QMS Internal Audit - 1 Day Trainng
QMS Internal Audit - 1 Day Trainng
Jayzer L. Aquino
1
Welcome Participants!
House Rules:
-Mobile phones in silent mode
-Feel free to ask questions relevant to the topic/ may interrupt the
speaker so we could immediately address the questions.
1. To know the basic principles and activities in conducting
Internal Audit.
2. To know how to audit the ISO 9001 & 14001:2015
requirements by using the principle of PDCA (Plan-Do-
Check-Act) and IPO (Input-Process-Output), Risk-Based
Thinking (QMS) and Life Cycle perspective (EMS)
3. Reference to the ISO 19011:2011 – employ the knowledge
and skills in conducting IA into your organization.
4. To appropriately report the audit findings – Good Practices,
Opportunities for Improvement and Nonconformities
PURPOSE
•To check the conformity of the organization to the
requirements of the ISO 9001/14001
ISO 14001:2015
EMS – Requirements
8
1. Scope
2. Normative references
3. Terms and definitions
4. Context of the organisation
5. Leadership
6. Planning for the quality
management system
7. Support
8. Operation
9. Performance evaluation
10. Improvement
9
P-D-C-A Methodology applied by ISO
“Plan-Do-Check-Act” (PDCA)
Plan: establish the objectives and processes necessary to deliver
results in accordance with customer requirements and the
organization's policies.
Do: implement the processes.
Check: monitor and measure processes and service against
policies, objectives and requirements for the service and report the
results.
Act: take actions to continually improve process performance.
10
(Source: ISO/ 9001:2015)
11 12.07.2015
The standard follows the Plan – Do – Check – Act cycle i.e.
DO CHECK
Develop and Implement the The effectiveness of the
Management Structure and Planning and Action stages
Control Mechanisms against established criteria
necessary to eliminate and for performance and, as
reduce the QEMS Issues necessary, take action
against weaknesses to
improve the management
and control measures
involved
PLAN
The approach to
Management of QEMS ACT
Issues now and in the Demonstrate and operate
future Top Management
commitment by initiating
continual improvement
against actual and potential
areas of need
AUDIT –
Its Principles and Process
13
AUDIT
Source: Wikepedia
AUDIT
- A systematic, independent and documented
process for obtaining audit evidence and
evaluating it objectively to determine the
extent to which audit criteria are fulfilled.
17
Identification of Self-Evaluation
Nonconformity and Future Plan
Plan
Analysis of Act Standardization
present system
Do
Selection of best Solution
alternative Implementation
solutions
18
ISO 9001/14001:2015
Clause: 9.2.1 Internal audit
26
SIX PRINCIPLES OF AUDITING:
1. Integrity
2. Fair Presentation
3. Due Professional Care
4. Confidentiality
5. Independence
6. Evidence-based Approach
AUDIT PLAYERS
Client
- party requesting the audit
Auditor
- conducting the audit /collects evidence and
findings
Auditee
- recipient of audit (entity/person)
TYPES OF AUDIT
First Party
- internal audit – own system
Second Party
- audit done by the organization to its external
(supplier/service) provider
Third Party
- audit done by an independent party of both
organization & supplier
“Plan-Do-Check-Act” (PDCA)
30
PDCA Cycle – Internal Audit Application
Plan
(5.3) Establishing the Do
AUDIT PROGRAMME
(5.4) Implementing the
Audit Programme:
(5.6) - Competence & Evaluation of Auditors
Reviewing & Improving - Performing the Audit
the Audit Programme
Check
31
32
Audit Criteria
-set of policies,
-procedures or
-requirements used as a reference against which audit evidence is
compared
ISO Standard, i.e. ISO 9001/14001
•Conformity Assessment
•Compliance Audit
Others
•Contractual Agreements
33
Verify the implementation of – How?
34
PRODUCT AUDIT – concentrates on the outcome – final
product/service (as received by the
customer/interested parties)
35
VERTICAL Audit
-An in depth look at a specific department/section
and verify the implementation of the step by step
procedures
-Common practice in Internal audit
HORIZONTAL Audit
-Focus on the inter-related processes /
interfaces
-Commonly used in 3rd party audit
36
37
IMPROVEMENT requirements of ISO
9001/14001:2015, clause 8.5
38
Regardless of the nature / type of audit
findings…(including Non-conformance)
All are intended for CONTINUAL
IMPROVEMENT of “”
39
PERFORMING
FIRST PARTY AUDITS
48
Audit Trail can be TRACED in one of combination of
the following:
-Traced forward
Follow the chronological progress of the process
-Traced backward
Auditor audits the final product then re-trace it
backwards to preceding process
-Random Selection
The auditor selects the any point in the process path
then makes use of flowchart
49
Ask what they do
Question
50
What key things to look for and where?
