Every company going through quality audits always wishes for a good result. In reality, all companies get findings, regardless of their maturity, and these findings come up every year, no matter which industry or auditor is involved. Identifying the weaknesses of the process is one of the most effective actions a quality department can take. The purpose of the quality management system is to ensure consistency, customer satisfaction, and improvement in the long run. But every time the auditors check the QMS on the compliance with ISO 9001 requirements, they identify the problem not in the structure of the system but in its implementation.
What Do Audit Findings Really Mean?
The finding does not usually mean there is no QMS in place. What it means is that there is a discrepancy between what is supposed to be done according to the QMS and what is really going on in the workplace, office or supplier site. Auditors take samples from what goes on, and if the sample does not meet the process documented in the quality management system, a non-conformity is noted. There are generally three levels of findings: major non-conformity, minor non-conformity and observation. In the first case there seems to be a systemic problem or missing requirement. The second level of finding indicates an individual violation of something. Observations indicate potential non-conformities. These patterns emerge among all types of findings.
- Problems with Documents and Records Management
Document control is probably the most frequent area for audit findings. Auditors frequently discover outdated procedures being distributed, uncontrolled copies posted at the work stations, lack of signatures or revisions indicated. Control of documentation brings forth the same issues. Forms remain empty or are filled out retroactively, documentation is inconsistently filed, and retention is either non-existent or disregarded. The main reason behind this issue is often a lack of ownership. Documents may be developed enthusiastically but never assigned to a custodian who would periodically review them.
- Poor Implementation of Corrective and Preventive Actions (CAPA)- Issues associated with weak implementation of CAPA can be identified in almost any audit cycle. Companies perform well when it comes to addressing the issue. However, they fail miserably at identifying its root causes. Root cause analysis is often insufficient with the answer being simply operator error or lack of training. One can also come across unverified corrective measures, overdue actions which have not been escalated, and a problem that recurs due to the previous corrective action having been ineffective as it had targeted only symptoms of the actual issue. Such a CAPA is the most obvious example of a company’s inability to learn from its mistakes.
- Poor Internal Audit Programs- The purpose of the internal audit program is to discover any issues before an external auditor, yet this itself is a very common gap. The usual gaps include missing audits of high-risk processes, lack of independent auditors, lack of trained auditors, and checklists which check on document compliance not process compliance. Another common issue is the scheduling of audits. This is not adhered to and audits fail due to the workload, so the program covers only a part of the system during the schedule period. When the internal audit program is a formality, it will result in few findings and this in turn acts as a gap itself for the external auditor.
- Lack of Management Review- Management involvement at the top level is one of the mandatory elements of QMS. Management reviews take place irregularly or are in the form of slide presentations without discussions and decisions made. The auditor must see that consideration has taken place of all required inputs. The audit result, customer comments, performance of the process, the state of any corrective action, and the impact of any change to the system. The outputs include decisions about resources and improvement opportunities. Where the minutes do not show any decision being made, the review cannot be deemed effective.
- Training and Competence Issues- Audits typically discover instances where people have been performing their jobs without proof of competence. This might be due to lack of training record, out-of-date training, or simply induction only. In other cases, training might have been performed but never followed up with an assessment of its effectiveness. Competence is more than going on a course. It requires appropriate education, skills, and experience. It is very common to find that organizations are making changes to their processes and introducing new equipment without following up with additional training.
- Supplier and Outsourcing Process Management- Organizations rely majorly on outside suppliers. However, supplier management programs are often not developed. Typical examples of findings in this area include out-of-date approved supplier lists, lacking criteria for assessing performance, and performance records of the suppliers. Some firms are unable to state the expectations that they have from their suppliers in their purchasing documents and may also fail to check their purchased products properly. Outsource activities present the greatest danger since the company is responsible for the conformity even when it does not manage the process directly.
- Risk-Based Approach That Exists Only in Theory- Current standards require organizations to identify risks and opportunities and to take actions to mitigate them. It is typical of audit engagements to have a risk register compiled for the purpose of certification and not maintained afterward. The risks are stated in a generic fashion, no owners are identified, and there is no link of this risk register to real decisions. Risk-based thinking must impact planning and design of processes and allocation of resources. When an auditor asks how some particular risk affected a recent decision, and nobody knows the answer, this becomes a finding.
- Problems with Monitoring, Measuring and Calibration- Outdated measuring equipment that is out of calibration or does not have traceability to national standards is one of the standard findings in manufacturing and laboratory environments. Aside from measuring equipment, organizations usually lack quality objectives and metrics. Quality objectives that are not measurable (such as to improve quality) or not subject to review cannot help in achieving quality improvements. An auditor expects to see measurements and use of data.
How to Close These Gaps Before the Next Audit?
All recurring issues have several things in common. There is no clear owner, there is not enough managerial focus and they rely on people rather than procedures. The solution lies in the allocation of an owner for each procedure, set of documents and quality objective, so everything will have its owner. With all those owners being defined, there will be no more issues getting lost in between departments, plus any query from an auditor will come directly to its responsible person.
The next step would be to deal with internal audits. They require a risk-based audit approach which focuses on areas with significant impacts and training of internal auditors in how to conduct interviews and collect evidence, so they could prove the functionality of processes and not just the existence of the appropriate documents. Root cause analysis needs to become more systematic and include tools such as the 5 Whys or fishbone diagram analysis. Always make sure to check whether the corrective actions were effective before closing them.
Conclusion
Audit findings may not be comfortable, but they are one of the most constructive types of feedback that a company can get. The areas where nonconformities usually occur are well-known as document control, CAPA, internal audit, management review, competence, supplier control, risk management, and measurement. The fact that these are always the same areas indicates that they are predictable. The key elements here are ownership, proper action following, and involvement of the company’s leadership in solving these problems. The aim is not only to have good audit results but to create a quality system in place.
