Remote Audits - My Experience
With the current pandemic related limitations on travel and social contact, I see a lot of talk in compliance auditing (financial, quality, environmental, etc) circles regarding the possible use of a remote auditing approach, sometimes referred to as the e-audit.
The IAF (International Accreditation Forum) had issued documents going back over a decade allowing certification bodies to incorporate some use of remote auditing using electronic means. These recommendations allow for the use of remote review of documents and information to augment, not replace, on-site audits. Still, there are a number of non-credentialed audit firms performing e-audits and issuing certificates of conformity based on remote audits.
The IATF (International Automotive Task Force) clarified their requirements in their March 27, 2020 communication. In short:
FAQ: Can the upcoming audit be conducted remotely by using webconference tools or similar?
Answer: The IATF does currently not allow any remote auditing. Instead… waivers for extending certificate expiration dates and additional flexibility for postponing audits were approved.
My Experience
In 2013, to placate an audit-phobic quality manager, I agreed to “experiment” with a remote internal audit. The manager requested this approach as a means to save time and money, music to the ears of upper management eager to reduce overhead for “non-value added activity.”
I chose a site that would be of the least risk and provide the best cost savings: a small remote engineering design center in the UK. Their past audit performance was excellent and avoiding the international travel cost would be material. Just as important, they were eager to participate in a new approach.
The goal was to achieve the same or similar audit coverage of all processes active at the site, with one exception: we could not perform an adequate audit of the small engineering lab at the site. We could review all the lab records, including equipment calibrations, work procedures, ESD and Safety compliance, and training records but observing adherence to procedures was not possible. With the agreement to cover the lab in a future on-site audit, we proceed to conduct the audit.
Normally, the on-site certification audit would last one day. Our policy for internal audits was usually to exceed this time, but the site had performed so well over the past several years that we had reduced the internal audit time down to the same as the external certification time.
The first realization came in scheduling the on-line conference time. No one could imagine an 8 hour conference call, particularly considering time zone differences with the US. The agreement was to limit the face time portion to 4 hours.
To adequately cover the equivalent of 8 hours of on-site auditing in 4 hours on-line, a weeks before the on-line conference, I randomly picked several design projects and requested records to show compliance to their defined procedures. The site had until the next day to provide the records, which they did with no problem. Reviewing the records raised questions that formed an email exchange that, due to time zone differences took the entire week to completely address. The total time spent: ~12 hours on each side.
The on-line conference covered the management process, HR and Training, and follow up interviews with those engineers working on projects that were reviewed the prior week. The result of the on-line conference call generated actions for follow up. It took another week of document and email exchange before all the questions and follow up details were addressed. The total time spent that week: ~12 hours on each side.
The summary report to management concluded that a one day on-site internal audit, with the exceptions noted for the lab could be performed effectively with a total audit time increase of 350% (28 vs 8 hours) and a man hour increase of 233% (56 vs 24hrs). A more important conclusion drawn was that the use of remote audits could not be effectively scaled to larger sites with more unique processes and could not be considered for any manufacturing sites.
Despite this disappointing conclusion, the audit-phobic quality manager pushed for more use of remote audits, including audits of a large (1000+ employee) software and hardware design center in India. As anyone who has attempted an hours long conference call with video link with India can attest, the effort was (being diplomatic) deeply dissatisfying.
The most important finding from the experiment was never communicated to upper management: both sites expressed their strong desire to go back to on-site audits.
References:
https://www.iaf.nu/upFiles/IAF%20MD4%20Issue%202%2003072018.pdf
https://www.journalofaccountancy.com/news/2020/mar/remote-auditing-during-coronavirus-pandemic.html
Principle Consultant @ Curtis Watson Consulting
4 年You are retired right?