CLOSE
logo text
Tags Posts tagged with "audit"

audit

by -
ISO Terms Explained - ISOUpdate.com

To the novice quality manager, ISO jargon can be extremely overwhelming. What is an NCR? What do you mean by OFI? Are we certified or accredited? But before you go and pull out your hair, let’s take a moment to go over some of the most frequently used terms and their definitions with regards to ISO and Management System Certification.

Are you Accredited, Certified or Registered to an ISO Standard?

First things first. You are not certified to an ISO Standard, your company’s management system is certified. Individuals cannot be certified to an ISO Standard. However, individuals can receive training to become auditors to audit companies against an ISO Standard. For example, you may seek training and personnel certification to become an ISO 27001 Lead Auditor. You cannot be certified to ISO 27001.

The terms ‘’accreditation’’ “registration” and ‘’certification’’ are sometimes used interchangeably, but they don’t share the same meanings, technically.

CERTIFICATION:

An organization is considered certified to an ISO Standard if they have developed and maintained a compliant management system that has been audited by a third-party auditor from an accredited Certification Body (CB). To maintain certification, the organization will undergo annual audits from the CB to verify continuing compliance to the specific standard. A certification document or a certificate will be issued as an attestation of conformity of an organization’s management system to a specific management system standard or other normative requirements. Certification can be revoked if regular audits are not conducted, or if your management system persistently or seriously fails to meet certification requirements.

ACCREDITATION:

Accreditation is how an authoritative body provides formal recognition that an organization is competent to carry out specific tasks. Accreditation Bodies (AB) accredit Certification Bodies (CB) that demonstrate competence to audit and certify organizations conforming with management system standards. The accreditation process ensures impartiality and competence and fosters confidence and acceptance of the CB’s certifications by public and private sector end users. Accreditation provides assurance to customers that CB’s operate according to internationally accepted criteria.

REGISTRATION:

Registration is another term for Certification. The terms Registration and Registrar are not used much anymore in this industry and Certification is now the preferred term.

Audits, Auditing & Auditors

Auditing:

Auditing is the systematic process of collecting and evaluating information about an organization’s management system to determine their level of compliance with the standard they are being audited against.

Types of Auditors

Consultants:

Management system consultants provide organizations with specific advice, instructions or solutions towards the development, implementation, and maintenance of a management system. They may also prepare or produce manuals or procedures for the management system.

Internal Auditors:

An internal auditor is a company employee who independently and objectively evaluates the operations of an organization’s management system. Internal auditors perform internal assessments of the organization and prepare reports for management.

Note: Internal audits are required by ISO management system standards but cannot be used to grant certification to an organization.

Third-Party or External Auditors:

Individual(s) who conducts the audit(s) on behalf of the certification body. Unlike a consultant or internal auditor, third-party auditors are impartial. Their job is to collect and evaluate objective evidence to determine if the management system complies with the ISO Standard. Based on these findings, the CB will make a recommendation for certification.

Certification Body:

A Certification Body (CB) is an accredited third-party organization that audits and issues certificates to companies seeking certification to various ISO Standards. CB’s obtain accreditation to be able to certify to a specific ISO Standard(s). CB’s are audited by Accreditation Bodies (AB) to ensure impartiality and conformity of their work and processes.

Accreditation Body:

An Accreditation Body (AB) is an organization that provides accreditation services. AB’s provide formal, third party recognition that a Certification Body is competent to issue certification to specific ISO Standards.

The ISO Lingo – Commonly Used Term & Definitions:

The following Terms & Definitions are from ISO/IEC 17021-1

Certified Client

organization whose management system has been certified

Impartiality

presence of objectivity ; freedom from conflict of interest / bias

Note 1 to entry: Objectivity means that conflicts of interest do not exist, or are resolved so as not to adversely influence subsequent activities of the certification body.

Client

organization whose management system is being audited for certification purposes

Auditor

person who conducts an audit

Competence

ability to apply knowledge and skills to achieve intended results

Guide

person appointed by the client to assist the audit team

Observer

person who accompanies the audit team but does not audit

Technical Area

area characterized by commonalities of processes relevant to a specific type of management system and

its intended results.

Note: The term “technical area” is applied differently depending on the management system standard being considered. For any management system, the term is related to products, processes and services in the context of the scope of the management system standard. The technical area can be defined by a specific certification scheme or can be determined by the certification body. It is used to cover a number of other terms such as “scopes”, “categories”, “sectors”, etc., which are traditionally used in different management system disciplines.

Nonconformity (NCR)

non-fulfilment of a requirement

Major Nonconformity (Major NCR)

a nonconformity that affects the capability of the management system to achieve the intended results.

Note: Nonconformities could be classified as major in the following circumstances:

  • if there is a significant doubt that effective process control is in place, or that products or services will meet specified requirements;
  • a number of minor nonconformities associated with the same requirement or issue could demonstrate a systemic failure and thus constitute a major nonconformity.

Minor Nonconformity (Minor NCR)

a nonconformity that does not affect the capability of the management system to achieve the intended results.

Technical Expert

person who provides specific knowledge or expertise to the audit team. Specific knowledge or expertise is that which relates to the organization, the process or activity to be audited.

Certification Scheme

conformity assessment system related to management systems to which the same specified requirements, specific rules and procedures apply

Audit Time

time needed to plan and accomplish a complete and effective audit of the client organization’s management system

Duration of management system certification audits (Audit Duration)

part of audit time spent conducting audit activities from the opening meeting to the closing meeting, inclusive.

Audit activities normally include:

  • conducting the opening meeting;
  • performing document review while conducting the audit;
  • communicating during the audit;
  • assigning roles and responsibilities of guides and observers;
  • collecting and verifying information;
  • generating audit findings;
  • preparing audit conclusions;
  • conducting the closing meeting.

Opportunity for Improvement (OFI)

Situations where the evidence presented indicates a requirement has been effectively implemented, but based on auditor experience and knowledge, additional effectiveness or robustness might be possible with a modified approach.

by -
Big Data in Auditing - ISOUpdate.com

Written by: Ken Lynch of Reciprocity Labs

Behind any pile of data is a story. Ideally, the data provides a well-outlined plot of the strengths, weaknesses, risks, and opportunities that your business faces. Unless your business can analyze this data, the story it tells remains hidden behind facts and figures.

Lucky for modern-day businesses, the conventional approach for auditing and data analytics has provided a baseline for firms to leverage the power of big data. Using these strategies, organizations can predict market patterns, investment opportunities, and business risks- all which influence the decision-making process.

Sadly, the precision at which these conventional strategies can predict the future isn’t enough. The good thing is that big data looks to fill the gaps that conventional approaches have, and revolutionize the entire auditing and analytics industry. As long as you can leverage big data, auditing for clients will be a walk in the park.

Read on to learn about the opportunities that big data presents your business and common challenges to its adoption:

The Perks Of Big Data

1.   Enhanced Audit Quality

Conventionally, auditors had to sample their client’s data to come up with useful insights. Though sampling has been effective for some time, it doesn’t provide enough precision. You typically have to ignore data anomalies a well as outliers, which can often help identify risks before they occur. Big data analytics systems will help you to analyze a wider scope of data, if not all the necessary data, to come up with more precise conclusions.

Also, it will allow you to analyze your client’s data early in the auditing process, making it easy to streamline the rest of the process. You can pick metrics for analysis early, identify problems, and know the kind of audit evidence to look for.

2.   Improving The Auditing Frequency

Other than being costly, data analysis can be quite time-consuming, especially if you lack the necessary analytics tools. This is why firms choose to analyze their data after every fiscal quarter or year- even though they know that frequent analysis will yield better results. Luckily big data streamlines the data analytics process, reducing auditing lead times.

As a result, businesses can enjoy more audits at a reduced cost. Not only does this continuous testing revolutionize risk identification, but it also paves the way for accurate control assessments as well as timely insights.

3.   Improved Client Service

As outlined above, big data helps shorten the auditing process as well as improve the results. Such factors can be quite helpful in the decision-making process by clients. Even better, this new approach to data analytics ensures that you can communicate time-sensitive threats and opportunities early enough, making the role of auditors in the business growth scene even more appreciated.

How Big Data Is Transforming The Audit

Auditors work in the interest of all stakeholders. They help with the quality assurance of businesses, from a financial to a security standpoint. They deliver insights that improve reporting, identify business risks, and even offer insights on tailored fields.

While conventional technology had played a significant role in supporting the task of the auditor, it limited their power. With big data and developments in the analytics field, everything changes for you as an auditor. You can now focus on an entire population of audit-relevant data instead of trying to fixate your judgment on a mere sample. It even allows you to tailor your auditing journey to deliver the right results.  

