Does Your Organization Really Benefit from Internal Audits? Time for a Change?

It's funny that you mention stages of maturity. I think if your company has a good Continuous Improvement program, your company will automatically grow and mature. I think this may be why I have a hard time "getting more" out our internal audit program. People truley are on board with continuous improvement. I'm going to fall back on compliance auditing being a good thing because as the company grows and employees come and go, I see it as a great training opportunity to keep people on track with the basic requirements. Having said that....I do understand that it can get old for managers to hear the same audit results as they always heard.

Sounds like an awesome place! Have you ever audited an improvement? To see if it's become institutional? I have seen examples of great improvements, put in place by energetic Kaizen teams, only to have them go to waste over a period of time, simply because the work was never committed to the quality system - the CI leaders saw ISO as 'BS' and so once the team got done, they never saw the benefit of writing anything down.

As a result, the improvements actually caused problems in other areas. Also, these improvement were 'transparent' to many auditors, since they weren't from that 'department' and, therefore had little to no exposure to waht was going on before or after the changes. Also, there was no linkage to the other affected departments, so other auditors weren't aware of the interactions.

So, from my perspective there are a number of audit issues which could have been effectively raised with management but because they did simple compliance audits, this crazy situation was never resolved.......

Re: Time for changes

Hi Jenifer,

I was just reading this post from 2006. I am interested in the outcome of the model you were in the process of designing: (quote: "I am in the process of designing a model that includes the necessary elements to prove value to process owners, train for repeat performance, win hearts and overall provide the vehicle (as a set of user-friendly tools and methods based on an existing quality-focused culture) for ratcheting the organization to the next higher performance level.") How did this go?
Silkeborg

I think I may have said this before but I feel that my main resonpsibility to my company and to our customers (as lead auditor) is to ensure we maintain our ISO registration and that means compliance auditing. Effectiveness auditing is interesting. Where can I learn about it and what can I use to back up my observations? The ISO standard? Anyone can go audit a process and come out with suggestions but those suggestions need something to back them up.

OOPS!!! I think i just replied to the wrong discussion.......sorry!!

goodtimes said:

I think I may have said this before but I feel that my main resonpsibility to my company and to our customers (as lead auditor) is to ensure we maintain our ISO registration and that means compliance auditing. Effectiveness auditing is interesting. Where can I learn about it and what can I use to back up my observations? The ISO standard? Anyone can go audit a process and come out with suggestions but those suggestions need something to back them up.

Click to expand...

Not a problem! Your response is in line with the theme of this thread. The value of compliance auditing over effectiveness is exactly what makes the difference between getting management to fully support or only give 'lip service' to the internal audit program.
Your question is a very valid and common one. The difference is, IMHO the focus of the audit program. Many audit managers and auditors never get beyond compliance!

Finding auditor training that gets beyond compliance is tough to find. You will notice a couple of fellow Covers (Helmut Jilling for example) offer courses which have gone beyond simple 'do what you say' audits.

Auditing a process for effectiveness is not that difficult, really. We often do something similar in our daily lives. You have to factor in the objectives and results of the process as well as looking at the controls in place. It's not too much to consider if you think about it! Did we actually get what we planned to get from the process, either internally or as seen by the customer.

goodtimes said:

I think I may have said this before but I feel that my main resonpsibility to my company and to our customers (as lead auditor) is to ensure we maintain our ISO registration and that means compliance auditing. Effectiveness auditing is interesting. Where can I learn about it and what can I use to back up my observations? The ISO standard? Anyone can go audit a process and come out with suggestions but those suggestions need something to back them up.

Click to expand...

The ISO 9001 standard itself requires effectiveness auditing!

ISO 9001:2008 said:

The organization shall conduct internal audits at planned intervals to determine whether the quality management system
a) conforms to the planned arrangements (see 7.1), to the requirements of this International Standard and to the quality management system requirements established by the organization, and
b) is effectively implemented and maintained.

Click to expand...

goodtimes said:

IEffectiveness auditing is interesting. Where can I learn about it and what can I use to back up my observations? The ISO standard? Anyone can go audit a process and come out with suggestions but those suggestions need something to back them up.

Click to expand...

It is required by 9001 (as howste points out) but like everything else in the Standard, it won't tell you how.

In my opinion, it's not really something you can learn from books or by reading about it. There's nothing like getting real experience from experienced professionals - I've learned something from every good auditor I've watched work. (And occasionally by watching bad ones, but that's usually a demonstration of what not to do).

Some ideas:

• Shadowing another (experienced & effective) auditor and then debriefing afterwards.
• Seeking help via your local quality organisation if that works
• A good course (like perhaps the Lead Auditors course) run by a reputable organisation and delivered by experienced professional/s.
• Can you enlist the help of your certification auditor? They can often be really helpful if you indicate a desire to learn or know more & give suggestions/tips. This doesn't have to be part of the audit itself (they may think it's too close to consulting - but there's always the possibility of a conversation over lunch!)

The standard says we shall conduct audits to determine whether the quality management system is effectively implemented and maintained. To me that's still compliance auditing. I think people throw the words "Effectiveness auditing" out like it's a totally different process backed by some other requirement when in fact it is still auditing to ensure we are compliant to the standard......correct? Sometimes I just feel like I'm missing something when there is talk about effectiveness auditing and maybe I am.....

goodtimes said:

The standard says we shall conduct audits to determine whether the quality management system is effectively implemented and maintained. To me that's still compliance auditing. I think people throw the words "Effectiveness auditing" out like it's a totally different process backed by some other requirement when in fact it is still auditing to ensure we are compliant to the standard......correct? Sometimes I just feel like I'm missing something when there is talk about effectiveness auditing and maybe I am.....

Click to expand...

You might be, if you never saw the majority of findings which tend to say something like 'Not following a procedure', or 'don't have a document to meet ISO 9001 XXX'. These are compliance audits. We see (at the Cove) people who want a checklist for ISO XXXX - if they audit to that checklist, they are doing a compliance audit also.

Auditing for effectivess of the QMS requires that there is an understandng of the objectives of a process and an audit of the results. It rarely happens!

Many (most) auditors are taught to do compliance audits, believe it or not! They are told to study the standard, compare the QM to the standard and then audit the implementation of the system to the requirements of the QM. Effectiveness is often judged by whether the company in the case study passes the audit!