•Documented Information
-identification, issue, content, adequateness, and
distribution
-Retention, archiving, preservation, legibility, accessibility
51
QUESTIONING TECHNIQUE
Open Question
Probing Question
Closed Question
52
QUESTIONING TECHNIQUE
OPEN QUESTION
is useful for starting an audit, allows the
auditee to give general explanation,
e.g “what is the context /
“what are the identified risks…..?
“What are the processes ….?
53
QUESTIONING TECHNIQUE
PROBING QUESTIONS
- Digging deeper on the area /process
“ Can you explain the…?
“How do you determine the context /
risks….?
54
QUESTIONING TECHNIQUE
CLOSED QUESTIONS
- Answerable by Yes or No.
“Do you have a documented information related
to…?”
“ Do you have job description…?”
55
Follow-up Phase
56
Follow-up Phase
Corrective and preventive action
1. The auditor is only responsible for identifying the
nonconformity.
2. The auditee is responsible for correcting
nonconformance.
3. Corrective action (s) should be implemented within the
time period agreed on during the closing meeting.
4. An action plan should be submitted to the management
representative and/or the team leader by the concerned
auditee.
57
Follow-up Phase
Corrective and preventive action
58
Types of Audit findings
1. Good Points / Best Practices
2. Observation / Opportunities for Improvement
3. Potential NCs
4. Non-Conformance
Note: Classification of Audit findings / classifications may vary
in the organization
Basic Audit Questions
AUDIT
Reasons for writing down all audit observations:
* To avoid misunderstanding
* To avoid omissions
* To assert how the process is demonstrated
* To sustain clarity
RELATED DOCUMENTS
FOR AUDIT
*AUDITORS
- Cooperate and support the lead auditor
AUDITOR’S
Qualification
2. Steadfast
- must achieve audit objectives fairly
3. Polite
- for everyone’s concern: an Auditor is a guest or a visitor
4. Professional
- report findings exactly as they are found without
fear or favor
ATTRIBUTES OF A GOOD
AUDITOR
5. Progressive
- technology changes constantly, so auditors must be
kept abreast with such developments
7. Punctual
- stick to the plan and be on time
ATTRIBUTES OF A GOOD
AUDITOR
8. Principled
- be completely open about concerns; handle the
confidential information appropriately, thus, keeping trust intact
9. Optimistic
- auditor’s task should not be regarded as a negative
undertaking that audit could become a search for
failure; instead should be viewed as an opportunity for
improvement
ATTRIBUTES OF A GOOD
AUDITOR
10. Practical
- treat each thing from a practical point of view that
audit is not a waste of time and money
11. Prepared
- time spent in planning and preparation of audit
should be worthwhile
REASON FOR APPLYING THE
AUDITOR’S PERSONAL ATTRIBUTES
To obtain and assess objective evidence fairly.
To remain true to the purpose of the audit without fear or favour.
To evaluate constantly the effect of audit observations.
To treat concerned personnel in away that will best achieve the audit
purpose.
To react with sensitivity to the national conventions.
To perform the audit process without deviating due to destruction.
To commit full attention and support to audit process.
To react effectively in stressful situations.
To arrive at generally acceptable conclusions based on audit
observations.
To remain true to a conclusion despite pressure to change that is not
based on evidence.