Algorithms For Data Analysis Make Big Data Even More Useful

Present-day auditing applications that are based on big data are designed with a series of algorithms. This provides a platform for both running checks for completeness and formatting analysis. At the very least, such algorithms help to streamlines a formerly manual process.

The applications will offer you, as an auditor, a dashboard-based information pool from which you can draw conclusions. It also becomes easy to check for anomalies and outliers, as well as pay attention to any red flags early. By combining them with the traditional approach to analysis and auditing, the extent to which such algorithms can change the business world is huge.

Auditors And Analysts Can Shift Their Focus Towards Risks

Ideally, data collection, processing, and checking are one of the most time-consuming tasks for auditors. These algorithms help reduce the role that you can play in the initial stages of data collection as well as the processing and checking the data. As the application does it all for you, you can shift your focus on the intricate details of auditing.

This allows for better performance benchmarking and the use of resources. The biggest benefit is that auditing and analysis oversight is enhanced. However, it will be essential to train people on the skills needed to use big data and related tools in auditing and analytics.

Threats To The Integration Of Big Data

There is a reason why big data hasn’t yet gained enough traction in the auditing field. The threats that slow down its integration are many, but they aren’t insurmountable. Here are some of them:

1.   Barriers To Capturing Company Data

As long as you can access client data, it can be pretty easy to use big data analytics in the auditing process. You could draw conclusions and even identify threats in a fraction of the time it would have taken you to do so if you were using conventional means. However, the fact that you have to access company data brings in the form of complexity.

Businesses spend years layering security tools to reduce the data security risks their data faces. To gain access to this data, auditors have to rely on a time-consuming approval process, with some businesses being reluctant in providing the data completely. Instead, they claim that they will be putting their data at risk, which is understandable.

2.   Data Extraction Isn’t An Auditing Competency

Businesses typically use a number of accounting systems to achieve their accounting needs. Since data extraction is not a core competency for auditors, and most businesses lack this competency, it adds a layer of complexity.

Ideally, you might have to go through a lot of back and forth between you and the organization you are auditing to capture the necessary data. Without enough insights into how data extraction works, this might seem like an uphill task.  

While conventional audits focused on the general ledger, you will need to obtain information from the sub-ledgers to truly enjoy the benefits of big data. Sadly, this also increases the complexity of integrating big data into auditing.

3.   Finding The Balance Between Auditor Judgment And Analytics

It is pretty easy to use descriptive analytics to pinpoint threats and opportunities that lie in the shadows. For instance, if a situation of fraud has been plaguing a business, you can easily point it out to your clients. Sadly, it is a little bit tougher to produce audit evidence trying to respond to the identified risks.

Big data mainly relies on the black box nature of analytics, whereby rules and algorithms are needed to transform the collected data into reports and visualizations. Once the data gets to this stage, auditors need to find a balance between relying on these analytics and using their judgment to make the necessary conclusions.

4.   Auditor Training Is Yet To Change

As outlined above, big data completely revolutionizes the auditing job. It requires you to have both analytics and IT skills as an auditor. This will allow you to know the kind of questions to ask the collected data and know how to use the analytical output to produce quality audit evidence. Simply put, the new skills make deriving business insights and drawing conclusions pretty easy.

However, the modern-day training for auditors hasn’t yet caught up with the demand for big data. The learning and development programs at the college level are mostly based on the conventional approach to auditing. This means that an auditor that comes from these levels will have a hard time adjusting to the new requirements.

Ideally, getting rid of this problem requires a ground-up approach to auditing training. Learning institutions need to incorporate the necessary big data skills into their training to arm auditors with the right skills.

The Changes That Big Data Brings Along

1.   Auditing And Analytics Standards Have To Adapt

Since time immemorial, the role of auditors has been governed by a specific set of standards. These standards have been governing what you can and cannot do as an auditor. They have control over how you communicate with clients and what tools you can use. However, they limit the use of big data tools in auditing and analytics.

The new tools disrupt data management, workflow management, as well as data interrogation. Without changes in these standards, some of these tools might never be used as effectively as they should be used. Ideally, the regulatory bodies that make such standards need to update them to pave the way for big data and related tools.

2.   Skillsets Need To Change

Ignorance can never be an excuse in the face of disruption. You need to be well versed with the latest analytics skills to remain competitive in the world of big data. Ideally, it starts at the college level. Sadly, a single issue has made it tough for the necessary skillsets in a world run by big data to gain traction.

