Secrets of Surviving a Quality Audit

Do you want to know the secret of getting through a quality audit with flying colors? You'll settle for just surviving
one? OK, here's the secret. There isn’t one. It’s really quite simple. If you are prepared, you will do well. If you are
not prepared, you won’t.
TIMING
Getting prepared shouldn’t be a problem, because an ISO9000 audit is never unannounced. The rule is - No
surprise audits. To begin with, the date and time for the audit will be known to the company well in advance.
Moreover, the auditor will give you an idea of the general areas he/she will be examining.
Being prepared for an audit starts with knowing what it is, and how it’s done.
PURPOSE
Quality system audits are performed to get answers to four questions:
1. Is "it" being done?
“It” being all the things you agreed to do in contracts with your customers, all the things you must do because of
rules and regulations that apply to your business and all the things ISO9000 requires you to do.
2. Is it documented?
Have you documented how those things are supposed to be done, with procedures, work instructions, and the
like? These procedures are needed whenever the activity is one that can have an impact on quality. They can
range from simple statements of what must be done to detailed, step-by-step instructions on how to do it. It all
depends on how critical the task is, how qualified the operators are, and how the procedures will be used. For
example, driving a car is an extremely critical activity, but there are no procedures for it. How would you use it?
3. Is it being done the way it’s documented?
Are you following your own procedures, instructions and drawings?
4. Is it effective?
Is the quality system meeting the objectives set by management, and is it making the Quality Policy a reality?
WHAT DOES THE AUDITOR LOOK FOR?

The auditor is trained to look for “objective evidence”, hard facts that can be observed, measured, tested and
verified, to support the answers to those questions.
Many times, these facts will be found in documents or records that you keep, like inspection records, test reports,
records of reviews, etc.  These are called Quality Records and the requirement to create them and keep them will
be found in your procedures.
Other times, objective evidence comes from what the auditor sees. An auditor might watch how a particular activity
is being performed to verify that it is being done the way the procedure says it is.
Lastly, it can come from answers to questions the auditor asks. When an auditor asks about how you perform a
certain activity (without actually seeing you do it), he/she can’t use your answer as objective evidence that the
activity is performed. However, he does use it as objective evidence of whether or not you know how it is supposed
to be performed.

HOW IS AN AUDIT CONDUCTED

Most of the work in an audit takes place behind the scenes. For example, an auditor will find most of the answers to
the first two questions by examining documentation. We tend to see the auditor in action when he/she is out
gathering objective evidence from us. But even then, the auditor spends most of his/her time preparing. What
evidence am I looking for? Where will I look for it? What questions will I ask? Who will I interview, and what do I
need to learn from them?
Auditors are trained to ask “open-ended” questions: questions that cannot be answered with a simple Yes or No,
because they provide much more information. “How do you perform that activity?” results in a lot more information
than “Do you perform that activity?”

IF YOU ARE A SUPERVISOR OR MANAGER

It’s your job to ensure that your people are prepared for the audit. You will be told the purpose and the scope of the
audit, so you will be able to identify all the documented policies, procedures, or work instructions (for simplicity’s
sake, let’s refer to them all as “documents”) that the auditor will be looking to verify.
1. Verify the revision levels/effective dates of the current documents.
2. Completely review official, controlled copies of each document, and identify all of the requirements that apply
to you and your people.
3. Review those requirements with all of the appropriate people in your charge, to ensure they understand them,
and to verify whether or not the documents accurately reflect how the processes are actually performed.
4. Be sure your people have access to the current documents, or at least know where to get them when they are
needed.
5. Be sure that the work area is purged of any superseded, obsolete or uncontrolled documents, except for those
that are clearly marked for historical reference only.
6. If you find differences between what you do. Or, how you do it, and what your  documentation says, bring them
to the attention of the “document owner” - the person responsible for approving the document. Together, you can
decide what has to be changed or modified: the process, the document, or a little of both.
7. If something must change, notify your Management Rep or Internal Audit Leader. If the process must be
corrected to match the documents, the auditor might decide to reschedule the audit to give you time to implement
the new practices, and to build some history. If the document must change to reflect the actual practice, the
auditor will need to have the latest revision.

