Ineffective Internal quality Audit: Underlying reasons

My name is Danang [email protected]. Automotive Lead Auditor since year 2004 till today. I am a professional engineer providing consulting and auditing services Today after almost 20 years- developed the business of the biggest global certification body. As a professional auditor, with almost audit every day - 2-3 clients per week - I have done over a thousand audits against, quality management, mostly in automotive industries - In the past 23 years, I have done over IATF 16949 (previously ISO/TS 16949) audits in the automotive industries.

After so many years, one observation that continues to linger is the ineffective internal quality audit process. Honestly - In almost every audit that I have participated in, there have been findings against the requirements of internal audits. I'm sure this will be the easiest topic to be raised by other fellow auditors - even though they have different points of view - but unfortunately I think this client system has become 'bent' in an ineffective direction due to the contribution of auditors - apart from consultants. In fact, a little because of the client I was auditing - on one occasion I was asked the most typical question during an audit: "Why didn't the previous auditor think this was a problem...?"

for things that are specifically stipulated in the quality management system requirements - I don't feel like I 'know better or am smarter here' - but I am sad because the client I audited became 'inefficient because our opinions can differ - because of that - after training I was last about internal quality audits - what I am writing is a reflection while waiting for my tiring and boring boarding time

Arguably, some of the underlying causes, why the internal quality audit process is ineffective are:

• Top leadership - not very active in committing to internal quality audits
• The environment to ensure the effective implementation of internal quality audits is inadequate
• Less resources: inadequate training and ongoing professional development;
• poor preparation;
• poor utilization of adequate tools;
• not having the ability to communicate in writing and/or verbally;
• Poor skill sets to collect samples of observations and supporting evidence.

Thus, I would like to share my views of what I have encountered. Hopefully, internal quality auditors can improve their auditing skill sets not only to demonstrate the effectiveness of the facility management system, but, also, to identify potential gaps with strong supporting evidence and, more importantly, opportunities for improvement to strengthen the effectiveness of a management system.

Back to Basic : The Purpose

What is the purpose of auditing a management system in a certified company? -This is an easy question - but the answer that essentially shows an organization's commitment to internal quality audits - is not easy to find of the answers given are too standard (or are they cliche?)

Internal auditing determines the robustness and effectiveness of the plant management system. Ultimately, it provides feedback to management on the performance of the facility management system and where to focus their resources in areas requiring attention. Why internal audits are important to management? There are several reasons why internal audits can be very beneficial to plant operations:

• one – identify areas of improvement. the internal audit evaluates the effectiveness and efficiencies of the management system. Quality audits have the ability to assess the effectiveness of prevention processes against planned risks and opportunities- Corrective actions are generated to address raised findings during the internal audit process.
• two – employee growth and breaking communication barriers- It is a good strategy to use employees from other departments as internal auditors. This allows the auditor-employee to learn various aspects and functions of the business. It can also break down some communication barriers between employees and management. For some, it can be an opportunity for growth in the company.
• three – internal feedback. If it is done correctly, findings can provide significant insight into the company's operation including existing performance and identifying opportunities for improvements.
• four – audit report. A well-written report is a summary of observations, in which area(s) should focus their any kind of waste management ( let's me used Japannese term : Muda-Mura-Muri)

Key factors of why the internal audit process is ineffective

Weak top management commitment

Top management is the main reason how internal quality audits will be effective or not - whatever we do - no matter how good the facilities and methods we use will be useless when top management does not show its commitment

we have to be honest about this - what a small role 3rd plays. The auditor party concluded this - even though we clearly saw that top management - did not really understand and use the internal quality audit that was presented to us during the audit. I will always remember 'how displeased' these leaders were with the 'major' findings of the internal mut audit program that we concluded at that time - "on what basis do you say our internal quality audit is ineffective?" - because the top leadership only saw that the audit planned, implemented and even conducted a training program for its team of auditors - every year. Our conclusion is based on how top management 'does not have a strong common thread' regarding the internal quality audit program that is being carried out - and ultimately: is it effective? Does lots of findings mean our quality audit is effective? - this is a major finding which is rare and unique when we do it - and we believe that something like this is almost a common view in the foreign capital manufacturers we audit...if that's the case - what kind of hope can we pin on their internal quality audit program?