Having not taught students about the recent developments in the different fields, learning institutions choose not to test such areas. On the other and, students fail to study those specific areas since they know they won’t be tested. The good thing is that institutions are slowly updating their courses to incorporate ad hoc changes, and online platforms are offering courses that can help arm you with these skills.

Regardless of whether you are working or a student, you need to access courses that can help you sharpen your skills for a world centered on big data. While training on the job is possible, go beyond this. The only way to be effectively competitive is to immerse yourself in the most recent developments. The good thing is that this will be straightforward as long as you have the conventional auditing practices as your baseline.

3.   Audits And Analysis Need To Dig Deeper

Big data provides more insights than before. It allows auditors to dig deeper into their client’s data environments and identify anomalies and risks that they previously couldn’t. Even better, it makes it easy to turn analytics and audits into a continuous process, offering businesses real-time insights throughout the year.

As an auditor, you need to have the necessary applications and tools to achieve both of these improvements. You should also change the way you describe your offering to clients to ensure that they understand that audit and analytics quality is better than before.

4.   Security Needs To Be Improved

Big data uses both structured and unstructured data to come up with business insights. Some of this data can range from communications with clients to financial data. The bad thing is that there is a looming threat of this data falling in the hands of cybercriminals. If this happens, not only could be the future of businesses in jeopardy, but their relationships with their clients and other stakeholders could also be at risk.

Ideally, businesses need to invest in security tools that fit right into their data environments without making big data analytics tough. On the other hand, you- as an auditor- should assess the tools you use for auditing with a lot of criticism. The last thing any auditor wants is to compromise the security of their client’s data when doing their job. This is why training in the latest developments in a world run by big data is essential.

Big data promises a lot of opportunities in the world of audits and analytics- from increasing analytics efficiency to improving the decision-making process. As long as the challenges behind the adoption of big data in analytics and auditing are eliminated, it will be much easier for businesses to grow and tackle risks. Be sure to up-skill and keep up with trends in the big data world to take advantage of it.

About the Author

Ken Lynch Reciprocity Labs - ISOUpdate.com

Ken Lynch is an enterprise software startup veteran, who has always been fascinated about what drives workers to work and how to make work more engaging. Ken founded Reciprocity to pursue just that. He has propelled Reciprocity’s success with this mission-based goal of engaging employees with the governance, risk, and compliance goals of their company in order to create more socially minded corporate citizens. Ken earned his BS in Computer Science and Electrical Engineering from MIT.  Learn more at ReciprocityLabs.com.

by -
4 Steps to an Effective Internal Audit

An Internal audit is one of the most important aspects within any management system. It is through audits that gaps, potential problems and possible solutions will be identified in order to maintain and improve the effectiveness of the management system.

However, not all audits add value to the system and in order. Follow these 4 steps to ensure your audits are effective. 

1. Be Planned & Programmed

Your organization needs to carefully determine which processes will be audited – not all systems have to be audited at once or with the same frequency. In order to do this,  consider the results of previous audits, the complexity and risk of its processes and the maturity of each process.

Auditors should consider the natural rhythm of the process being audited, including the synchronization of processes and time and the availability of trained and experienced auditors.

Specific timetables should be elaborated and these must be informed in advance within the organization, detailing which processes are to be audited – and when.

2. Use Competent Auditors

Auditors must be competent, objective and impartial. They must demonstrate comprehensive knowledge of the processes and the standard which they are auditing against.

3. Objective Communication

The findings and their details, i.e., non-conformities, positive areas, and areas for improvement – should be communicated during the audit’s closing meeting to everyone involved. These findings should also be discussed with the auditee during the audit and before recording it.

Information must be communicated in an objective and friendly manner and any suggestions should be informed in a constructive manner.

4. Record & Monitor Results

The results and the corrective actions encountered during the audit must be recorded and monitored in order to ensure that non-conformities are taken care of and improvements are made.

It is also important to establish who will be responsible for monitoring the actions necessary for closing a non-conformity or implementing an improvement.

For an internal audit to be effective, it is essential for this process to be carried out together with auditors and auditees. The planning and programming of internal audits must be consider information given by all involved.