EACH EMPLOYEE
It’s your job to ensure that you are prepared for the audit. You will be told the purpose and the scope of the audit,
so you will be able to identify all the documented policies, procedures, or work instructions (for simplicity’s sake,
let’s refer to them all as “documents”) that the auditor will be looking to verify.
WHAT DO I DO BEFORE THE AUDIT?

•Use this checklist to prepare yourself for a thoroughly successful audit.

•Know the Quality Policy.
•Know where you can get access to the latest procedures that apply to your job functions. They need to be close
by.
•Be sure that you have only controlled copies and that you know how to tell if they are current.
•If you have different revision levels of the same controlled document, see your supervisor for instructions.
•Review the current documented procedures against the actual methods used to perform your activities, and bring
any differences between what they say and what you do to your supervisor’s attention.
•Use the procedures to find answers to those questions you might be asked (see above)
•Understand your responsibilities and the applicable procedures concerning how to handle, identify and report
non-conforming product.
•If you use production, inspection, measuring or  test equipment, be certain they have been currently calibrated or
checked
•Know what training, if any, (formal or OJT) you have had for each job that you do.
•Know who your ISO9001 Management Representative is.
•Know the quality objectives that the company is using to measure the performance of the system. If you don't
know what they are, ask your supervisor .
WHAT DO I DO DURING THE AUDIT?
•Listen carefully to the questions asked by the auditor. Answer only the questions asked. Tell the facts as you know
them. Don’t speculate. Don't try to tell him/her what you think they might want to hear. If you don’t know the answer
to a question, say so.
•Remember, what we have learned from politicians. The more they speak, the less they say. The people who go on
and on are usually the ones trying to hide how little they really know. Smoke screens don’t work.
•Do not volunteer any additional information, especially in response to a closed-end (Yes/No) type question.  (If the
auditor needs more information, he/she will ask.)
•If you are not sure you understand a question (audit terms and audit language can be a bit strange), say so, or
repeat the question back in your own words. " I think you are asking me………..….Is that correct?"
•When asked to describe what you do or how you do it, get the applicable procedure, open it up and use it as a
discussion guide. "Here, Mr./Ms. Auditor, let me show you what the procedure says." There is no reason for you to
try to remember everything it says. It isn't expected. Remember procedures are there to be used. This is the perfect
time and place to use them!
•Don't argue with the auditor. If he/she says something you do not agree with, you can say something like, "I'm not
sure I agree with that. I'll have to think on it a while." External auditors are highly trained. It isn’t likely that you will be
put in such a position.
•You know more about your job than the auditor knows. Don't be afraid to show your confidence in yourself. That's
one of the things a good auditor likes to see. It tells him that you are in control.
•Relax. Relax. Relax. I have not yet met an ISO registration auditor who wasn't friendly, respectful and interested in
putting you at ease.
•In spite of what some people might believe, the auditor’s job is not to catch you doing things wrong. In fact, the
auditor’s goal is to catch you doing things right.
•A properly written audit report will include observations made about the activities that were verified, along with
findings about any that were found to be non-conforming. It will even identify practices that the auditor considers
outstanding.
•The audit report will never single out any individual for criticism.
•This guidance has been prepared to assist you and your associates in preparing for a successful audit. Most of its
advice applies equally to external (registration) audits and to internal audits conducted by your own staff.
Typical Audit Questions
 You can select from this inventory of recommended inquiries when auditing your quality system. They are
designed to elicit as much information as possible. Please note that most are open-ended questions (cannot be
answered Yes/No). They have intentionally been drafted to be benign and non-threatening. Every effort should be
made to keep the tone of your inquiries relaxed and conversational.
About your job:
Would you give me a "birds eye view" of your job?
What operating steps do you take? Including set-up
What is the Input/Output of your job? (In other words, what do you need to get started and what do you deliver to
your internal customer when you are done?
Who are your interfaces?  Who is your Suppler? Your Customer?
What quality records do you create? (Usually this is a form you fill out.)
Where is it kept and how long do you keep it?
 About your training
What kind of training did you receive?
Were you trained in ISO9001 requirements?
Did you receive a document or training certificate?
 About improvements
What are you doing to improve your processes?
Document
Do you have Procedures, Work Instructions, Drawings, etc.?
How can you tell if they are the latest revision?
Please show them to me.
In your opinion, how important or useful are they to your job?
How often do you need to refer to them in order to perform your job properly?
From your experience, how often do they change?
How do you find out about revisions? Do you get the revisions in a timely fashion?
In your opinion, are they accurate?
•Do they contain more detail than needed, less than nneded, or are they OK, as is?
•Is there a flow chart available?
Input
What is the Input of your job? What do you need?
From where or whom does it come (Supplier interfaces)?
How do you determine that the input is acceptable? What do you receive from your "supplier" that tells you? What
do you do that tells you?
In-Process
What operating steps do you then take? Including set-up.
What documents do you have or use that provide these instructions?
What circumstances occur that cause you to do it different than the way you described it? (Is it done this way all
the time?) If there are others doing this same process, how do they do it differently?
What tools or equipment do you use?
How were you trained in their use? What instructions do you have about their use?
Do these tools need to be calibrated?
If so, how can you tell if they are calibrated?
What would you do if you found one that is either damaged, out of calibration, or you found one you suspect
might be out of calibration?
While performing the process, what do you do to control it or inspect it?
What statistics do you use?
Output
What is the Output of your job? Who are your "Customers"?
What is done to ensure output is acceptable?
What tests are made?
What constitutes a successful completion of your job?
Do you sign off?
Is higher approval required?
Records
What forms do you have to complete or what records do you have to prepare?
What happens to them?
Where do you keep them?
For what length of time?

