GETMOREINFO

For more information contact Bernard F. Carmell, President and Senior Consultant of Resource Development Group, Inc. (Pittsfield, MA) at (413) 443-0661.

MMTTOOLS

 Print This Article

Clause 4.17 Internal Quality Audits
ISO 9000 has built in a verification process to indicate whether the quality system is doing its job. This process directly informs management at all levels about how effective the quality system is.

Successful operation of the audit process in the mold, tool and injection molding business is directly correlated to the support provided by senior management. This means providing adequate training, resources, time and support to allow the audit team to perform and report audit results. Also, management needs to support audit findings and timely completion of corrective action. When senior management allows rescheduling of internal audits for "any" reason; is not critical about past due corrective actions; cuts training budgets; reassigns auditors or does not mandate audit time, your quality system has begun to fail.

Q9000-2-1997 Guidance Provides Valuable Information About Internal Quality Audits
"Internal quality audits should be carried out by the supplier in order to determine whether the various quality system elements are effective and suitable to achieve the stated quality objectives. The frequency of periodic audits should be defined in an internal audit schedule.

The supplier should select and assign qualified auditors for the activity being audited. The requirement for the audit activity to be carried out by personnel independent of those having direct responsibility for the activity being audited does not preclude persons who have specific functions and responsibilities within the organization from being internal auditors of other functions and areas within the organization.

Periodic internal audits may be performed on parts of the quality system or the whole quality system:

• To determine the adequacy and conformity of the quality system elements with the requirement for their documentation and implementation requirements.
• To determine the effectiveness of the implemented quality system.
• To give an opportunity to improve the supplier's quality system.
• To facilitate external quality audits.

Note: This guidance series does not add to or otherwise change the requirements of Q9001, 2 or 3.

Before addressing the specific requirements of Element 4.17, it is important to mention selection and training of auditors. Begin to think about this need early in your quality system development process to plan events in time for effective execution. Offer all employees the opportunity to volunteer to be trained and become internal auditors. Plan auditor training to coincide with quality system implementation. In this way, newly trained auditors immediately can conduct audits using new skills. Provide reward and recognition for auditors and continue to add new auditors to your program. You will experience turnover for a number of reasons, including:

• New auditors may not like the pressure of the work.
• May be reassigned by management to a new position with no free time.
• May leave for personal reasons.
• Can't perform to expected levels.

Clause 4.17 Internal Quality Audits
A. "The supplier shall establish and maintain documented procedures for planning and implementing internal quality audits ..."
B. "To verify whether quality activities and related results comply with planned arrangements and ..."
C. "To determine the effectiveness of the quality system."

Action Items
A. The key words are planning and implementing. You are required to develop procedures for both planning and implementation of internal audits. The word audit means system audit.

Q10011-1-1994 defines quality audit as "A systematic and independent examination to determine whether quality activities and related results comply with planned arrangements and whether these arrangements are implemented effectively and are suitable to achieve objectives."

Planning means both the programs for conducting audits and the actual conduct of the audit. You will develop a yearly schedule as part of the program plan. Keep it simple. Use a table with the months (top, horizontal) and the departments (left side, vertical). Place Xs by department, by month (see Table I). If you have 15 departments, your schedule will identify each department and the month's audits are planned. Most companies plan to audit the complete quality system twice per year for the first two years after Registration. Before Registration, most companies have completed at least two full quality system audits. This requires a very active audit team conducting three or four audits per month. Once you have positive audit results, you can reduce the audit frequency.

The next planning step is to develop an Audit Matrix by Department and Element (see Table II), which identifies each department within your company and the ISO 9000 Element/Clause applied to that department. This table is valuable as an audit team-planning tool to identify those procedures and work instructions applicable to each department. It also helps each department by clearly defining ISO clause requirements. The department knows what elements the auditor will be auditing before conduct of the departmental audit.

Table II Audit Matrix by Department and Element

Your procedures will clearly document each step in the audit process. Most companies support the audit process by requiring all auditees to schedule time for audit completion.

Trained auditors will use checklists as reference documents during the audit and keep copious notes about activities that either comply or do not comply with requirements and why. Because an audit is a snapshot in time, some activities will not be checked as frequently as others based on audit results. However, an audit finding must always be considered important and representative as a sample reflecting possible additional nonconformities.

Your Registrar auditor(s) will look at your audit schedule to see if you are current; at your audit plan to see if you met your plan requirements and at your audit procedures to see if you followed stated procedures as written.

Action Items
B. Compliance with planned arrangements. A system audit is a documented activity performed to verify, by examination and evaluation of objective evidence, that applicable elements of the quality systems are appropriate and have been developed, documented and effectively implemented in accordance and in conjunction with specified requirements.

With this definition in mind, think about those quality activities that affect the ability of a product to satisfy its stated or implied needs. It is not enough for your internal auditors to verify that procedures are being followed. They have to take the next step to see if the results or outputs of the procedure(s) comply with planned arrangements or requirements. Auditors will ask questions about contracts, objectives and departmental goals, stated specifications, customer complaints, etc. as part of the audit process. So, be sure to define in your procedure what planned arrangements are and/or include.

Action Items
C. Effectiveness of the quality system. How do you define quality system effectiveness? Is effectiveness completion of a full audit cycle with no nonconformances? NO! You could be doing everything your procedures state, but still not satisfying your customer.

Your audit practice must identify problems present during the audit. Remember that the audit process is designed not to place blame on individuals, but to identify system deficiencies or areas of opportunities. Auditors will investigate progress by department toward achieving set goals, benchmarks or targets. Issues identified as continuous improvement opportunities and preventive action opportunities also support system effectiveness. Internal audit program effectiveness and quality system status is further validated by Registrar continuing assessments.