Understand that the purpose of an internal audit is to identify possible weaknesses and areas for improvement in order to ultimately increase the effectiveness of the organization’s processes and its management system in general.



by -
Stage 1 vs Stage 2 Audits - ISOUpdate.com

A Certification Audit is the first step for your organization once you have decided to undergo an assessment process. Your options include undergoing an assessment with a Certification Body (CB), or Registrar, like The Registrar Company, to determine if your management system complies with the requirements of a given standard (ISO 9001, ISO 14001, ISO 45001, etc). This Certification Audit is completed in two stages: Stage 1 and Stage 2. These audits differ in many ways: their purpose, duration, information reviewed, and sometimes even location. Therefore it is important to understand the difference between Stage 1 and Stage 2 Audits, and the effect your selection of CB will have on the process.

These audits differ in many ways: their purpose, duration, information reviewed and sometimes even in the location where it will take place.

The objective of a Stage 1 Audit is to determine an organization’s readiness for their Stage 2 Certification Audit. During the Stage 1, your Certification Body’s auditor will review your management system documented information, evaluate your site-specific conditions, and have discussions with personnel. The auditor will look to see that objectives and key performance indicators, or significant aspects are in place and understood. They will review the scope of the management system and obtain information on your processes and operations, the equipment being used, the levels of control that have been established, as well as any applicable statutory or regulatory requirements. Internal audits and management reviews will be evaluated to ensure they are being planned and performed and the overall level of implementation of your management system will be assessed to determine if your organization is ready to move forward with the Stage 2 Certification Audit.



Your Certification Body will use the Stage 1 Audit to complete Stage 2 Audit planning, including a review of the allocation of resources and details for the next phase of the audit. Documented conclusions will be given to your organization that will outline your readiness as well as identify any areas of concern that could be classified as a nonconformance during the Stage 2 Audit.

A Stage 1 Audit is usually carried out over 1 or 2 days and typically occurs onsite. For organizations with more than 1 location, the audits are usually carried out at your central function location.

The Stage 2 Audit evaluates the implementation and effectiveness of your organization’s management system(s). During the Stage 2 audit, your Certification Body will determine the degree of compliance with the standard’s requirements and report any non-conformances or potential non-conformances that your organization will have to correct before the certification can be issued. If the Stage 2 audit is successful, your organization’s management system(s) will be certified.

The Stage 2 Audit includes:

  • All relevant documented information that evidences your management system’s conformity with all the standard’s requirements;
  • Key performance objectives and targets, looking at performance monitoring, measuring and reporting;
  • Evaluation of internal audits, management review and management responsibility for your organization’s policies;
  • All relevant processes, looking at operational control and the ability to carry them out as planned.

The duration of the Stage 2 Audit is determined in accordance with the relevant IAF Mandatory Documents.  Depending on the size and complexity of the organization this audit can range anywhere from 1 to many days.

Every organization undergoing a certification process should maintain open and clear communication with their Certification Body in order to clarify any questions that may arise before the audits take place. At TRC, customer service is our top priority, with every facet of our organization designed with your satisfaction in mind.

Associating your company with an internationally recognized and trusted certification shows your customers that you hold their satisfaction and expectations above all and adds real value to your bottom line through increased efficiency and reduced risk – and working with the best Certification Body for your unique needs should be top of mind. Certification can be a lengthy process, and you will be working closely with your Certification Body and Auditor for years to come, ensure you pick the best.

 

About the Author

The Registrar CompanyTRC is internationally recognized and trusted. With a large network of auditors, TRC is an international certification body with local benefits. With dedicated Client Service Managers and family-owned and entrepreneurial values, our clients are family. We take the time to understand your business and your unique needs. TRC audits are more than a checklist, we highlight your corporate strengths, and find opportunities for improved processes to ensure you stay competitive and thriving. TRC works with you to ensure minimal disruptions so you receive the highest benefits from the auditing process. Learn about how we can help you today.

Read about The Characteristics of an Excellent Internal Audit



by -
ISO Implementation Process

Preparing for an ISO implementation process of any ISO standard can be overwhelming and stressful for organizations of any size. How an organization prepares for an ISO implementation process will depend on factors such as size and complexity of its processes, the current knowledge and culture related to the standard; i.e., quality, environmental, safety, etc; the maturity of any other existing systems related to the standard wishing to implement, and many others.

6 Tips to Facilitate the ISO Implementation Process

Despite the differences there may be between organizations, there are a few tips that will facilitate the ISO implementation process of any management system.

Know the Standard

It is essential that some personnel knows the management system’s requirements. Everyone does not need to be an expert on the requirements of the specific standard that will be implemented, but key workers need to fully know and understand all of the requirements of the standard.