(ISO 19011)
FOUNDATION
OF TRUST FOR AN AUDITOR
1.0 Has an Improved Communication
1.1 Know thyself
1.2 Listen more than talking (75% listening)
1.3 Paraphrase to clear ideas
2.0 Must be Prepared
2.1 Know the procedure
2.3 Choose a convenient audit time
3.0 Must be Empathic
3.1 Be genuine and enthusiastic
3.2 Be sensible
3.3 Maintain eye contact
3.4 Exercise good humor
3.5 Boost morale
FOUNDATION
OF TRUST FOR AN AUDITOR
4.0 Has an Objective Criteria
4.1 Agree on a standard to be followed
5.0 Focus on problem, not on people
5.1 Refrain from blaming others
6.0 Consult before deciding
6.1 Understand views before considering deviation
7.0 Agree or disagree if necessary
7.1 Refrain from inevitable argument
7.2 Elevate unresolved issue
8.0 Build a working relationship
8.1 No to conventional audit, instead give recommendations
8.2 Understand the auditee’s limitations
8.3 Consider common courtesy; “thanks”, etc.
Internal Auditor’s Note:
1) Analyze data, don’t just accept, show where to improve solve
problem, identify risk
2) An auditor decision must be more substantive and value added
3) Increase competence of auditors like educating them to other
related trainings
4) Cannot audit if process was not fully understood. Team skill is a
mandate including understanding of legislative and how transfer of
information are made.
5) Audit is lots of analyzing, evaluating, asking complete objective
evidence and verification, so do 3rd party.
MECHANICS
OF INTERNAL AUDIT
I. PREPARATION STAGE
85
Objective
Evidence
Audit
Findings
Audit
Cirteria
86
Types of Audit Findings:
-POSITIVE - exemplary conformance / best practices
-OPPORTUNITIES FOR IMPROVEMENT – e.g. suggestions /
recommendations
-POTENTIAL NON-CONFORMANCE – on the edge to be
NC, if not address
-NON-CONFORMANCE - non-conformance to a
specific requirement/s and/or based on risk or impact
87
Three (3) Components of NCs:
88
1.Requirement (e.g. Standards)
Ref. ISO 9001:2015 clause/s
Ref. applicable statutory / regulatory requirement
Ref. documented information / specifications
91
Normally stated in one sentence as to WHY the evidence
deviated the requirement/s
Description of Failure
92
Purpose:
-To serve as evidence of problem noted “as of the
time of the audit”
93
Nonconformity (NC):
94
-Extent of conformity of quality
management system based on the audit
criteria and effectiveness
95
-Audit evidence gathered was based on samples
96
- Comments / opinions should be discussed
related to findings…. if possible resolved
immediately
97
The Audit Report, should be:
- Dated
98
Guides on Writing
Audit Findings…
99
Note: the type/classification of audit findings may vary in
different organization
Type of Audit Nature How to handle
Findings
Opportunities for -No bearing if the auditee Auditees are
Improvement / will consider or not encourage to
Observation -For improvement “consider “ / Optional
purposes with the auditee if
action is necessary.
Potential NCs -Audit evidence are not Auditees need to take
clear; action – to PREVENT
-Audit criteria not clearly from NC to OCCUR
specified
Nonconformities -Clear deviation from Auditees need to take
requirements action – to PREVENT
-Significant impact / RISK RECURRENCE of the
in the system if not raise problem. 10
as NC 0
- Insufficient knowledge with the Audit Criteria
-Thinking of the “implication” of raising audit findings – or
the impact of the findings
- Not familiar with the structure of stating OFIs / Potential
NCs and NCs
- Choice of words / inappropriate
- “May consider…”’
- “Consider to…”
- “It was observed that…consider to ….”
- “It would be better if…”
- “Consider to improve…”
- “Consider to review…”
- “Review the ….”
- “Consider to revisit”
- Note: Don’t use words like .. “shall”, “must”, “should”10
2
2. PNC (Potential Non-conformity):
Statements need to start with or include:
-“Ensure that the…
-“There’s a need to consider….otherwise (site the
possible consequences / impacts)
-“It is strongly suggest that…
-“It was observed that… however, it is strongly suggest
that action need to be taken… in order to prevent…
Note:
Depends on the context … the statement
should always imply…the potential
impact/consequences
10
3
3. NC (Non-conformity):
Statements need to start with or include:
-“The requirement of…was deviated…based on the
audit evidence…
-“It was found out that there are inconsistencies on the
compliance to the requirements…
-Based on the evidence gathered…such as (bullets
can be included)….the requirement of …was
deviated.
-“The following items….are not in accordance with the
criteria of …”
-Note: Outline of stating NC can be enumerated as
(RED):
-Requirement?
-Evidence? 10
4
-Deviation?
3. NC (Non-conformity):
Additional…
10
6
Thank you for Participation
QUESTIONS?
107