.png)
In this blog we are going to learn about strategies for auditing a process that is not defined - where there is no simple defined procedure or work instruction for us to follow to the point where we can develop an audit check list that we can use during that type of audit.
If we look at the ISO Standards for our management system processes, they mandate some mandatory documentation such as having a defined policy and objectives, but not all of our system procedures have to be documented. Similarly, at an operational level, organisations have a choice about whether they document their operational procedures.
Process Is Defined:
Let’s come back to an example we used in a previous blog, auditing chemical storage of a business.
For chemical storage processes, there will be a work instruction, safe operating procedures and whatever it might be that spells out the methods (step 1 – the teams do this, then moving on to the other steps). If this is the case, then this will be reasonably easy to audit against.
This is saying ‘here’s what’s required’ now you can gather evidence against all the steps.
Process Is NOT Defined:
ISO don’t mandate that you have to define everything, and therefore there can be situations where auditors need to explore how to audit something that is not neatly defined for them.
Using the chemical storage example...
Step 1 - Planning and Preparation:
You will have to do a little bit more planning and preparation for the audit. In particular, you need to go and interview people who are involved in that process. This may mean first carrying out an audit of the responsible manager (R.M), to find out where the chemicals are stored.
If you then find out at they are stored in the warehouse, you need to find the warehouse manager as one of the people to interview.
Essentially, you are interviewing that person to say, “When chemicals are received what are the steps involved in putting them away and storage?”
You are trying to build up an understanding of what’s required at steps 1, 2, 3, 4, 5 and beyond.
Based on the interview, you can note down what the RM said at each step.
Step 2 - Interview more than 1 person
An important consideration is you need to interview more than one person prior to the audit. If you can, interview at least 2 people that are involved in the process.
You should interview that second person when the batch of chemicals is received to find out what the steps are in storing and putting the chemicals away.
It may even be beneficial to audit a third person to determine if what has been said from each of them is similar to what the RM told you. If the answers are roughly the same, that is great – you now have a bit of an audit checklist. There’s consistency in the process and you can start auditing against it.
An important thing to understand is even though ISO may not mandate an operational process being documented under the operational control requirements, you still need to deliver that process consistently and effectively. By interviewing different people, you can see if there a level of consistency.
Answers are not consistent?
Personally, if interviewee number 2 and 3 all give wildly different versions of what happens when they receive a batch of chemicals, I would go and speak to the RM and advise them that you are getting told there are different methods and different steps in the process as to how you store chemicals.
As a team, they really need to work through and resolve that by looking at why there are differences and see if any further training is required. But essentially, I would park the audit and say you are a team and you need to work through that, and I’ll come back an audit you in 3 or 6 months.
As we gain more experience as auditors, we do have some other options. You could pull out the regulation for storing chemicals in the workplace and use some of that as the basis for the audit. Even within the management system, with a management review process that’s not defined, you could also audit against the related clause in the standard as well.
Personally, I do not continue the audit if I am getting highly different accounts of what is happening and how it is meant to be happening.
RESOURCE:
Download the ‘Internal Audit Training – Simple’ Document template from our Resources Page under the training section at the bottom of the page.
OTHER AUDITING BLOGS: