by Andy Hofmann
There is little doubt that management system audits have changed since the halcyon days in the late 1980s when our business started. Since then we have gone through several economic cycles that have had significant effect on the organizations we audit. Technological advancements have allowed robots do the work formally done by people. We are now in an era where we can communicate virtually instantaneously almost anywhere on earth. Accordingly, audit methods have also changed.
ISO 19011 provides official guidance from the International Organization for Standardization (ISO) on the subject of auditing management systems. Updated in 2011, ISO 19011 now includes information on the use of remote auditing techniques. Recognizing that it’s now possible to conduct an interview without physically being in the same location as the interviewee, the standard addresses the use of interactive technology for interviews, document review, and checklist completion.
However, to this point the organizations accrediting certification bodies have not decided how much of the required audit time can be delivered remotely. Will a certification body (CB) be permitted to conduct an entire surveillance audit without visiting the location? Will the amount of onsite time be reduced by some percentage in recognition of the hours spent offsite engaged in virtual work? The accreditation bodies’ (ABs) interpretation of these requirements is a key pacing item, and, as yet, still unknown.
In the meantime, we have a familiar situation. Auditors are engaged by CBs to perform audits for which they are qualified. For any particular engagement, an auditor must possess the combined technical and standards knowledge relative to the business being audited. When the client and the appropriately qualified auditor are located in the same geographic area, this arrangement is perfect. However, from looking at how much auditors travel we can see that this perfection seldom happens.
Remote auditing aerospace manufacturers
Consider an audit of a company that makes carbon composite parts for the aerospace industry. The company’s customer requires certification in accordance with AS9100C. Given the combination of special technology and the aerospace standard, the nearest qualified auditor may be half a continent away.
Adding to this complexity, our aerospace composite manufacturer doesn’t operate from a single facility. To cover customer opportunities, it has 15 different locations in North and South America, Europe, and Asia, so choosing auditors now will require a screen of language capabilities.
The complexity doesn’t end there. The aerospace client had a major nonconformity issued against the lack of design procedures in one of its Asian locations during its last audit. The location had explained to the local auditor that design was a corporate responsibility. All the procedures and personnel involved in design were located in the Washington head office. Although the auditor could see the linkages to the design outputs and manufacturability, he was shocked to find that the design procedure had not been translated into the local language. He ruled that was a major nonconformity and generated his report accordingly.
In aerospace audits, all nonconformities are registered in OASIS, a database visible to the customers of each entity audited. When the major nonconformity was registered in the OASIS database, the head office was inundated with phone calls from customers that were threatening to move their business elsewhere and not to place new orders until the nonconformity (NC) was resolved. This single NC caused hundreds of thousands of dollars in lost business and productivity.
After this audit, corporate decided that it would require its CB to ensure audit consistency. It required the CB to provide a certification project manager who would ensure each auditor around the world understood its business. In addition, it insisted that this project manager be present for each and every audit, no matter where in the world it was taking place. Although this involved higher travel costs, these were insignificant in comparison with the result of the major nonconformity.
This is the nub of the situation we as auditors can find ourselves in. Suppose you are this project manager. Looking at the sites and their size, you quickly realize that your calendar must now accommodate an additional 45 to 60 days a year on the road. You have to deal in seven different languages and time zones that span the globe. And that is if you can find a suitably qualified auditor in each audit location to work with. If none can be found, your personal audit time will increase in each location to accommodate translation.
This project manager needs a strategy to convince the client that audit consistency can take place without his or her physical presence. Easy to say, hard to do given that the project manager wasn’t even sure that he or she could find the right combination of technical and language skills necessary in each part of the world. Let’s look at this scenario and see how it was managed.
First, the project manager determined that the following languages were required:
- English
- German
- French
- Spanish
- Portuguese
- Chinese
- Japanese
The project manager who was hired knew two languages: English and Portuguese. If necessary, she could operate in Spanish but would have more difficulty and thus add time to the time per audit. Of the 15 locations, ten were large enough to need at least two auditors. The project manager had to find auditors in the following countries:
- Australia
- Japan
- China
- France
- Germany
- Ireland
- Canada
- United States
- Brazil
- Mexico
In the past, the project manager would simply call the international desk of her CB and have someone there suggest qualified auditors closest to the cities in each country she needed people. However, that’s exactly how the scenario with the major NC originated: Too much dependence on the database of qualified people and not enough assessment of who the team members actually are.
She decided to take a two-fold strategy. She would involve the international desk to identify existing internal resources with the required technical and language skills. But she needed a backup plan if this did not produce acceptable candidates.