Keep Everyone Informed

The implementation process is not a task of just a few chosen ones. Everyone needs to be involved in this process. Every worker needs to know what is being implemented, why is it being implemented, which are the benefits for the organization and for themselves, and how they will be involved in the process. When people are informed, they will be more open and willing to collaborate in the implementation.

Analyze the Organization’s Current Situation

Before starting to implement any ISO management system, an organization needs to know its level of compliance with the standard. This will allow the organization to understand beforehand its strengths and weaknesses regarding the ISO management system wishing to implement and estimate the time needed for implementation.

Map Your Processes

Establish and record current processes in order to know the relationships between departments and how the processes flow within the organization. This will allow organizations to plan their implementation by processes and not just by areas and departments.

Review Existing Procedures and Work Instructions

Many processes need written and documented information that will guarantee that activities are carried out in the correct manner. Organizations need to review which processes are documented and how many work instructions there are. It is not the same to develop a few documents and just review work instructions than to develop them from scratch. Organizations need to have an idea of how much time they will have to invest in developing and reviewing documents.

Review Current Training Programs

Evaluate existing training and awareness programs. Training and awareness are an important part in the implementation process and if an organization has not considered training its workers, it would be best to redefine these programs to make sure that a large percentage of workers are trained and informed about policies, procedures, regulations, etc that will be a part of their daily activities.

These are some recommendations that will help your organization prepare for the ISO implementation process of any ISO management system.

Note: Make sure that the whole organization is working for the same objectives and pulling in the same direction.

by -

All management systems require organizations to conduct internal audits in order to obtain information that will evidence the degree to which requirements are being met. In other words, internal audits check practice against policies, processes and procedures and thoroughly document any differences.

Although internal audits are an important tool for organizations to evaluate their management systems and to uncover areas that are in need of attention, for many, this process induces an enormous amount of stress. For audits to serve as a means to identify gaps and effective solutions, it is essential that these are formal, planned and organized. Other key characteristics internal audits should have are:



They are scheduled
Surprise audits are not welcomed by anyone. A schedule should be set and communicated to everyone, preferably at the beginning of the year. There’s no need to audit all processes at once; different processes can be audited at different times throughout the year, organizations just need to make sure that at the end of the year all processes have been audited.

Auditors are competent
Auditors need to demonstrate in-depth knowledge of the standard which they are auditing against and they should have an understanding of the processes being audited. They should be objective and impartial; this means that they can’t audit a process which they manage or control. Large organizations usually have a team of trained auditors, but that is not necessary; an alternative is to hire the services of an external consultant to perform the internal audits.

They are planned
The audit needs to be confirmed with the process owner. At this stage the auditor should review procedures and previous findings or issues related to the audited process. A checklist with a pre-determined list of questions can be sought to be used during the audit; this checklist should be provided to the auditee so they have time to organize any information.

It’s conducted in an objective and friendly manner
An audit should start with an opening meeting with the auditor and the auditee(s). It’s recommended that the auditor works systematically through the checklist or procedure, while reviewing records, observing the process, analyzing process data and talking to employees. During the audit, the auditor must discuss the findings with the auditee before recording it.

Audit findings are recorded
A closing meeting with the auditee is fundamental so information is not delayed. Here the auditor should point out possible weaknesses and areas for improvement. Findings and their details (these include non-conformities, positive areas and improvement areas) need to be recorded and communicated to the auditee(s) and management.

Findings are monitored
The auditor is responsible for ensuring that corrective actions have been taken to fix any problems found during the audit.

If everyone takes advantage of the positive results internal audits can bring, and if these aid organizations to improve their processes and management system- whether is a quality, environmental or any other system- an internal audit can be considered a success.



by -
What is a Pre-Assessment Audit? - ISOUpdate.com

Defining a Pre-Assessment Audit

A pre-assessment audit is one that is performed before a certification/registration audit takes place. This pre-assessment audit determines the degree of conformance of an organization’s management system(s) with the requirements of a standard (e.g. ISO 9001, ISO 14001, ISO 27001, etc.)

After putting the time and effort to implement a management system and before diving into a certification audit, many organizations choose to contracting the services another organization or person to perform a pre-assessment audit. This is a full audit of a management system against the requirements of a specific standard that allows organizations to identify any nonconformities and implemented corrective actions before the certification audit.



About the Pre-Assessment Audit

A pre-assessment audit is performed with the same independence and objectivity as a certification audit. The auditor(s) will conduct activities such as documentation review, process review, interview of process owners, etc, in order to gather the necessary information that evidence compliance.

Audits are performed on-site and are a complete assessment of the management system against the requirements of the relevant standard. As any other audit, all nonconformities and observations found will be presented in an audit report that will be delivered at the end of the process; this report will serve as a baseline for the organization to improve its processes and implement the necessary corrective actions.

Who Needs a Pre-Assessment Audit?

Any organization that has implemented a management system and wishes to determine its readiness to undergo a certification audit can seek a pre-assessment audit.

What are the Benefits of a Pre-Assessment Audit?

Some of the benefits of performing this audit are:

  • Helps organizations identify any non conformities and implement corrective actions.
  • Contributes in the optimal preparation for the certification audit.
  • An organization can focus its resources on weaknesses that might lead to nonconformities.
  • Depending on the outcome, organizations can decide to postpone a certification audit that has already been scheduled or, on the contrary, face the certification audit with a renewed confidence.
  • Helps organizations avoid unnecessary additional costs.

A Pre-Assessment audit can be conducted by qualified consultants, registrars, or competent individuals with experience and knowledge regarding the relevant industry sector and standard. It is important to remember that, just as an organization carefully chooses  a certification body or any other service, it should also take the time to choose the correct organization or person to perform its pre-assessment audits.



Did you find that article helpful? Continue learning about Audits & how to choose the correct organization or person for your Audit.

by -

Management systems such as ISO 9001, ISO 14001 and OHSAS 18001 require that internal audits are scheduled at planned intervals; they do not establish a specific frequency nor do they establish that all processes need to have an annual internal audit. Therefore, organizations must establish a frequency which is right for their business. But how often should you be having internal audits for compliance? Audits can be performed monthly, quarterly, twice a year, or once a year. It is important to understand the criteria which should be considered before defining an internal audit frequency, as not all processes should be considered on the same timeline.



Complexity of the Processes

  • Crucial or high-risk processes should be audited on a more frequent basis, perhaps quarterly or twice a year
  • Low-risk processes can be audited just once a year or every other year

Internal Audit Frequency - How Complex is your Process? - ISOUpdate.com

Maturity of the Processes

  • Well established processes that run efficiently can be audited once a year or every other year
  • Newly developed processes should be audited more frequently, for example, quarterly, until they are stable

Internal Audit Frequency - How Mature is your Process? - ISOUpdate.com

Past Experience

  • Processes that have a history of frequent deficiencies or non-conformities, should be audited on a more frequent basis, such as quarterly or twice a year
  • Processes with troubles achieving targets and objectives should also be audited on a more frequent basis, such as quarterly or twice per year

Internal Audit Frequency - What is your Processes History? - ISOUpdate.com
Other factors that may influence the frequency of auditing:

  • Budget for the execution of internal audits
  • Regulatory or customer requirements

There is no need to audit every process all at once; consider spreading out internal audits throughout the year by auditing different processes at different times. Auditing many processes all at once can be exhausting and process deficiencies or areas for improvement may be overlooked.

Internal Audit Frequency - Establish a Rational Schedule - ISOUpdate.com

 

Although most standards do not require that all processes be audited every year, it is a common practice in many organizations. Some organizations with mature and well-established management systems may wish to schedule their audits over a 3-year time plan instead of annually. Every organization needs to take a close look at each of their processes, their management systems, and other applicable requirements to establish a rational schedule which fits their needs and is right for them.

This article was written by The Registrar Company and published with permission.

by -
How to Prepare for a Successful ISO 9001:2015 Audit - ISOUpdate.com

No matter how many audits someone has gone through, knowing that someone will be auditing your work always generates some tension and anxiety. Here are some recommendations from The Registrar Company, a North American Certification Body with over 20 years of auditing experience, to help your organization prepare for a successful ISO 9001:2015 audit.

Prepare Employees

  • Quality Policy – Review the quality policy, refresh it if needed, and make sure everyone understands it. There is no need for workers to memorize the policy, but they should have a clear understanding of what the organization has committed to in terms of quality.
  • Quality Objectives – Workers should know what the organization’s quality objectives are and how they themselves contribute to achieving them. Employees should know and be able to explain how their day to day activities can influence these objectives.
  • Training – Ensure that everyone has been properly trained to perform their tasks.
  • Documented Information – Make sure everyone knows where to find current copies of procedures, work instructions, and forms that are relevant to their position.
  • Audit Schedule – Let everyone know the scope of the audit, when they will be audited, and what the auditor may be checking in their areas.
  • Interviews – Workers should have the confidence to answer what they know, and have the same confidence to say ‘’I don’t know” when they are not sure how to respond during an audit.

Review Documented Information

  • Make sure document and record listings are up-to-date.
  • Check that all documents have been reviewed, approved, communicated, and followed by everyone involved in the process or activity.
  • Ensure obsolete documents have been removed from circulation and are no longer in use.
  • Verify that all records are being used correctly.

Ensure all Processes are Being Performed Correctly

  • Make sure that all procedures (whether they are documented or not) are being followed.
  • Ensure that critical processes are being performed in the same way (the correct way) by everyone.

Review Corrective Action Process

  • Review the findings from previous audits and make sure they have been addressed.
  • All non-conformities must be properly recorded, investigated, and actions need to be in place or concluded by the time of the audit.
  • Corrective actions that have been executed and closed should also have been verified for effectiveness.

Organize the Workplace

  • It is difficult for quality control and assurance to take place in an untidy, dirty, or unorganized workplace. Take time to organize the workplace (offices, desks, warehouse, workshop floor, etc.).
  • Make sure records, forms, procedures, and any relevant documents are on-hand or easy to access.

Practice Positivity and Professionalism

  • Make a good first impression – treat auditors professionally and with respect.
  • Do not be predisposed. Auditors are not enemies, they are there to establish conformance and to help your organization uncover any weaknesses so that you can take the necessary actions to improve.

The Registrar CompanyTRC is internationally recognized and trusted. With a large network of auditors, TRC is an international certification body with local benefits. With dedicated Client Services Managers and family-owned and entrepreneurial values, our clients are family. We take the time to understand your business and your unique needs. TRC audits are more than a checklist, we highlight your corporate strengths, and find opportunities for improved processes to ensure you stay competitive and thriving. TRC works with you to ensure minimal disruptions so you receive the highest benefits from the auditing process.



by -
Become a Third Party Auditor - ISOUpdate.com

Third party auditors are those who perform an external and independent audit of an organization’s management system to evaluate if it meets the requirements of a specific standard; if successful, this third-party audit will provide the organization with certification or registration of conformity with the given standard.

A third party audit is carried out by a Registrar/Certification Body (CB) hired by the organization; therefore, in order for someone to be a third-party auditor, he/she needs to be employed by a CB.

Find a CB that is hiring in your area by visiting our Career Resources

All CB’s need to ensure that the auditor possesses the knowledge and skills necessary to achieve the intended results of the audits they are expected to perform. Standard interviews are typical.

  • Personal attributes that will enable them to act in accordance with the principles of auditing, which include ethical conduct, fair presentation, due professional care, independence, and free use of an evidence-based approach.
  • Knowledge on the contents of ISO 19011: 2011, Guidelines for auditing management systems.
  • Knowledge and skills on audit principles, procedures and methods, which will enable them to conducted audits in a consistent and systematic manner.
  • They should be able to exhibit professional behavior during the performance of audit activities, including being ethical, open-minded, diplomatic, observant, perceptive, versatile, tenacious, decisive, self-reliant, open to improvement, culturally sensitive, and collaborative.
  • Knowledge and skills on management system and reference documents that will enable them to comprehend the audit scope and apply audit criteria.
  • Sector specific knowledge which will enable them to comprehend the organization’s structure, business, management practices and the legal and contractual requirements applicable to the organization being audited.

As indicated in ISO 19011, someone pursuing to become a third-party auditor can acquired all these knowledge and skills by using a combination of the following:

  • Formal education/training and experience that contribute to the development of knowledge and skills in the management system discipline and sector the auditor intends to audit.
  • Training programs that cover generic auditor knowledge and skills.
  • Experience in a relevant technical, managerial or professional position involving the exercise of judgment, decision making, problem solving and communication with managers, professionals, peers, customers and other interested parties.
  • Audit experience acquired under the supervision of an auditor in the same discipline.

After acquiring all the necessary knowledge and skills and successfully being employed by a CB, third-party auditors must pledged to advocate a particular code of ethical conduct in the performance of an audit and they must abide the internal policies and rules of the CB that hires them. All these requirements must be followed in order to protect everyone involved in the audit process.

Find a CB that is hiring in your area by visiting our Career Resources.



12Next Page 1 of 2
©