Management Direction
What can you tell me about the company's Quality Policy?
What meaning does it have to you?
What can you tell me either about the company's Quality Objectives or any departmental Quality Objectives you
might have?
What impact do you have on the Policy or on the Objectives insofar as your job and the way you perform it?
How do you measure your success?
Improvement
Please share with me some of the troublesome or repetitive problems you experience?
What can you tell me about what has been done to identify and eliminate the causes of those problems?
If you were the boss, what changes or improvements would you make?
What are you doing to improve your process/function?
This guidance has been prepared to assist you and your associates in conducting and preparing for successful
audits.
Typical Audit Questions
 
You can select from this inventory of recommended inquiries when auditing your quality system. They are designed
to elicit as much information as possible. Please note that most are open-ended questions (cannot be answered
Yes/No). They have intentionally been drafted to be benign and non-threatening. Every effort should be made to
keep the tone of your inquiries relaxed and conversational.
Snapshot
•Please give me a birds eye view of your job.
Documentation
•Do you have Procedures, Work Instructions, Drawings, etc.?
•How can you tell if they are the latest revision?
•Please show them to me.
•In your opinion, how important or useful are they to your job?
•How often do you need to refer to them in order to perform your job properly?
•From your experience, how often do they change?
•How do you find out about revisions? Do you get the revisions in a timely fashion?
•In your opinion, are they accurate?
•Do they contain more detail than needed, less than nneded, or are they OK, as is?
•Is there a flow chart available?
Input
•What is the Input of your job? What do you need?
•From where or whom does it come (Supplier interfaces)?
•How do you determine that the input is acceptable? What do you receive from your "supplier" that tells you?
•What do you do that tells you?
In-Process
•What operating steps do you then take? Including set-up.
•What documents do you have or use that provide these instructions?
•What circumstances occur that cause you to do it different than the way you described it? (Is it done this way all
the time?) If there are others doing this same process, how do they do it differently?
•What tools or equipment do you use?