How many hours does your company spend auditing?

In Audit Schedule, Internal Auditing, ISO 13485, Quality Management Systems on May 27, 2011 at 6:01 am

For this week’s video I picked a song played by Stevie Ray Vaughan and Jeff Healey–Look at Little Sister. They are two of the worlds greatest guitar players ever and both died way too soon.

Just in case you can’t connect…here’s another great Jeff Healy performance.

Each week I audit a different company or I teach a group of students how to audit. In the courses I teach, I use a slide that gives an example of an audit schedule (see my example above).

On the surface, this example seems like a good schedule. There are 12 auditors performing two audits each per year. If each auditor spends a day auditing and another day writing the report, the combined resources equal 48 days (~$20,000) allocated to auditing and each person spends less than 2% of their work year auditing.

Unfortunately, I have learned that the quality of auditing is directly related to how much time you spend auditing. Therefore, I recommend using fewer auditors. There is no perfect number, but “less is more”. My example also has another fundamental weakness. The audit schedule does not take full advantage of the process approach. Instead of performing an independent audit of document control and training, these two clauses/procedures should be incorporated into every audit. The same is true of maintenance and calibration. Wherever maintenance and calibration is relevant, these clauses should be investigated as part of auditing that area. For example, when the incoming inspection process is audited it only makes sense to look for evidence of calibration for any devices used to perform measurements in that area. For a second example…when the production area is being audited, it only makes sense to audit maintenance of production equipment too.

If the concept of process auditing is fully implemented, the following clauses can easily be audited in the regular course of reviewing other processes: 4.2.1) Quality System Documentation, 4.2.3) Document Control, 4.2.4) Record Control, 5.3) Quality Policy, 5.4.1) Quality Objectives, 6.2.2) Training, 6.3) Maintenance, 6.4) Work Environment, 7.1) Planning of Product Realization & Risk Management, 7.6) Calibration, 8.2.3) Monitoring & Measurement of Processes, 8.5.2) Corrective Action, and 8.5.3) Preventive Action. This strategy reduces the number of audits needed by more than half.

Another way to embrace the process approach to auditing is to assign auditors to processes that are upstream or downstream in the product realization process from their own area. For example, Manufacturing can audit Customer Service to better understand how customer requirements are confirmed during the order confirmation process. This is an example of auditing upstream, because Manufacturing receives the orders from Customer Service—often indirectly through an MRP system. Using this approach allows someone from manufacturing to identify opportunities for miscommunication between the two departments. If Regulatory Affairs audits the engineering process, this is an example of auditing downstream. Regulatory Affairs is often defining the requirements for the Technical Files and Design History Files that Engineering creates. If someone from Regulatory Affairs audits these processes, the auditor will realize what aspects of technical documentation are poorly understood by Engineering and quickly identify retraining opportunities.

One final aspect of the example audit schedule that I think can be improved is the practice of auditing the same process twice per year. This practice doesn’t seem to work very well for a few reasons. First, it requires that an auditor prepare for an audit twice per year and write two reports instead of one. This doubles the amount of time auditors spend in preparation and follow-up activities associated with an audit. Second, doubling the number of audits naturally shortens the duration of each audit. It is more difficult for auditors to cover all the applicable clauses in a shorter audit, because it takes time to locate records and pursue follow-up trails. Longer audits, covering more clauses, make it easier for the auditor to switch to a different clause while they are waiting for information. Third, if an area is audited every six months, it is often difficult to implement corrective actions and produce evidence of effectiveness before the area is due for auditing again.

It is not possible for me to provide a generic audit schedule that will work for every company or even to show how all the clauses will be addressed in one table. I can, however, provide an example of an improved schedule that illustrates the above concepts. This example (see below) uses four auditors instead of 12, and the number of days planned for each audit is two days instead of one. The preparation and reporting time is still one day per audit, and therefore the combined resources equal 24 days (~$10,000) allocated to auditing and each person spends 2.5 % of their work year auditing. I have provided a copy of this improved plan below. My intention is not to create the perfect plan, but to give audit program managers some new ideas for more efficient utilization of resources. I hope this helps, and please share your own ideas as comments to this posting.

  1. Great concept Rob, I like it. Do you think it would cover the FDA requirements?

    • Thank you so much Cari. I went back and reviewed the QSR and I found something worth sharing in my blog…please see my next posting.

  2. […] his blog, “How many hours does your company spend auditing?” Rob Packard presents an audit schedule based on the process approach to auditing. This blog […]

  3. Verdaderamente lo que has publicado resulta interesante. Si
    bien tengo que reconocer que ciertos post distinto no me pareció
    tan bueno, el de esta vez me ha interesado mucho.


    • Thank you for your comments Veronica. For others that do not speak Spanish, the Google Translation is: Really what you have posted is interesting. if
      While I have to admit that certain other post did not seem so good, this time I was very interested.”

      I appreciate all feedback on my blog postings–compliments and criticisms. If you have specific suggestions for improvement of my postings, please let me know. I also welcome suggestions for blog topics. I have about 100 blog postings between my two websites and the guest postings I have written for others. Not all of the postings are great, but some are popular.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: