Planning for audit success or for the sake of planning?

Under any ISO standards, whether it be ISO 9001:2015 Quality management systems, ISO 14001:2015 Environment management systems, or ISO 45001:2018 Occupational health and safety management systems, Clause 9.2 states that, when planning for their internal audit, organisations must take into consideration the importance of the process concerned, changes affecting the organisation and the results of the previous audit.

The easiest way of looking at this is, of course, to refer to the previous year’s audit programme and repeat the planning process. It saves time and effort in reviewing any modifications to the importance of the processes concerned, other changes that have taken place in the organisation, as well as taking a look at the messy results.

This is where organisations sometimes fail to appreciate how the exercise of conducting an audit gives value-added information, helping the company to remain sustainable and move forward and, most likely, come to an untimely death in terms of relevance to the needs and expectations of worldwide market forces.

Concerned important processes and their impact on quality

The first things to consider are ‘concerned important processes’. What are they? From a quality standpoint, they are the core processes of the organisation. This could mean areas such as business development and marketing, design and development, and transfer, production/project planning, resource management (including the availability of suppliers and contractors), implementation of the production/project (including management of suppliers and contractors), final quality control, and, finally, storage and delivery/handover.

If any of these processes break down, the organisation will not be able to produce what its clients want. Therefore, a concerned important process is classified as important from a quality standpoint.

“If any of these processes suffer a breakdown, the organisation will not be able to produce what their clients want.”

Andy Lau, IRCA Lead Auditor

For example, in environment and occupational health and safety (OH&S), the simplest answer is most likely the correct one. In this case, the results of risk assessments conducted determine those activities, products and services of the organisation that are significant in terms of causing injury and ill health to workers and the public, with the added issue of causing pollution to the environment. Therefore, these are classified as of concerned importance.

The implications of change

Changes? What does not change? Maybe outdated politicians playing musical chairs while pretending to know what they are actually doing seems to be the only thing these days!

To take a recent example that has affected all countries, when Covid-19 became an issue at the beginning of year 2020, nobody was ready for its fallout on people’s day-to-day life. How to deal with this pandemic? Among the many items were: lockdowns; movement control orders; restrictions for the types of industries that were or were not allowed to open; enforcement of wearing face masks; physical distancing; washing of hands; don’t touch your face; if you feel unwell; stay at home and get yourself tested – the list went on and on.

As long as the sun rises in the east, people will go to work. But here in Malaysia, amid Covid restrictions, you had to ask for permission from the relevant authorities just to travel from one district to another. This raises questions: if I cannot get a permit on time, what is going to happen to my attendance at the workplace? Is my employer going to start cutting my salary for not showing up like usual? Is my employer allowed to do that? What if I go to work and get infected? Can I still go home and see my family?

Let’s just say that no-one was ready for these changes and, with uncertainty in the number of positive cases, the rules are constantly changing and have to be monitored on a week-by -week basis. So, with these constant changes taking place, the context of the organisation will now change more regularly. When changes take place, are the workers ready to cope with them, and how will the implementation of these changes impact the integrity of the management system in governing expectations around quality, environment and OH&S?

Results of a previous audit

The final point to consider when planning an audit is the result of the previous audit. For example, when auditing warehouse processes the year before, 10 non-conformities were found and 20 opportunities for improvement. The audit was completed in two hours by one auditor. This year, for the same process in the warehouse, how much time should I spend auditing the warehouse if I am the sole auditor?

So, in conclusion, remember that audits are a means to an end and not the end itself. Completing your company’s yearly cycle of audits is not how we judge success – unless you consider getting the audit out of the way as quickly as possible, so that the external auditor does not raise a non-conformance for you failing to perform your internal audits.

I emphasise that success can come from making the right choices in what you want to improve. Making those right choices comes from having the right information (importance, changes and historical data), and this comes by planning your audits correctly.

As famed American basketball coach John Wooden said: “Don’t mistake activity with achievement.”