Internal quality auditor capabilities, knowledge and willingness to do audit

I always try to convey the following to clients - and almost always get a hesitant response: Internal auditors should be tougher, and dig deeper than third-party auditors because they are familiar with plant operations and understand company culture. However, I recognize that internal auditors may do one or two internal audits per year. Yet, an auditor at a certification body, such as i have done with a certification body may do one or two audits per week. > 95% of total days per year for audit, training, and consultation

Auditors at certification bodies also benefit from calibration training once or twice a year, as well as there is constant feedback and witness audits from senior management, certified companies, and accreditation bodies. From this feedback auditors improve their auditing skills over time - something an internal auditor may not benefit from.

Thus, often, there are observations and/or findings that a third-party auditor records against the requirements of internal audits. Some of the underlying causes include inadequate training and lack of ongoing professional development, poor preparation, poor utilization of auditing tools, and inability to communicate in writing and verbally. This also includes an inadequate collection of observations that would support any positive or negative conclusions and communicate those findings to the process owners for a better understanding of some of the gaps that may exist in the department or process, for which he or she is responsible for

Another primary cause is a lack of management commitment and/or management understanding of the benefits of the internal audit process to company operations above , which leads to the lack of:

First : Resources for adequate training and - time to do the audit and follow-ups. Absence of those lead to:

1. Not covering all aspects of the business operations, specifically the plant leadership – too often an internal audit team does not audit plant manager, for whatever reasons. It is important that one auditor is assigned to audit the leadership team of the site. Site manager must demonstrate their leadership and commitment to an effective and continuous management system. Management should be aware of the performance of the management system and which resources are required to strengthen and improve the existing management system.
2. Internal auditors are ill prepared and/or not qualified: it is great that plant personnel volunteers to become internal auditors, but too often they are ill prepared, because they were not properly trained; expectations and outcomes of the internal audit were not explained to them and they are not monitored by qualified management during the internal audit to later provide feedback. Internal auditors in most cases may do one or two audits per year, and it is very important that management provides refresher training every year and continuously monitors the progression during the audit. Sometimes, it is helpful if people work as a two-person audit team, where one person interviews the auditee and the second person takes notes, with the team alternating these roles. This creates synergy with the two-person audit team and the quality of the audit improves significantly. Also, the person responsible for the management system should organize witness audits to observe the audit team and provide feedback to increase knowledge and competencies. It is also important for the person, responsible for the management system, to explain expectations and upcoming changes. To overcome possible barriers in the company’s culture, the audit team could be a composition of managers and hourly personnel.
3. Using a generic checklist that has no value to the company’s operations: checklists are used all the time both for internal and external audits. But for a novice auditor using a checklist will only scratch the surface, and there are little opportunities to investigate deeper. A checklist is a tool, but it is an assigned auditor’s responsibility to investigate as deep as he or she wants to assure the confidence of the audit. If the site is planning to use a checklist, it is better the checklist is adapted to the company’s operations. The best checklist I’ve seen includes guidance notes what to look for and expectations of specific activities, audits, or requirements.
4. Too much admiration for TURTLE DIAGRAM - although not all of them - but the thing that I don't like is the notion that with Turtle Diagram audits can be effective - that this is a tool where our audits will be effective with turtle diagrams - it's magical - trutle diagrams can't work like medicine antibiotics against infection
5. Observations are incomplete, most often a documentation review: too often, internal auditor(s) will review documents, but would not review records, observe site operations and/or interview management and hourly personnel. Good manufacturing audits, process audits, or system audits determine the effectiveness of every process that is part of a company’s operation, and ultimately the effectiveness of a plant management system. Thus, process audits must include interviews of the process owners, samples of interviewed personnel, who work or are responsible for the process. It also includes documentation and records reviews and, if necessary, site visit for both inside and outside a facility premises. An internal auditor can review procedures beforehand to fully understand process activities, but ultimately, he or she audits the effectiveness of the assigned process. Furthermore, the auditor must document positive and negative observations to support the assessment of the effectiveness of the audited process.
6. There is no evidence that records were covered or reviewed, and there is no evidence that observations were made on site visit of company operation: too often, records associated with the management system are not reviewed and recorded on the auditor’s checklist or auditor’s notes. There are no guidelines how many records should be reviewed, but if there are several records every day for example about inspection activities, an auditor should review the initial sample to determine effectiveness of the inspection process, and if there are any gaps or deficiencies, the auditor can review more records. Ultimately, the auditor must have confidence the audited process is effective. In addition, both positive and negative observations should be recorded. Unlike a GMP audit or an inspection, a description of the observations should be documented to demonstrate traceability and support findings.
7. There is no evidence of proposed continuous improvements when gaps are identified: an internal auditor has more flexibility and is not restricted by accreditation requirements to propose opportunities for improvement. Internal auditors have many years’ experience with plant operation, know the culture and should be much tougher than an external auditor to ensure the audit process is effective. And if there is a gap, the assigned auditor can propose opportunities for improvement.
8. Difficult to maintain integrity or objectivity, when an assigned auditor is auditing own company’s department and or processes: often the person, responsible for the management of the facility management system, takes part in the internal audit. The best practice would be, if the person, responsible for the facility management system, would delegate the internal audit to others, and he or she can focus on improving the effectiveness of the system.
9. Auditing by process or risk factor: there are still many companies that are auditing by standard requirements or even by clause - this is old-school. A more effective practice would be auditing by process and/or by risk factor and associated requirements of the standard that the process owner would be responsible for. Such approach would provide added value, because the process owner would know some of the gaps that have been identified in his/her process. Also, auditing by risk factor would ensure that more resources are dedicated to the high-risk areas and low risk areas get less resources.
10. Do not fully understand the science, methodology and/or techniques of specific processes: the assigned internal auditors must understand the science, technology and/or methodology in the audited areas: e.g. hazard analysis, risk analysis, corrective actions, microbiological hazards, metal detection. If they do not have the knowledge, we strongly suggest preparing some training materials to help them understand some of these key concepts; otherwise the audit would be very superficial. Furthermore, extensive literature - various technical and scientific papers - is available on the Internet about internal audit best practices, good manufacturing practices, methods, technologies and methodologies. Auditors should constantly search the internet for topics of interest that can help during an audit.
11. Poor selection of auditors: auditing is not for everybody - it is important that the person responsible for the selection of the internal audit team should be very selective as to who should be part of that team. The selected auditor should have some abilities to investigate and collect evidence, communicate the evidence to the process owners and document his/her observations on the audit checklist and/or auditors’ notes. More importantly, internal auditors should be motivated to not only determine the effectiveness, but also ways to improve the audited process. It will not be easy, but the assigned auditor should audit the same process several times to have a better understanding of operation and become familiar with the activities. In this case, the assigned auditor should be able to recognize any deficiencies and propose opportunity for improvements. Furthermore, some schools of thought consider auditing once a year as a bad practice: instead, audits should be spread out throughout the year and be performed by a very small pool of auditors.
12. Pool of auditors is too large in comparison to the complexity of the operation: too often an audit team is too large, sometimes 30 to 40 auditors in a 200 or 300-person operation. That is a large team to manage and the quality of auditing suffers, because the assigned auditor may only do one audit per year. Instead, best practice would be to select a small group of auditors, who will be more efficient. There is no magic number how many auditors there should be, but it should be relatively small, so that the audit team could maintain integrity and do a number of audits per year, which would add value in an effort to continuously improve effectiveness of a management system. To train all these auditors significant resources are required, which may not add any value to the audit team, if it is only utilized once or twice per year.
13. Verbal communication: for an internal auditor, this may be the most difficult task, because he or she is auditing a colleague, a friend and/or a superior. For some auditing superiors or managers can be intimidating, or an auditor may be hesitant to provide adequate feedback, especially if the findings are not favorable. In a large company it is relatively easy to select a group of auditors, who are independent from plant operations. But what do you do, if you are small to medium-size facility, with no corporate support? It starts with the management’s commitment and explanation of expectations for the outcomes of the internal audit process, which would, essentially, aim to strengthen and improve the affected process, to the process owners.

