Management Systems Audit Tools
October 25, 2018
As a general best practice, an auditor should prepare work documents, or tools, to help plan and guide a process-based audit. An acceptable audit tool used correctly will streamline the audit process, focusing on performance and only the value added factors. While there are no requirements for which audit work document or tools the auditor must use, to be effective the chosen tool should at minimum include the following:
- Process Name and Owner
- Process Activities: list 3-7 of the most important activities done within this process
- Process Limits: What are the inputs and the outputs of this process? Where did the input originate? Where is the output going? (Interaction with other processes)
- Process Control Methods: What are the monitors and measurements used to control the process effectiveness?
- Process Operation Methods: What are the applicable documented procedures and instructions?
- Needed Resources: What are the most important resources needed to perform this process?
- Applicable management system standard requirements: What are the most important requirements that this process shall address? (list three to seven of the most important clauses or sub-clauses with only their numbers and titles)
- Applicable customer, statutory and regulatory requirements associated with the scope of the management system: What are the most important and critical (if they exist)?
Below we’ve outlined two audit tools useful for auditing management systems and processes. Although these tools are not required for conducting an audit, they’re proven to greatly increase value for all parties involved by guiding a thorough, and well-organized audit.
1. Turtle Diagram
The turtle diagram is a tool commonly used by organizations as a proven way to define processes. It is also a useful tool for auditors conducting a management system or process audit. If used correctly in the planning process, the turtle diagram can assist the auditor to do the following:
- Identify relevant sources of risk
- Address performance, highlighting those sources that influence the MEASURE of the process
- Trace WHERE the outputs of the process go, and what INPUTS the process uses
- Perform the audit, using the tool to collect relevant auditor evidence to support findings
- Perform the audit to trace outputs of the process into other areas of the system
The Turtle diagram is the framework for defining the following components of a process:
- Process name: What is the name of the process (normally expressed as an action; suggest using a verb for the name of the process)? Examples might include Marketing, Ordering, Manufacturing, Auditing, Management Review, etc.
- Inputs: What is the customer need that this process will fill? Define this need at the characteristic level. Include any regulatory and statutory requirements. Does the standard specify any requirements as inputs for this process?
- Outputs: Has the customer’s need been met? How will you know that the characteristics required in the input have been achieved? This will help lead to what you measure.
- What: What are the resources for the process (materials, equipment, buildings, hardware/software, etc.)?
- Who (Owners): Who are the individuals applying the resources? Who is the process owner and who are the individuals operating with-in the process? List the Process Owner and some process personnel.
- Who (Supporters): Who are the individuals involved in supporting this process. Refer to the “How” box and link to supporting processes. Examples might include HR, Cleaning staff, Facilities and Equipment Maintenance, IT, etc. (List 2 or 3).
- How (Process Control): How is this process controlled (procedures, sub-processes)? Which processes support this process?
- How (Supporting Processes): What are the supporting processes. Examples might include training, housekeeping, facilities maintenance, equipment maintenance, etc. This will also help with the “Who is involved part” of the “Who” box (List 2 or 3).
- Measures: Which measures are used for analysis of process effectiveness (measures and metrics, use of data)?
Focus on Performance
Once you’ve added a few items in each box of the turtle diagram, you’ll have a general overview of the process. Next you’ll return to the Measurement box and drill down to see how the process is performing. This drill down will take you back to many of the other boxes to investigate records to show the objective evidence of how the process is performing; focusing on Performance. If the performance of the process is good and seems well-defined and working as intended by management, stop drilling down and move to another process that does not seem to have acceptable performance.
2. Process Approach Planning Worksheet
Another recommended tool for process-based auditing is a process approach planning worksheet. The worksheet is designed to assist planning an audit by breaking the audit into practical, concrete audit paths; that is, processes that are linked together, have definable and individual characteristics attributable to processes, and actually exist. Once completed this audit map provides information for planning and conducting an audit, and allows you to decide which parts (processes) of the organization’s QMS you wish to investigate and diagnose.