The art of demonstrating compliance with a standard
When assessing conformity to the standard, audit checklists may not be sufficient. At the end of an audit, the auditor should be in a position to know whether all requirements of the standard are satisfied or not. Trying to show compliance to a standard often brings auditors back to using checklists, when they check off the requirements of the standard one by one, making sure that all requirements have been covered. This basic approach of filling out a checklist is an easy way to ensure all requirements of the standard have been checked.
However, considering the approach of the ISO 9001:2000, performing an audit from a generic checklist might prevent an auditor from collecting evidence of effective interfacing between processes. Completely moving away from the checklist - or audit question list - might not be possible, particularly if evidence of compliance to the standard needs to be demonstrated to regulators or conformity assessment bodies.
It is important to use a checklist in an appropriate way; for example, as a tool to help keep track of the requirements of the standard to be covered.
What is adequate sampling?
There is no statistical or mathematical formula to establish the right number of samples to be taken during an audit. Defining the number of samples (one, five, or even more samples of records for a particular requirement) to be taken to confirm compliance to the requirements is not efficient and does not ensure compliance. By increasing the number of samples taken, an auditor will have greater confidence regarding the actual status of the implementation of the quality management system. “Adequate” sampling in this context would refer to a level of sampling taken during on-site interviews and record reviews that give sufficient confidence that the system is implemented as described.
Multi-site sampling, or sampling of the organisational units of a company, are covered in Annex II of the IAF’s Guidance on the Application of ISO/IEC Guide 62, along with the required onsite auditor days and sampling formula for multi-sites.
The auditor needs to perform interviews and check records and evidence during the interview. The number of samples to be taken depends on the complexity of the process being audited, and on the quality of information received from the auditee during the interview.
It is important the auditor maintains the schedule outlined in the audit plan. The auditor needs to feel comfortable that the samples and the objective evidence seen are representative in order to draw appropriate conclusions on the quality management system.
Recording audit information
ISO 19011 and the IAF Guidance on the Application of ISO/ IEC Guide 62 explain what an audit report should contain. However, it is important that the audit reports to the auditee only contain important information for the auditee, such as information on possible improvements, positive observations, and non-conformities to the standard. Merely reiterating and explaining the requirements of the standard are unlikely to be what the auditee is looking for.
There may also be a requirement for the auditor to demonstrate the sequence in which the audit was performed, sometimes called the audit trail. Using audit notes is a very efficient way for an auditor to record the audit. The main disadvantage of using audit notes is that they tend to be a very personal way of recording information during an audit, and the levels of recording detail and styles will vary from one auditor to another.
A checklist can ensure some uniformity in the performance of auditors. However, auditors should never forget to spend their time auditing, not filling out checklists or taking notes.