?

Yet, it is very important for an internal auditor to be transparent and provide feedback to the process owner after the completion of the audit process. If the process owner pushes back on some of the findings, then the person responsible for the management system, and, in some cases, plant leadership should intervene to avoid potential personal conflict between the process owner and the auditor. However, it is important for the internal auditor to be professional, diplomatic, courteous, in some cases pragmatic, ready to compromise when necessary, but not be influenced by the process owners’ reactions and be firm, if there is sufficient evidence that supports his/her findings. For most, this may be very challenging.

?

Conclusion

In summary, management must recognize benefits of the internal audit process to strengthen the facility management system and provide adequate resources, including time and continuous training, ensure selection of qualified auditors, who in turn can ensure effectiveness of the facility management system and, more importantly, identify opportunities for improvements. Management must clearly explain to the audit team its expectations for outcomes of internal audits. For internal auditors, interpersonal communication with colleagues and superiors can be challenging, but after an auditor performs a number of audits, this challenge should become less burdening.

It is also important to constantly review auditing best practices, to be aware of the most up- to-date concepts such as lean manufacturing and/or six Sigma concepts, to be prepared by knowing company’s operations and culture and make adequate observations, including from listening to plant personnel’s comments during interviews, document reviews and site visits. There should be adequate evidence to support an auditor's findings.