contributions
Identifies clear linkages between
interconnected processes
Ensures requirements of the Standard fit with
processes
Eliminates weaknesses of other approaches
Enables internal audit team to establish that the
organization is managing processes effectively

Orion Registrar, Inc. 27

Orion Registrar, Inc.
7850 Vance Dr., Ste. 210
Arvada, CO 80003
303-456-6010
www.orion4value.com
Westminster, MD
410-857-1748
kgilson@orion4value.com
410-884-9165
Orion Registrar, Inc. 28