The logistics plan should be sent to the auditee well in advance of the audit. The audit team leader should then contact the auditee to confirm that the timing is acceptable and that meeting space will be available.
The number of logistical issues will depend on whether the audit is internal or external, on- site or remote, the size of the organization, the size of the audit team, and the complexity of the area to be audited. Issues particular to on- site audits include but are not necessarily limited to:
• Meeting rooms for audit team use and for daily auditee briefings
• Office space for auditors to review past observations and prepare for the next interview
• Special safety, environmental, or security issues, as well as orientation and training programs
• Access to telephones or cell phones, high- speed internet, and other means to communicate with the auditee, audit team members, and audit program manager
• The distance between areas to be visited and logistical difficulties for bringing team members together
• Personnel facilities (rest rooms, lunchroom, break area, smoking area) Issues for both on- site and remote audits or eAudits include:
• Access to necessary facilities and equipment required for verification activities
• Access to documents and records needed, such as manuals, procedures, process flowcharts, process maps, and PFDs
• Facilities or locations for the safe storage of proprietary and confidential information (this is especially important for remote audits or eAudits)
• Permission to use cell phones, cameras, or recording devices
• Permission for any out- of-the-ordinary event, such as a mandatory conference call from the main office, a personal call related to a family crisis that would require a change in the audit team, or a cancellation or rescheduling of the audit
Part IIa
• Availability of escorts or on- site guides
• Presentations and tours related to the area being audited
Most logistical items should be addressed before the data collection phase or per-formance phase activities, but no later than the close of the opening meeting if an on- site audit.
escort
An auditee should provide an escort for each subgroup of the audit team. (An exception can be made for internal audits if the auditor is already familiar with the organization and activities being audited.) The escort accompanies the auditor on the entire data- gathering portion of the audit and serves as a liaison between the auditing organization and auditee management. The escort ensures that safety rules are followed, performs personnel introductions, and provides clarifying information as needed. For example, an escort can suggest a way of rephrasing a question, perhaps by substituting terminology more familiar to the person being interviewed. However, the escort should refrain from answering questions for the auditee unless asked to do so by the auditor.
Other duties of the escort include:
• Providing or requesting supplies and records required by the auditor
• Acting as an observer for management and providing an overview of the auditor’s observations, findings, and conclusions to auditee management
• Acting as a guide for the auditor
• Confirming or denying that a discrepancy or nonconformity has been found before moving on to the next area to be audited
• Ensuring that auditors comply with company rules, including safety rules
• Ensuring communication equipment is functioning properly if a remote audit
If an escort suggests that the auditee may not understand the question, it may be possible that the escort or the interviewee is trying to dodge the question, or it may be that he or she doesn’t understand the audit process terminology used by the auditor. In either case, the auditor should continue collecting the audit evidence necessary to verify conformity by the most effective means available.
Tours
A tour of the area to be audited is permissible and oftentimes highly desirable. An auditor may tour this area as part of a preaudit visit to review documents or before or after the opening meeting. Day- of-the-audit tours and presentations should be scheduled and are normally very brief (less than an hour). If tour activities start to take too much time, the lead auditor should politely curtail them so that the audit schedule remains on track.
Part IIa
In Quality Audits for Improved Performance, the author states, “Another way to understand the activity is to take a tour of the place. Watch the operations taking place and notice the location of major equipment. The tour is informal and short, generally without the rest of your team. What if you find something really bad?
You have this natural desire to call home and report it. In doing so, you have started your audit—without a checklist, opening meeting, or even a team! You have totally destroyed the trust and respect building between auditors and audi-tees. Because of these dangers, think carefully before going on a pre- audit tour.”15 In the book The Process Auditing Techniques Guide, the author explains, “For complex or external process audits, a post [opening] meeting tour is a good tech-nique to become familiar with the layout, identify changes since the last audit, and align what you see with your expectations (the PFD). Tours should be brief.
During the tour you should start recording numbers and observations. You should record part, batch, lot, traveler, routing card, form, room number, transaction, cus-tomer identification number, and order numbers. When doing a system audit or complex process audit, the auditor must have a means to connect the different pro-cesses. Knowing what is being processed, readied to ship, or what the new inputs are will be very useful.”16 However, auditors should not start their investigation at that time and should remember that they will have plenty of time during the interviews and data collection phase to get their questions answered.
5. aUdITINg TooLs aNd WoRkINg PaPeRs Preparation of audit Checklists, guidelines, and Log sheets
An audit checklist is the primary tool for bringing order to an audit. A well- planned and well- defined checklist helps ensure the audit will be comprehensive. With-out a checklist, an auditor has a disjointed, disorganized activity and no place to record failed efforts. Before developing the checklists, an auditor must know what the governing requirement’s documents say.