She decided to see what she could find out from the international bodies that certify auditors. She found that there were online databases available to her organized by country and qualification. She found additional resources were available in each of the above countries with valid auditor credentials. She added these resources to the list provided by her CB’s international desk.
She then reached out to each of the auditors in e-mails. She introduced the project and told them where and what each auditor would have to assess. She asked for each person on her list to get back to her with interest and to list what in their backgrounds would qualify them to audit on this engagement. Of the 25 auditors she reached out to, there was the following distribution of responsiveness:
- Eight replied within eight hours
- Six more within 24 hours
- Six more within 48 hours
- Five not at all
Given the time zones involved, she was impressed with the 14 that responded within the first day. All but four of these responded with all the information she had asked for. When reminded to submit relevant credentials, two of the remaining four candidates sent them and two did not respond any further.
Our project manager reflected on something her father had once told her. The person you first meet is the best that person will be. Expecting someone to improve on a characteristic afterward is folly. Our project manager and her client required timeliness so she went forward with the 12 responsive candidates to the next stage.
The project manager organized an online meeting for the potential candidates. She set it up so that everyone would be inconvenienced a little bit with the time of the meeting. She found that the best time to get everyone online was ten in the morning in her time zone. In China, this was ten in the evening. In Europe it was 4 p.m. In Perth, Australia it was ten in the evening. In Oregon, it was 7 a.m. All 12 auditors accepted the meeting invitation.
When the time for the meeting arrived, the project manager was online 15 minutes early. She noted the time at which people chimed in. Of the 12, five were online prior to the appointed time, three more right at the appointed time, and two within a minute after the appointed time. The last two had difficulty joining the conference and held things up while they involved the project manager in the resolution of their technical issues.
The project manager presented on the following subjects:
- Audit planning
- Company history, structure, and technology
- Audit questions and trails
- Nonconformance writing and classification
- Audit reporting
At the conclusion of the presentation, the project manager asked the potential team members to take a quiz. The materials she presented were e-mailed to the participants at the conclusion of the presentation. The quiz would be open for the next 48 hours. Of course, there were a few problems. Of the 12 candidates online that day, the following distribution took place:
- Five took the quiz within 24 hours and passed
- Three took the quiz within 48 hours and passed
- Four did not take or pass the quiz
Our project manager concluded her assessment and asked the eight successful candidates to join her team. She forwarded the contract details and asked for signed responses within five days. Half of the auditors had questions on the terms and conditions that were answered to their satisfaction. All signed the agreements within the requested time.
If it sounds like our project manager had performed a remote job interview, she had. She got to know each of the resources over the course of the process and assessed how they thought and responded to her. She tested their ability to work in English and the speed at which they understood the business to be audited. She did all of this without personally meeting any of the resources.
When it came time to audit with each of these individuals, she found that they worked well in a team. They were knowledgeable in the standard as well as the industry and the client enjoyed having them participate. As the project progressed, most of the team members indicated that her approach was refreshing. She provided the coordination that is so often missing in an international audit. Of the eight audit team members, six remained with the project three years in.
Our project manager reflected on an important discovery. Much of the substance of each audit could be conducted offsite. She and her team were able to collect the following evidence without going onsite:
- Management review
- Objectives and targets
- Customer scorecards
- Internal metrics and performance
- Internal nonconformances and corrective actions
- Interviews with key process owners and stakeholders
About the only thing she wasn’t able to do was to watch production steps occurring in person. Reflecting back on the new requirements of ISO 19011, we probably have an answer to how much onsite auditing time can be reduced. One needs only the amount of time to view production areas related to the most significant internal and external failures that occurred over the audit period. Usually, this will be a small fraction of the total audit time: 30 percent or less. With a well-qualified local audit team, it would require virtually zero travel by the project manager.
So what have we discovered during this discussion? Preparation for international audits begins with a thorough understanding of the activities of the client in its various locations. Based on these activities, the careful selection of qualified team members is crucial to success. Finally, the technology that exists today to permit rapid and frequent international communication must be employed to its limits. Then you too can be like our project manager and retain satisfied clients around the world.
About the author
Andy Hofmann has been involved with management systems for more than 30 years. He has audited more than 2,500 systems, giving him a unique opportunity view of organizations that are performing well and those that struggle. A regular contributor to American Society for Quality management systems conferences and publications, Hofmann’s intellectual property has received wide acceptance. Currently the president of ICS Certification Services, Hofmann continues to work with management systems professionals throughout North America. He has an MBA from the University of Toronto and is a Certified Engineering Technologist.