Effectiveness is linked to Management Review Clause 4.1.3. This clause requires Management to review the quality system to ensure continuing suitability and effectiveness in satisfying the Standard and your quality policy and objectives. Management includes audit results, customer complaints, cost of quality, customer survey results and critical evaluation of each Element of the Standard to determine overall quality system effectiveness.

Clause 4.17 Internal Quality Audits
A. "Internal quality audits shall be scheduled on the basis of the status and importance of the activity to be audited and ..."
B. "Shall be carried out by personnel independent of those having direct responsibility for the activity being audited."

Action Items
A. Schedule audit activity based on status and importance. The Audit Matrix (see Table II) developed for your company identifies activities to be audited. They are all considered important at the start of your first audit cycle. After completion of three audit cycles, your audit reports will show departments with high numbers of nonconformities. By this time, your quality system is mature enough to provide adequate objective evidence supporting compliance or noncompliance. You now have historical data to figure out the next audit schedule based on status. If your data for purchasing, for example shows -0- findings during three audit cycles, you can reduce the audit schedule frequency from twice per year to once per year. However, if purchasing history shows multiple nonconformities for each audit performed, you can increase audit frequency.

The importance of the activity is for you to decide if, in the purchasing example above, the nonconformity resulted from not signing after review of each P.O. as required by the procedure (this action does not create further negative results) or if the nonconformity resulted from not conducting the P.O. review (this action resulted in receiving the wrong raw material causing three presses to be shut down).

The importance of the second situation is much greater than first one. So, if you experienced the second situation, your action would be to increase the frequency of purchasing audits based on the high level of importance (receiving the necessary raw materials for production).

Action Items
B. Independent auditors. Independence means freedom from bias and external influences. The audit is performed by a person not responsible for production in the area being audited. For example, if you work in the quality department, you cannot audit this department. You can use your auditor knowledge to work with your superior and peers to improve the department outside your auditor responsibility. Use the audit matrix in Table II to identify and ensure auditor independence.

The reason for independence is clear. If you audited your own department, your audit results would be reported to your boss or the department head. This individual is responsible for your performance review, raises, work assignments and advancements. You would be pressured by fear of loss to overlook nonconformities to make the department look good.

Clause 4.17 Internal Quality Audits
A. "The results of the audit shall be recorded (see 4.16) and brought to the attention of the personnel having responsibility in the area audited."
B. "The management personnel responsible for the area shall take timely corrective action on deficiencies found during the audit."

Action Items
A. Audit records and management responsibility. Auditors should be trained to record both positive results and audit nonconformities. Each finding must be supported with objective evidence, or lack of such, and include the ISO element requirement not met. Audit practice is most effective when the nonconformities within a department are reported and reviewed with the department head, manager or supervisor. Gaining agreement before a closing meeting or report generation is critical.

Audit Master Software is recommended as an aid to develop audit reports. (Audit Master Software by Harrington Group is recommended based on its simple input requirement, low cost and ease of use.) There are many software products available on the market for your selection. You also can develop your own reports using word processor programs, Access database, etc.

Your audit report will include all audit results - both compliances and noncompliances. Each noncompliance should include identification of the standard's requirement, the department and location of the finding, objective evidence supporting the finding and the reason for noncompliance. Do not include prescriptive ideas.

Action Items
B. Timely corrective action by responsible management. Your procedure 4.14 Corrective and Preventive Action can be linked to Element 4.17 to define timely corrective action. This procedure includes a mandated response time, usually 30 days - requiring, at the minimum response, an action plan for root cause analysis and estimated time for closure for each nonconformity.

In practice this is a difficult time management issue the management representative (MR) has to deal with. The MR is not supposed to hold hands and prompt action to receive completed corrective action documentation. However, with "other" projects/assignments rated urgent and important, babysitting is often required to get results. Don't make this a practice or as a MR you will not have time to carry out your full responsibilities. The manager, department head or supervisor who assigned the corrective action is responsible for figuring out time requirements. Timely for one finding may not be timely for another. So, there must be flexibility built into the procedure, which allows reasonable time based on the complexity, scheduling, cost, labor requirements, etc. to respond to corrective action.

Auditors look for procedural statements about response time, usually 30 days with a description of documentation - including target dates and a plan for problem solving through implementation. Audit corrective action results will be reviewed to find out if the plan was met and the problem (root cause) was resolved. Auditors realize that some noncompliances are difficult to resolve - or the level of importance is low and will not take issue, if appropriate time extensions have been documented.

Clause 4.17 Internal Quality Audits
"Follow-up audit activities shall verify and record the implementation and effectiveness of the corrective action taken (4.16)."

"Note 20 - The results of internal audits form an integral part of the input to management review activities. (4.1.3)"

Action Items
A. Follow-up for corrective action is required before the audit item can be closed. Your audit procedure will define follow-up requirements or this process will be adequately documented as part of your auditor training program.

Adequate follow-up includes answering the following questions:

1. Did the responsible manager meet target dates and carry out actions to eliminate the root cause? Has corrective action been taken?
2. Has the root cause been eliminated? Is there any evidence of the problem existing today?
3. What objective evidence supports closing this item? (Attach copy to the C/A form.)
   • Updated Procedures or Work Instructions.
   • Data showing effective application - including meeting minutes.
   • Development of additional record-keeping requirements or modification of existing documentation.
   • Training records - including all employees trained to new procedure or work instruction.

Record-keeping of audit corrective actions should include:

1. A way to show the auditor what corrective actions are open.
2. Origin of the corrective action.
3. What phase the corrective action is in with due date for response.
4. The date follow-up was conducted to close the corrective action.