A completed checklist provides:
• Objective evidence that an audit was performed
• Order and organization
• A record that all applicable aspects of the program were examined
• Historical information on program, systems, or supplier problems
• The essence for the exit meeting and audit report
• An information base for planning future audits
• A vehicle for time management
• Sampling plans and strategies
The purpose of a checklist is to gather information during the course of an audit that the auditor will need in order to justify the audit findings and conclusion. The checklist guides each member of the audit team to ensure that the full scope of the audit is adequately covered. The checklist provides space for recording facts
Part IIa
gathered during fieldwork, with places to answer questions and numerous areas for taking notes.
A checklist is a set of notes and instructions about specific areas, with specific questions to ask and specific techniques to use during an audit. Checklists or writ-ten procedures are used to ensure continuity and comprehensive coverage of the area of interest. They also provide evidence of the questions that were reviewed and a record of the review.17
A checklist may contain a standard set of information that every auditor looks for, such as the following:
• Does the person being audited have access to written procedures and applicable work instructions?
• Is the procedure up to date?
• Does the scope of this employee’s training cover the observed activities?
• Is the organizational structure proper for what the employee is expected to do in the observed procedure?
• Are appropriate records being maintained?
The specific format and construction of a checklist may vary depending on what works best for the auditor. Some checklists are yes/no questions that reference a specified requirement, others are open- ended interview questions that test the lim-its of a procedure, and yet others are statements providing additional instructions for the auditor. Variations of checklist questions or statements may be: “Does the person being audited always have access to the latest version of the procedure?”
“Verify—through observations, discussions, and review of documents—that indi-viduals have access to written procedures and applicable work instructions that cover their activities.”
In addition, many checklists contain a set of questions for each section of the requirement standard that is being audited against. This part of the checklist includes questions about management responsibilities, training, quality planning, and so on. These canned or generic checklist items should be supplemented with time- and circumstance- specific questions and observations that the auditor wants to make during the audit. Checklists should always be reviewed to make sure they are still current, since standards change.
Canned checklists with predetermined questions or statements from high- level documents such as ISO 9001 or ISO 14001 are very common. The use of canned checklists ensures all requirements are addressed, but they have limitations. In the book The Internal Auditing Pocket Guide, the author states that “canned checklists may not provide the flexibility that you may need for a specific audit. Canned checklists are good to use for comparison purposes, such as different suppliers, or comparing operating organizations.”18 Sole use of canned checklists can result in what is called a checklist mentality, with auditors asking only the questions on the checklist in audit after audit.
Deviations from the checklist may result from a change in the audit schedule or an observation that indicates a possible problem. A checklist can be expanded as necessary while still staying within the scope of the audit.19
Part IIa
An audit checklist is flexible; audit observations need not be restricted to what the auditor has planned. Also, it is permissible to abandon or make adjustments to the checklist items during daily meetings. A checklist is nonlimiting in that it does not restrict what an auditor needs to do, provided the auditor stays within the scope of the audit; it is simply a way to plan so that the auditor knows what to look for and observe in the given area.
The audit checklist may be forwarded to the auditee prior to the audit. This is a choice of the auditing organization. Normally, for first- and second- party audits, if the auditee requests a copy of the audit checklist, it is provided in the spirit of cooperation. Some audit organizations issue notifications when checklists are shared, to remind the auditee that the checklist is not the standard and that areas not on the checklist may be examined as long as they are within the purpose and scope of the audit.
It may benefit the auditor to review previous audits after the checklist is com-pleted, to see if anything that was a concern in the past should be added. The rea-son for waiting to review previous audits is to avoid bias in audit preparation due to some historical event. If a previous audit had a corrective action that requires follow- up, this is the time to add it to the checklist. There may even have been some complaints that were not completely answered. These are important issues that cannot be ignored.
Guidelines are additional documented instructions that are considered good audit practice that may provide additional information for conducting the audit.
Guidelines are not mandatory and are normally prepared in a statement format.
Log sheets are another kind of working paper prepared in advance of an audit.
A log sheet contains auditor notes and becomes a record of activities performed during an audit—what the auditor observed and with whom the auditor talked.
Example Log Sheet
One example of a log sheet is a white ruled pad that chronologically details where the auditor went and who was interviewed.
Example Area Guidelines for an Auditor
• Make sure that posted instructions are approved (signed) and that any changes are also approved (signed).
• If cyclical reports are kept, be sure older ones are marked as historical or reference. This also applies to drawings or specifications.
• Everyone with a need to know should be able to use the intranet to view practices and specifications. Make sure all stations are capable.
• Changes (to routings, for example) must be approved (such as being initialed).
• All products should be identifiable (for example, routing, tag) and nonconforming material segregated in the Materials Review Board (MRB) area (quarantined) or status clearly marked.
Part IIa
• Housekeeping need not be what we do for VIPs, but there should be some orderliness, and debris should be removed.
• Any instruments used for pass/fail decisions or that potentially impact or measure product quality should be calibrated, and calibration checks should be up to date. Also check for dates that expire the following week.
• Personnel training records must be current and available.